Commit Graph

581 Commits

Author SHA1 Message Date
Vadim Yanitskiy c2729a525c fix use-after-free in ipaccess_bts_keepalive_fsm_alloc()
In ipaccess_bts_keepalive_fsm_alloc() we allocate a keepalive FSM
instance as a child of the respective struct ipa_client_conn, and
store the pointer to the respective struct e1inp_ts.

  + struct e1inp_line
  |
  ---+ struct ipaccess_line (void *driver_data)
  |  |
  |  ---+ struct ipa_client_conn *ipa_cli[NUM_E1_TS]  // <-- parent
  |
  ---+ struct e1inp_ts ts[NUM_E1_TS]
  |  |
  |  ---+ .driver.ipaccess.ka_fsm  // <-- pointer

When an ipaccess connection (be it OML or RSL) goes down and then
up again, for instance if the BSC gets restarted, osmo-bts crashes.
The problem is that struct ipa_client_conn gets free()ed before the
associated FSM instance gets terminated:

* e1inp_ipa_bts_rsl_connect_n() is called
** calling e1inp_ipa_bts_rsl_close_n()
*** this function free()s struct ipa_client_conn
*** (!) as well as the struct osmo_fsm_inst (talloc child)
** calling ipaccess_bts_keepalive_fsm_alloc()
*** calling ipaccess_keepalive_fsm_cleanup()
**** accessing free()d e1i_ts->driver.ipaccess.ka_fsm
**** BOOOM!  segmentation fault

Fix this by calling ipaccess_keepalive_fsm_cleanup() before free()ing
the associated struct ipa_client_conn.

Note that ipaccess_bsc_keepalive_fsm_alloc() is not affected because
it's allocating keepalive FSMs using the global tall_ipa_ctx.

Change-Id: Ic56c4b5b7b24b63104908a0c24f2f645ba4c5c1b
Related: SYS#6438
(cherry picked from commit f6bde0f521)
2023-05-08 22:18:14 +07:00
Oliver Smith 231f67ebb2 Run struct_endianness.py
Ensure there is no diff to prepare to run this in CI.

Related: OS#5884
Change-Id: Ib78f02bcd63455abedd713fa5ca6a67020a17594
(cherry picked from commit 3dacef93ca)
2023-05-08 22:18:14 +07:00
Philipp Maier cf890391ee trau_sync: add Ericsson RBS GPRS TRAU synchronization pattern (16kbps)
For GPRS TRAU frames (Ericsson calls them GSL frames), Ericsson
introduces a  proprietary synchronization pattern. There are slightly different
patterns used for synchronization and data, however the intersection of both
still provides reliable synchronization. There is no need to switch the pattern
depending on the frame type.

Change-Id: I8398f8bbfc51530e37c4328f25155b774394e779
Related: OS#5198
2022-12-23 11:04:08 +00:00
Daniel Willmann f2c76035fb ipa: Guard against calling ipa_client_conn_open* multiple times
Change-Id: I574af543429d01c9522e267265e97e4efe55b60c
2022-12-15 16:10:36 +01:00
Daniel Willmann c20af05bfc ipaccess: Add connect timeout in e1inp_line
* VTY command e1_line N connect-timeout T to set the connect() timeout
* use ipa_client_conn_open2 to connect with timeout

Related: SYS#6237
Change-Id: I7379102d19c172bed2aa00377d92bc885f54b640
2022-12-15 16:10:36 +01:00
Daniel Willmann 6113525d6b ipa: Add ipa_client_conn_open2 with connect timeout argument
Related: SYS#6237
Change-Id: Iaeb672a4c981e9769443fb0cd6c8e59cb76307bd
2022-12-15 16:10:36 +01:00
Daniel Willmann 8e38094664 ipaccess: Clean up keepalive FSM properly
Fixes: OS#5828
Change-Id: I0a54c1056e43161edc86c570e80be51d7517f411
2022-12-14 11:25:00 +01:00
Harald Welte ce70074476 trau_sync: Fix typo tray_sync_pat_id -> trau_sync_pat_id
... plus add a #define for compatibility with old source code.

Change-Id: I472107bfbed10a8cadd4736ce84120b24a5579f8
2022-11-30 18:11:29 +01:00
Harald Welte 9d90eb9960 trau_sync: Add the V.110 sync pattern
ITU-T V.110 is used in GSM CSD (Circuit Switched Data).  The frames
are rather similar to TRAU frames, so we can use the trau_sync code
for it.  This commit adds the related definition.

Related: OS#4395
Change-Id: I3aab5c3f494f6ea2b11f3cf69fb09bc77ea941d8
2022-11-30 15:35:15 +01:00
Oliver Smith 3d8426e4c4 ipaccess: update_fd_settings: use LOGL_ERROR
Use LOGL_ERROR if setsockopt fails, so errors are less likely to go
unnoticed.

Related: OS#5786
Change-Id: I519a88dce30c01d2ea02cf900b1892497b494e09
2022-11-23 14:14:07 +01:00
Oliver Smith fa19b2d9db ipaccess: require tcp keepalive related defines
Fail the compilation if TCP_KEEPIDLE, TCP_KEEPINTVL, TCP_KEEPCNT or
TCP_USER_TIMEOUT are not defined.

Harald wrote:
> What we want to prevent is the user configuring timeouts, assuming
> they would be installed into the kernel TCP stack, which then simply
> end up no-ops becaus somehow the libc didn't define them or the right
> #include file was not present at compile time.
>
> [...] Apparently TCP_KEEP{IDLE,INTVL,CNT} were introduced with kernel
> 2.4 and TCP_USER_TIMEOUT with 2.6.37. I think it's fair to say that
> using a modern/master libosmo-* on such old systems might fail for
> various other reasons (eventfd, ...) and cannot be considered a valid
> configuration anyway.

Closes: OS#5786
Change-Id: Idc0ff1ff02ce4b994692d8213c14c0b2caad756e
2022-11-23 14:05:26 +01:00
Oliver Smith ef0f7c25f0 e1_input: enable tcp keepalive by default
Set the keepalive parameters to E1INP_USE_DEFAULT initially instead
of 0. Do this independent of the driver (the only driver making use of
this is ipaccess).

Closes: OS#5785
Change-Id: Ia7659c209aea0d26eb37d31e771adc91b17ae668
2022-11-23 12:34:00 +01:00
Harald Welte 35c109fd8b Support building with -Werror=strict-prototypes / -Werror=old-style-definition
Unfortunately "-std=c99" is not sufficient to make gcc ignore code that
uses constructs of earlier C standards, which were abandoned in C99.

See https://lwn.net/ml/fedora-devel/Y1kvF35WozzGBpc8@redhat.com/ for
some related discussion.

Change-Id: I5ca56d885b5ce4d4c9f91ffc083c05a48d1306e4
2022-11-03 12:21:11 +01:00
Harald Welte 4b77d42ea6 input/unixsocket: Remove write delay timer
Unlike with classic E1 or nanoBTS, there is no reason why we would
use a delay timer when talking over a unix domain socket between
two osmocom programs.  Let's remove the write-delay timer.

Change-Id: I642d2e4495a08ce45e9a4492e98255aacd0be39a
2022-10-27 13:40:04 +02:00
Pau Espin c4c3a856ad ipaccess: Call line->ops->sign_link_down() only if set
This op must not necessarily be set by the user, so check if it is set
before calling it.

Change-Id: I666c5bbf157fe604e336df44f7eac098572d42ba
2022-09-19 16:57:42 +02:00
Pau Espin 3d3e5afb52 ipaccess_close(): No need to lookup already available struct e1i_ts
Change-Id: I54a69cad5adc3df3f95dd51e00ea68bb04ba9963
2022-09-19 16:57:42 +02:00
Pau Espin 2b52ac5dbd e1inp_line_ipa_rsl_ts(): Return null instead of reading out of bounds
Change-Id: Ic382ab509e4541124f36df153e4b247d9cba35c5
2022-09-19 16:57:42 +02:00
Pau Espin 57a148f332 ipa: Allow users closing lower layer tcp/ipa connections
This is useful for users to abort connections which are in "connecting"
state, since the higher layer struct e1inp_sign_link is not provided to
the user until the TCP+IPA handshake in the socket becomes fully
established (sign_link_up() callback).

This is intended for osmo-bts: when something fails and may enter into
SHUTDOWN state, it is desirable to close new RSL links (sockets) which
are in progress to connect, while it waits for a while to complete
shutdown (power ramping down, etc.).

Change-Id: Ia6418321f3b6f1f7274efd414625a4b10a09a362
2022-09-19 16:57:38 +02:00
Pau Espin 5b42f98089 cosmetic: Remove unneeded empty line
Change-Id: If72058144d0ea4031ec0f4aea7f2b4f20859c014
2022-09-19 16:51:38 +02:00
Jan Engelhardt 74c8eba5ad pkgconf: require libosmocore
osmocom/abis/e1_input.h includes osmocom/core/linuxlist.h, therefore
the .pc file(s) need a dependency on libosmocore so that the Cflags
from libosmocore.pc make an appearance on the compiler command line
when using `pkg-config libosmoabis --cflags`.

Committed-by: Max <msuraev@sysmocom.de>
Change-Id: Iacf4ccdb1c2a0e64ac997bda11161b8fe2548725
2022-08-10 16:19:12 +07:00
Vadim Yanitskiy 79fbccf293 libosmo{abis,trau}: add -no-undefined to *_la_LDFLAGS
Make sure that there is no undefined references in shared libraries.

Change-Id: Ib03f939d532173d9e4fcfdf5476c458a21c2c665
2022-08-04 05:18:21 +07:00
Pau Espin 8933b8f7cd configure.ac: Set libosmo-e1d dependency version
Change-Id: I2c6e50f73090a2134485d68a189036bc0aa00266
2022-06-29 12:15:31 +02:00
Pau Espin 59a0c91904 Bump version: 1.2.0.14-dcbc-dirty → 1.3.0
Change-Id: I14b709d38d655d9c6f5238462da2f7b21c103898
2022-06-28 17:59:38 +02:00
Harald Welte dcbc00d0c4 osmo_pcap_lapd_write: Fix write of uninitialized byte(s)
The problem is that we don't zero-initialize the struct pcap_rechdr +
pcap_lapdhdr before memcpy'ing them to buf, before we call write:

==20097== Syscall param write(buf) points to uninitialised byte(s)
==20097==    at 0x4E48471: write (write.c:26)
==20097==    by 0x4DA8DE9: osmo_pcap_lapd_write (lapd_pcap.c:168)
==20097==    by 0x4DA8433: send_ph_data_req (lapd.c:628)
==20097==    by 0x4C94F5C: lapd_send_rej (lapd_core.c:536)
==20097==    by 0x4C9A08A: lapd_rx_i (lapd_core.c:1574)
==20097==    by 0x4C9AA8F: lapd_ph_data_ind (lapd_core.c:1708)
==20097==    by 0x4DA7C55: lapd_receive (lapd.c:496)
==20097==    by 0x4D96B2C: e1inp_rx_ts_lapd (e1_input.c:778)
==20097==    by 0x4D9C97C: handle_ts_sign_read (e1d.c:78)
==20097==    by 0x4D9D908: e1d_fd_cb (e1d.c:281)
==20097==    by 0x4D1281B: poll_disp_fds (select.c:361)
==20097==    by 0x4D12928: _osmo_select_main (select.c:399)
==20097==  Address 0x1ffefffed7 is on thread 1's stack
==20097==  in frame #1, created by osmo_pcap_lapd_write (lapd_pcap.c:129)

The whole idea of first filling the two structs on the stack, and then
copying them to another buffer on the stack is somehow weird.  Let's
just create a combined struct on the stack and then fill that one
directly.

Change-Id: I358c71354cc6ddad1964cc4a988ad29b7ba617f1
Closes: OS#5592
2022-06-27 08:07:48 +02:00
Harald Welte 1885e0422a update git URLs (git -> https; gitea)
Change-Id: I9b41e0b88785d34809db0e62e82aaa71f8127f71
2022-06-18 14:05:53 +02:00
Harald Welte 3d41fc6815 update git URLs (git -> https; gitea)
Change-Id: I9edabaefe7081493fb639760d311f02c01da0155
2022-06-17 23:12:04 +02:00
Pau Espin 90df035a8d input/ipaccess: Avoid extra poll() call when e1i_ts tx queue becomes empty
Before this patch, the logic (both for delayed tx and immediate tx)
always left the WRITE flag set, and relied on an extra call back from
the main loop (poll()) to disable the flag until it found out there was
nothing else to send.
Instead, let's disable it immediatelly at the time we submit the last
message in the queue.

Change-Id: I0e5da5d1342f352d0e2bca9ee39c768bccb2c8d5
2022-05-09 12:59:48 +02:00
Pau Espin d20a10c58b input/ipaccess: Remove unneeded osmo_fd_write_enable()
Recent commit optimize the same function by avoiding an extra poll loop
when e1i_ts->sign.delay was zero. Upon doing so, the
osmo_fd_write_disable() was moved to some conditional paths. Hence, the
WRITE flag is left set and we don't need to set it again in the code
path modified in this commit.

Fixes: 28fea7746b
Change-Id: I84787b6de2a5ccc82bd8f19ce874e73708bc287f
2022-05-09 12:48:54 +02:00
Harald Welte 28fea7746b input/ipaccess: Don't start zero-ms timer on every write
Historically, before November 15, 2010 when commit
d49fc5ae24fc9d44d2b284392ab619cc7a69a876 was merged to [back then]
OpenBSC, before libosmo-abis became a separate library, we used to
have a 10us delay timer for subsequent writes to ip.access nanoBTS 900.

    ts: Reduce the delay to 0 for OML and RSL

    This is possible after not sending more than one OML command that
    requires an extra ACK. For the RSL line we do not need any speed
    limitation.

Ever since the above-mentioned commit, the BSC always sets that timeout
to zero, which makes libosmo-abis start a zero-microsecond libosmocore timer,
which in turn will make libosmocore call select/poll with zero timeout, which
makes the kernel return immediately.

Why not remove the timer completely? Because ipaccess-config.c still specifies
a non-zero signaling delay, and we cannot be sure that this is really not
needed.

So let's alter the code to only start the timer if it's non-zero

Change-Id: I9c379364e7e6afce35fc6316392b5b33748980f7
2022-05-08 18:32:01 +00:00
Michael Iedema ee2589e484 stats: add site_id scope to ipa-rsl tcp stat names
Multiple IPA units can have the same bts_id but scoping by their
site_ids will make them unique. This also clarifies the "bts"
number being communicated. It is not the bts configuration index
in osmo-bsc.cfg, it is the bts id specified in the vty line:

bts X
 ipa unit-id SITE BTS

Change-Id: I3b44319fb4bc6a812800001c58dfe1a664645b43
2022-05-03 10:26:28 -07:00
Vadim Yanitskiy adb2e1666f input/e1d: use msgb_hexdump_l2() in handle_ts_raw_read()
Change-Id: I17f4ab1315f0fdab71ccbe45fc83facf2c9ea641
2022-04-18 02:13:21 +03:00
Vadim Yanitskiy bb9cba0167 input/e1d: fix a memleak in handle_ts_raw_read()
Change-Id: I18965d1ef67a388e7bcdddd0314a9090e34c89e0
2022-04-18 02:12:00 +03:00
Michael Iedema 296678662a stats: add BTS index to IPA RSL TCP stats name
With this change, the new TCP stat names more closely
resemble existing RSL related stat names.

Change-Id: If7ae7f0e75de37e2e52a8ed724c861f57d0da574
2022-02-24 09:25:20 -08:00
Michael Iedema 95a8d6f2ef stats: add RSL line number to TCP stats name
Change-Id: Ie42d8a0cb3757f2d01a4b6d69ea2bcce400b7538
2022-02-10 09:20:22 -08:00
Philipp Maier f5f31d34d1 ipaccess.c: register RSL/OML related osmo_fds for monitoring
The osmo_fds used for ipaccess based E1 traffic should be registered for
monitoring to get tcp_stats for all RSL/OML links.

Change-Id: I42ca4e9257eee2857784dd4f5b17a83220e2be9e
depends: libosmocore I64b288174ae3dd22d50a701ce7cbf9e623246479
Related: SYS#5701
2022-01-04 16:58:48 +01:00
Oliver Smith 2650b57400 treewide: remove FSF address
Remove the paragraph about writing to the Free Software Foundation's
mailing address. The FSF has changed addresses in the past, and may do
so again. In 2021 this is not useful, let's rather have a bit less
boilerplate at the start of source files.

Change-Id: I0ad20cdf1e571c1a15f6e67d46e07155a6a02520
2021-12-14 11:58:39 +01:00
Harald Welte a864378936 lapd: don't add parenthesis around datalink name
The name [printing] works like this:

* libosmo-abis:lapd tells libosmogsm:lapd_core a name for each data link
* libosmgsm:lapd_core assumes this name has no paranthesis and puts additional
  parenthesis around it in macros like LOGDL

However, current libosmo-abis:lapd [before this patch] adds its own set
of parenthesis, causing all ISDN-LAPD related log messages generated by
libosmgsm:lapd_core to have double-parenthesis.

So we have to remove the parenthesis from lapd_datalink.name and
lapd_instance.name to fix the log lines printed in libosmocore.

This in turn means we have to add parenthesis to some log statements
here in libosmo-abis:lapd.

Why can't we instead modify libosmogsm:lapd_core to drop parenthesis
there? Becaus it is also used by LAPDm code in osmo-bts, and those two
get it right :)

Change-Id: I688cf2a73a8c31cb3cf66ec005d02a14de197008
Related: Ie6742843fff809edffcac24c4dce4edf66bc71be
Related: OS#1938
2021-11-17 20:19:08 +00:00
Pau Espin a6eda5ae01 Bump version: 1.1.1.14-57ff-dirty → 1.2.0
Change-Id: I0536137e6221fd322536111dfda6e19d3c57de6c
2021-11-16 14:18:45 +01:00
Pau Espin 57ff57ac5c e1inp_input: Fix e1inp_line_clone removing original line from global list when freed
Since a recent commit (see hash below), e1_input.c code was fixed to
release the line from the global line list (e1inp_line_list) before
freeing the object. However, the change didn't have into account that
there were cloned lines from the original one which had a duplicate of
the original line->list. Hence, whenver a clone was freed, it actually
removed the original line from the global list.

Since the original line is the one actually holding the permanent
reference due to being configured over VTY, let's fix e1inp_line_clone
to reset the clone->list so that whenever it is freed it doesn't affect
the original line.

Fixes: 49924f0a79
Related: SYS#5642
Change-Id: I0627da0d28057649b494e2bd83b283b09fb9a2d7
2021-10-13 16:38:02 +02:00
Pau Espin 92aee5109c ipaccess: e1inp_ipa_bts_rsl_connect: Fix memleak recreating ipa_client_conn
If BTS, using this app, tried to use it in order to re-create the
connection, it would leak the previous strut ipa_client_conn. A similar
fix was already put in place recently for OML, but it was not applied
for RSL.

The leak was spotted by having a BTS connecting fine over OMl but then
failing each time to connect on RSL.

Related: OS#5248
Change-Id: I4ee1ae318b446490783c8b910fca10ba5f72dd5a
2021-10-11 12:16:30 +02:00
Pau Espin d2d28d83a4 ipaccess: Allow reconfiguring the ipa line during line_update()
The e1inp_line_update() API is precisely aimed at that: tell that we
want to reconfigure some aspects of the e1 line. Hence, it makes no
sense to apply a no-op with the flag "line_already_initialized".
That flag was added a long time ago in order to avoid problems when
several BTS are attached to the same ipa server link. That case doesn't
apply to the BTS role, so we can simply recreate the ipa_cli_conn.

Fixes: d6216405b7
Change-Id: Iff8092f88726cf238dac2abb99e135ac5864272d
2021-09-29 14:32:13 +02:00
Pau Espin dd48e257ab e1_input: Document e1inp_line_create()
Specially important regarding the pre-allocated reference count.
This was done when moving the API to use osmo_use_count internally,
because previous code already came with refcount=1.

Change-Id: I819a13732c5d0ff150bc11d1cfd64e96ee81bad2
2021-09-22 19:37:56 +02:00
Pau Espin 49924f0a79 e1_input: Fix line not removed from e1inp_line_list when freed
This was not an observable issue so far because both osmo-bts and
osmo-bsc used to keep the same line created once, keeping at least 1
reference count to it.

Change-Id: I1314d6b917ecb622994507475eb894e649a1a2ad
2021-09-22 19:32:15 +02:00
Pau Espin 24e0217c2e osmo_ortp: Fix seqno reset to 0 upon ssrc_changed
It was spotted in an osmo-mgw instance receiving RTP from osmo-bts 1.2.3
that sometimes the seqno was reset to 0 (while tx_timestamp was kept
properly). This seems to be the only possible way osmo-bts can reset the
seqno to 0 (calling rtp_session_reset()), since osmo_rtp_socket_create
already sets it to other values and inside ortp rtp_session_reset() is
the only one setting it to 0.
If SSRC changes, we are fine resetting some Rx state, which is done by
calling rtp_session_resync. However, calling rtp_session_reset() is too
much, since it erases other stuff like Tx state, which sholdn't be
affected in this case, since we are still transmitting the same stream.

Related: OS#3104
Related: OS#3299
Related: SYS#5498
Fixes: 28eeb6bc93

Change-Id: Ic6006b4991c85413b009b70f8f3a6f97c41990ec
2021-07-20 14:29:40 +02:00
Pau Espin c5f1d4f9d3 Use new stat item/ctr getter APIs
Generated with spatch:
"""
@@
expression E1, E2;
@@
- &E2->ctr[E1]
+ rate_ctr_group_get_ctr(E2, E1)
"""

Change-Id: I064aae995975a379425d5f21221fa48efc6d05f9
2021-06-04 17:53:33 +02:00
Philipp Maier ea0f1bd49e ipaccess: do not block ipaccess_line_update on failure
The function ipaccess_line_update (called when the API user calls
e1inp_line_update and the line is of type ipaccess) internally sets
the line_already_initialized regardless whether the initalization is
successful or not.

This also means that if the initalization fails the API user is unable
to retry the initalition with corrected line options.

Change-Id: I90d330e2864f85b964628502afdb0c38eb54f15d
Related: SYS#4971
2021-05-20 21:11:50 +02:00
Keith Whyte df088b0ea9 Fix up vty 'show' commands for E1 line/timeslots
Change-Id: I6af92ae2808713c74afeecaa1f500443fb2b7795
2021-05-05 14:07:40 -05:00
Keith Whyte bbff304e2e Log TRAU FSM at INFO not NOTICE
During normal operations, osmo-mgw floods the log/vty at level NOTICE with:

 Received Event RX_BITS (trau_sync.c:525)

Change-Id: Ib4c5ac130e766906361c63090b30111970343075
2021-05-04 15:43:06 -05:00
Harald Welte 14277e3375 trau: Introduce osmo_rtp_socket_set_priority()
For consistency reasons with osmo_rtp_socket_set_dscp(), let's also
introduce a osmo_rtp_socket_set_priority() function to wrap the two
calls to osmo_sock_set_priority().

Change-Id: I52c08f4b2a46981d002ef0c21e6549445d845a6e
2021-04-29 21:44:18 +02:00
Harald Welte 41547559da e1_input: Allow (vty) configuration of IP DSCP and socket priority
Change-Id: I8991dd6eb406a5b9a70498974fc1ad339452f871
Related: SYS#5427
2021-04-29 21:24:28 +02:00