Detected while running a TTCN3 sending malformed SCCP message in
SCCP_Tests_RAW.ttcn:
sccp_user.c:174:12: runtime error: member access within null pointer of type 'struct xua_msg'
ASAN:DEADLYSIGNAL
=================================================================
==6==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f2a11f93c5c bp 0x7ffefcf05c50 sp 0x7ffefcf05c10 T0)
#0 0x7f2a11f93c5b in mtp_user_prim_cb /tmp/libosmo-sccp/src/sccp_user.c:174
#1 0x7f2a11fb48f9 in deliver_to_mtp_user /tmp/libosmo-sccp/src/osmo_ss7_hmrt.c:94
#2 0x7f2a11fb4c8a in hmdt_message_for_distribution /tmp/libosmo-sccp/src/osmo_ss7_hmrt.c:133
#3 0x7f2a11fb5c90 in m3ua_hmdc_rx_from_l2 /tmp/libosmo-sccp/src/osmo_ss7_hmrt.c:275
#4 0x7f2a11f6f5c2 in m3ua_rx_xfer /tmp/libosmo-sccp/src/m3ua.c:586
#5 0x7f2a11f70480 in m3ua_rx_msg /tmp/libosmo-sccp/src/m3ua.c:739
#6 0x7f2a11faee35 in xua_srv_conn_cb /tmp/libosmo-sccp/src/osmo_ss7.c:1623
#7 0x7f2a0f46d082 (/usr/lib/x86_64-linux-gnu/libosmonetif.so.8+0xb082)
#8 0x7f2a1186c0be (/usr/lib/x86_64-linux-gnu/libosmocore.so.12+0xc0be)
#9 0x7f2a1186c735 in osmo_select_main (/usr/lib/x86_64-linux-gnu/libosmocore.so.12+0xc735)
#10 0x557378718219 in main /tmp/libosmo-sccp/examples/sccp_demo_user.c:264
#11 0x7f2a105ad2e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
#12 0x557378717059 in _start (/usr/local/bin/sccp_demo_user+0x6059)
Change-Id: Idafa8c9693d98ecd214b62155372e4db69e2a4a4
* Introduce check to make sure we don't write out of peer->host bounds.
* Clean up any/specific address checks, it should be more clear now.
Change-Id: I3ecb94267acbec6ecf2134b08110f24f131cd8cf
Server addresses (and remote added ones) were not being copied to the
ASP and hence connections were not matches against the ASP when
connecting:
osmo_ss7.c:1820 (r=127.0.0.2:2905<->l=127.0.0.1:2905): m3ua connection
without matching ASP definition and no dynamic registration enabled, terminating
Related: OS#4355
Change-Id: I77d4f4d733cb46eaaacc7dc32259c9851c79d78e
The code managing addresses is decoupled from xua_server since they will
also be used to manage addresses for ASPs.
Change-Id: I4af2a6915ac57c7baa67343bd9414c65154d67f7
It doesn't really change old behavior since it's impossible the child
function returned an error with current implementation, but let's better
return the return code in case new error paths are added.
Change-Id: I24747578b3412b385c1ea1a14922f543f9023a27
It seems that our TTCN3 VTY/Telnet module no longer supports '-'
inside prompts. Let's make sure the SCCP_Tests can again be executed
by removing them from our promt name here.
Change-Id: I4b6d7dd6fdf7521a4a9071e50ac1dcb2993c74bb
Old commit of mine successfully fixed a memory leak, but apparently
after some more investigation it seems to have introduced a double free
of xua object in other code paths.
Nowadays, it seems scrc_rx_mtp_xfer_ind_xua() is called from 3 different places:
mtp_user_prim_cb()
sua_rx_cl()
sua_rx_co()
Before present patch, first caller is not freeing the xua message and my
old commit made scrc_rx_mtp_xfer_ind_xua() free it (by passing
ownsership of the object). But the other 2 callers do free the xua
object afterwards (actually the grandparent caller sua_rx_msg() does
it), which means it would double-free the xua object.
Let's move ownership out of scrc_rx_mtp_xfer_ind_xua() and let the
caller free the xua object (only changes need on the first caller). This
way everybody is happy and we keep the free() closer to the alloc().
Change-Id: Ia550b781b97adbdc0a0ad58a1075e5467e056f1e
Related: OS#4348
Fixes: 9c3baa89fb
This reverts commit ffb248dd78.
Reason for revert: ttcn-msc-tests fail, apparently there are lots more
xua_msg_free() in scrc_rx_mtp_xfer_ind_xua() that need to be dropped
Change-Id: I008bcb6d5bad9e6347e7cd670159816f51331189
After dispatching to scrc_rx_mtp_xfer_ind_xua(), free the xua_msg.
Do not free the xua_msg in any of the code paths triggered within
scrc_rx_mtp_xfer_ind_xua(), i.e. remove xua_msg_free() from:
sccp_scoc_rx_from_scrc()
+->sccp_scoc_rx_unass_local_ref()
+->tx_coerr_from_xua()
+->tx_relco_from_xua()
Before this, some code paths would free the xua_msg, while most code paths
would not, causing mem leaks.
Change-Id: I72b3c6a6f57ba32d9ba191af33b4b236492174e0
let's avoid messages like
DLSS7 <000c> xua_asp_fsm.c:600 XUA_ASP(asp-client0){ASP_DOWN}: transition to state ASP_DOWN not permitted!
Change-Id: Iabbcf92e3022a4c3f165ce19be929915f92b455c
Make build and external tests work with python3, so we can drop
the python2 dependency.
This should be merged shortly after osmo-python-tests was migrated to
python3, and the jenkins build slaves were (automatically) updated to
have the new osmo-python-tests installed.
Related: OS#2819
Depends: osmo-python-tests I3ffc3519bf6c22536a49dad7a966188ddad351a7
Change-Id: I344c49001fba23bdcfdef06ab174c52b60edd01c
If we are running in ASP (client) role, and we are about to transmit an
ASPAC or ASPIA to the SG, we must make sure to include any applicable
routing contexts.
Change-Id: Iee4f0d553d6845a9ae08cb5e4f57fdec443e4ef9
Related: OS#4285
When a client (ASP) sends an ASPAC to the server (SG), it should include
the traffic-mode configured for it's ASs, if any.
Change-Id: Ia850df22df529dab74959e8666f85976002c482c
Related: OS#4285
we handle this correctly in not writing the actual "asp" configuration,
but we have a bug when writing the list of asps within one "as". Let's
make sure to skip the dynamically-created ASPs there, too.
Change-Id: I1a184f3ddec2e91ced8c95ada224da8b490407a8
Closes: OS#4284
The ASP role must be saved in lowercas as the parser during config file
reading only understands it in lowercase.
Change-Id: I38b8e4d73121f8bf001037fdd2dd164113544d94
Closes: OS#4270
The code to set the default role (SG) and default SCTP role (server)
must only be executed when the ASP node is first created. Subsequent
times entering the pre-existing ASP node should not overwrite
those role settings [or any other configuration for that matter]
Change-Id: I068996a5e0d870043b652fb69a3c300adc6fda7c
Closes: OS#4271
This is like osmo_ss7_asp_find_and_create(), i.e. it's doing a full
match for an ASP within the specified SS7 instance, of the specified
port numbers. It just doesn't create it if it is missing.
Change-Id: I1ed3cf2b69ee622d6f9d8b50487f392fe913ae90
Related: OS#4271
In general we want to avoid multiline log messages since they make
parsing more difficult. Also output in VTY over telnet looks strange
(indentation incremented at each new line).
Change-Id: Id9084d0e0f976bb374186db93d6ff8062b99e238
Since it may act sometimes as a server and sometimes as a client, let's
better use one more neutral (2-side arrow) connector, and mark which
address is the local and which is the remote. We already use same
formatting in other osmocom code.
Change-Id: I42feaa16790f02b98bcda65281de8cd9295ddcb6
Since there's no official spec for IPA and some
implementations seem to like sending the IPA ID ACK before
the IPA ID RESP, let's catch it and feed it after we receive
the IPA ID RESP and we are in correct state. Otherwise the connection
would deadlock during the initial handshake.
That's the case with our TTCN3 IPA implementation running STP_Tests
suite.
Change-Id: I99f5346a3854ca07979020245897334197f3cd3b
If AS is configured with Traffic Mode Override, then if a new ASP
becomes active, all previous ASPs are considered to be inactive and new
data is sent to the newly activated ASP.
Remark: It's still unclear which methodology/implementation will follow
when the last activated ASP becomes inactive/shutdown. Then probably
another one should be activated at that time, but that logic is not
there implemented as far as I know.
Change-Id: I4ff246b2f899aaa3cf63bbdb3f3d317dc89b3d15
Similar to what we do with local address. Should fix creating the stream
when no remote address is provided on an ASP configured through VTY.
Related: OS#4260
Change-Id: I33672e76a51a5d5a483906749d30e4c4e08b66ce
This change suspends the warnings about option 'subdir-objects',
by using the existing object file from the build directory.
Change-Id: I4dc2abb19c58fce0a12cc9799019878194c667d1
RFC4666 sec 4.3.4.3. ASP Active Procedures:
"""
In the case of an Override mode AS, receipt of an ASP Active message
at an SGP causes the (re)direction of all traffic for the AS to the
ASP that sent the ASP Active message. Any previously active ASP in
the AS is now considered to be in the state ASP-INACTIVE and SHOULD
no longer receive traffic from the SGP within the AS. The SGP or
IPSP then MUST send a Notify message ("Alternate ASP_Active") to the
previously active ASP in the AS and SHOULD stop traffic to/from that
ASP. The ASP receiving this Notify MUST consider itself now in the
ASP-INACTIVE state, if it is not already aware of this via inter-ASP
communication with the Overriding ASP.
"""
Change-Id: I474f5cc1f6cbab72d010d1f8ac7ed2285e4c1c45
Most likely, we want all dynamically allocated ASPs to play the SG
role by default. Otherwise when using the following configuration:
cs7 instance 0
xua rkm routing-key-allocation dynamic-permitted
listen m3ua 2905
accept-asp-connections dynamic-permitted
both OsmoMSC and OsmoBSC fail to establish connections.
Change-Id: Ib904ecf0e5d192a1024863f6f0fdf79301055655
Fixes: I2df9cd9747ad5c9a05d567d9a71bab6184c53674
Related: OS#4247
This way the AS can be configured to use different traffic modes over
time as long as they don't overlap in time. That is in this case where
no specific traffic mode is specified in AS local configuration (VTY).
Some RFC4666 state similar behvor of deleting data set by ASPs during AS
shutdown. For instance:
"""
Other ASPs may continue to be associated with the Application Server,
in which case the Routing Key data SHOULD NOT be deleted. If a
Deregistration results in no more ASPs in an Application Server, an
SG MAY delete the Routing Key data.
"""
This allows for tests to easily re-use same AS to test different traffic
modes as long as they wait for the recovery timeout (2 secs by default,
configurable via VTY).
Related: OS#4220
Change-Id: I370aa3b5ddfc456c1be5b2585f2f470d5aa8d289
The M3UA specification states that either of the two roles should
be the SCTP client and the other the server. It also states that
the default for the SGP is to operate as server. However, it permits
other configurations. Let's allow this to be configured by the VTY.
We need to ensure that while in ASP role, we don't send any NOTIFY
messages to the peer SG.
Change-Id: I7452a862d45da35dcd58654ca17222eb52d26f1f
Closes: OS#2005
So far, we had a static role model:
* SCTP servers (listening, such as OsmoSTP) are role SGW
* SCTP clients (connecting, such as OsmoMSC) are role ASP
While this is customary, it is not actually required by the
specification. The SGW can establish the SCTP connection to an ASP
but still remain "SG" role.
Let's make things more flexible by having the role configurable.
Related: OS#2005
Change-Id: I2df9cd9747ad5c9a05d567d9a71bab6184c53674
If the AS is e.g. configured as broadcast, then individual ASPs cannot
be activated in loadshare or override. Everyone must agree.
Change-Id: Ic73410fbc88d50710202453f759fa132ce14db4c
Pau Espin
Harald Welte
Neels Hofmeyr
Neels Hofmeyr
Oliver Smith