Change in osmo-sgsn[master]: gprs_gmm: Check for RAT change and ensure this only happens for RAU/ATT

[daniel]

daniel has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/17081 )


Change subject: gprs_gmm: Check for RAT change and ensure this only happens for RAU/ATT
......................................................................

gprs_gmm: Check for RAT change and ensure this only happens for RAU/ATT

Change-Id: I38cb31907eddeade5350cdb648df179408d908d2
Related: OS#3727
---
M src/sgsn/gprs_gmm.c
1 file changed, 27 insertions(+), 0 deletions(-)



  git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/81/17081/1

diff --git a/src/sgsn/gprs_gmm.c b/src/sgsn/gprs_gmm.c
index f62d0d1..c574dac 100644
--- a/src/sgsn/gprs_gmm.c
+++ b/src/sgsn/gprs_gmm.c
@@ -1099,6 +1099,16 @@
 	osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
 }
 
+/* Detect if RAT has changed */
+static bool mmctx_did_rat_change(struct sgsn_mm_ctx *mmctx, struct msgb *msg)
+{
+	if (MSG_IU_UE_CTX(msg) && mmctx->ran_type != MM_CTX_T_UTRAN_Iu)
+		return true;
+	if (!MSG_IU_UE_CTX(msg) && mmctx->ran_type != MM_CTX_T_GERAN_Gb)
+		return true;
+	return false;
+}
+
 /* 3GPP TS 24.008 § 9.4.1 Attach request */
 static int gsm48_rx_gmm_att_req(struct sgsn_mm_ctx *ctx, struct msgb *msg,
 				struct gprs_llc_llme *llme)
@@ -1944,6 +1954,23 @@
 		return rc;
 	}
 
+	/* A RAT change is only expected/allowed for RAU/Attach Req */
+	if (mmctx && mmctx_did_rat_change(mmctx, msg)) {
+		switch (gh->msg_type) {
+		case GSM48_MT_GMM_RA_UPD_REQ:
+		case GSM48_MT_GMM_ATTACH_REQ:
+			break;
+		default:
+			/* This shouldn't happen with other message types and
+			 * we need to error out to prevent a crash */
+			LOGMMCTXP(LOGL_NOTICE, mmctx, "Dropping GMM %s which was received on different "
+				       "RAT (mmctx ran_type=%u, msg_iu_ue_ctx=%p\n",
+				       get_value_string(gprs_msgt_gmm_names, gh->msg_type),
+				       mmctx->ran_type, MSG_IU_UE_CTX(msg));
+			return -EINVAL;
+		}
+	}
+
 	/*
 	 * For a few messages, mmctx may be NULL. For most, we want to ensure a
 	 * non-NULL mmctx. At the same time, we want to keep the message

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/17081
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I38cb31907eddeade5350cdb648df179408d908d2
Gerrit-Change-Number: 17081
Gerrit-PatchSet: 1
Gerrit-Owner: daniel <dwillmann at sysmocom.de>
Gerrit-MessageType: newchange
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200130/e17fe0a3/attachment.htm>