Change in osmo-bsc[master]: MSC pooling: LU: ignore TMSI NRI from a different PLMN

[laforge]

laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-bsc/+/18783 )

Change subject: MSC pooling: LU: ignore TMSI NRI from a different PLMN
......................................................................

MSC pooling: LU: ignore TMSI NRI from a different PLMN

Change-Id: Iac1158cff022b6365ce22bb70feaaff93e39172a
---
M src/osmo-bsc/gsm_08_08.c
1 file changed, 49 insertions(+), 0 deletions(-)

Approvals:
  Jenkins Builder: Verified
  laforge: Looks good to me, approved
  pespin: Looks good to me, but someone else must approve



diff --git a/src/osmo-bsc/gsm_08_08.c b/src/osmo-bsc/gsm_08_08.c
index 0707c65..46ef9af 100644
--- a/src/osmo-bsc/gsm_08_08.c
+++ b/src/osmo-bsc/gsm_08_08.c
@@ -123,6 +123,48 @@
 	return cm->cm_service_type == GSM48_CMSERV_EMERGENCY;
 }
 
+static bool is_lu_from_other_plmn(struct msgb *msg)
+{
+	const struct gsm48_hdr *gh;
+	int8_t pdisc;
+	uint8_t mtype;
+	const struct gsm48_loc_upd_req *lu;
+	struct osmo_location_area_id old_lai;
+
+	if (msgb_l3len(msg) < sizeof(*gh))
+		return false;
+
+	gh = msgb_l3(msg);
+	pdisc = gsm48_hdr_pdisc(gh);
+	mtype = gsm48_hdr_msg_type(gh);
+
+	switch (pdisc) {
+	case GSM48_PDISC_MM:
+
+		switch (mtype) {
+		case GSM48_MT_MM_LOC_UPD_REQUEST:
+			/* First make sure that lu-> can be dereferenced */
+			if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*lu))
+				return false;
+
+			lu = (struct gsm48_loc_upd_req*)gh->data;
+			gsm48_decode_lai2(&lu->lai, &old_lai);
+
+			if (osmo_plmn_cmp(&old_lai.plmn, &bsc_gsmnet->plmn) != 0)
+				return true;
+			break;
+
+		default:
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+
+	return false;
+}
+
 static bool is_msc_usable(struct bsc_msc_data *msc, bool is_emerg)
 {
 	if (is_emerg && !msc->allow_emerg)
@@ -198,6 +240,13 @@
 		if (osmo_tmsi_nri_v_get(&nri_v, mi.tmsi, net->nri_bitlen)) {
 			LOGP(DMSC, LOGL_ERROR, "Unable to retrieve NRI from TMSI, nri_bitlen == %u\n", net->nri_bitlen);
 			nri_v = -1;
+		} else if (is_lu_from_other_plmn(msg)) {
+			/* If a subscriber was previously attached to a different PLMN, it might still send the other
+			 * PLMN's TMSI identity in an IMSI Attach. The LU sends a LAI indicating the previous PLMN. If
+			 * it mismatches our PLMN, ignore the NRI. */
+			LOG_NRI(LOGL_DEBUG,
+				"This LU Request indicates a switch from another PLMN. Ignoring the TMSI's NRI.\n");
+			nri_v = -1;
 		} else {
 			is_null_nri = osmo_nri_v_matches_ranges(nri_v, net->null_nri_ranges);
 			if (is_null_nri)

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-bsc/+/18783
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-bsc
Gerrit-Branch: master
Gerrit-Change-Id: Iac1158cff022b6365ce22bb70feaaff93e39172a
Gerrit-Change-Number: 18783
Gerrit-PatchSet: 5
Gerrit-Owner: neels <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: daniel <dwillmann at sysmocom.de>
Gerrit-Reviewer: dexter <pmaier at sysmocom.de>
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: neels <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200618/8307d0c0/attachment.htm>