June 2024 - gerrit-log - lists.osmocom.org

[S] Change in pysim[master]: pySim.ota.OtaDialectSMS: Move SMS header construct up to class level

by laforge

Attention is currently required from: laforge. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/37140?usp=email to look at the new patch set (#6). Change subject: pySim.ota.OtaDialectSMS: Move SMS header construct up to class level ...................................................................... pySim.ota.OtaDialectSMS: Move SMS header construct up to class level this way we can use it in other [future] methods. Change-Id: If296f823c18864fddcfb9cb1b82a087bac8875d4 --- M pySim/ota.py 1 file changed, 13 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/40/37140/6 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37140?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: If296f823c18864fddcfb9cb1b82a087bac8875d4 Gerrit-Change-Number: 37140 Gerrit-PatchSet: 6 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 year

1
0
0 0

[L] Change in pysim[master]: add contrib/saip-tool.py

by laforge

Attention is currently required from: laforge, osmith. Hello Jenkins Builder, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/pysim/+/37011?usp=email to look at the new patch set (#8). Change subject: add contrib/saip-tool.py ...................................................................... add contrib/saip-tool.py This is a tool to work with eSIM profiles in SAIP format. It allows to dump the contents, run constraint checkers as well as splitting of the PE-Sequence into the individual PEs. Change-Id: I396bcd594e0628dfc26bd90233317a77e2f91b20 --- M contrib/jenkins.sh A contrib/saip-tool.py A pySim/pprint.py 3 files changed, 249 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/pysim refs/changes/11/37011/8 -- To view, visit https://gerrit.osmocom.org/c/pysim/+/37011?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I396bcd594e0628dfc26bd90233317a77e2f91b20 Gerrit-Change-Number: 37011 Gerrit-PatchSet: 8 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-MessageType: newpatchset

1 year

1
0
0 0

[M] Change in libosmo-abis[master]: trau2rtp_hr16: change output format to RFC 5993

by falconia

falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37152?usp=email ) Change subject: trau2rtp_hr16: change output format to RFC 5993 ...................................................................... trau2rtp_hr16: change output format to RFC 5993 Emitting RFC 5993 payload format instead of TS 101 318 brings Osmocom+E1 BSS into compliance with TS 48.103 (which requires RFC 5993 format at AoIP interface), and will also make it much easier to add optional support for TW-TS-002. There are no backward compatibility issues: OsmoMGW E1 support currently works only for FR and EFR, not for HR. Related: OS#6448 Change-Id: I0bcfdccbf4df5a5cd90a65525527f08107be2cf5 --- M src/trau/trau_rtp_conv.c 1 file changed, 43 insertions(+), 14 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/52/37152/1 diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c index e1e0391..069baab 100644 --- a/src/trau/trau_rtp_conv.c +++ b/src/trau/trau_rtp_conv.c @@ -147,40 +147,51 @@ static const uint8_t rtp_hr_sid[14] = { 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; -/*! Generate the 14 bytes ETSI TS 101 318 RTP payload for HR from a decoded 16k TRAU frame. - * Note that thsi differs from the IETF RFC5993 format. However, as OsmoBTS implements - * the TS 101 318 format, we also use the same format here. osmo-mgw can convert them. +/*! Generate an RFC 5993 RTP payload for HR from a decoded 16k TRAU frame. + * We previously emitted TS 101 318 format; however, RFC 5993 is the format + * specified in TS 48.103 for AoIP, it can also be extended with TRAU-UL-like + * capabilities with TW-TS-002, and we now support RFC 5993 output in OsmoBTS + * on all models. * \param[out] out caller-provided output buffer * \param[in] out_len length of out buffer in bytes * \param[in] tf input TRAU frame in decoded form * \returns number of bytes generated in 'out'; negative on error. */ static int trau2rtp_hr16(uint8_t *out, size_t out_len, const struct osmo_trau_frame *tf) { - unsigned int i; + enum osmo_gsm631_sid_class sidc; if (tf->type != OSMO_TRAU16_FT_HR) return -EINVAL; + if (out_len < GSM_HR_BYTES_RTP_RFC5993) + return -ENOSPC; + /* HR Data Bits according to TS 48.061 Section 5.1.4.1.1 */ - if (tf->dir == OSMO_TRAU_DIR_UL && tf->c_bits[11]) /* C12: BFI */ + sidc = (tf->c_bits[12] << 1) | tf->c_bits[13]; + /* both C13 and C14 being set is invalid combination */ + if (sidc > OSMO_GSM631_SID_CLASS_VALID) goto bad_frame; - if (out_len < GSM_HR_BYTES) - return -ENOSPC; + /* Plain RFC 5993 without TW-TS-002 extensions does not allow + * BFI or invalid SID packets. */ + if (tf->c_bits[11] || sidc == OSMO_GSM631_SID_CLASS_INVALID) + goto bad_frame; + + /* RFC 5993 Frame Type is equal to GSM 06.41 SID classification, + * restricted to just speech or valid SID per above. */ + out[0] = sidc << 4; /* TS 101 318 Section 5.2: The order of occurrence of the codec parameters in the buffer is * the same as order of occurrence over the Abis as defined in annex B of ETS 300 969 * [which is 3GPP TS 46.020 */ - osmo_ubit2pbit(out, tf->d_bits, 112); + osmo_ubit2pbit(out + 1, tf->d_bits, 112); - if (tf->c_bits[12] || tf->c_bits[13]) { - /* Generate SID frame as per TS 101 318 Section 5.2.2 */ - for (i = 0; i < sizeof(rtp_hr_sid); i++) - out[i] = out[i] | rtp_hr_sid[i]; - } + /* RFC 5993 requires SID frames to be perfect, error-free */ + if (sidc == OSMO_GSM631_SID_CLASS_VALID) + osmo_hr_sid_reset(out + 1); - return GSM_HR_BYTES; + return GSM_HR_BYTES_RTP_RFC5993; bad_frame: return 0; -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37152?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: I0bcfdccbf4df5a5cd90a65525527f08107be2cf5 Gerrit-Change-Number: 37152 Gerrit-PatchSet: 1 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in libosmo-abis[master]: rtp2trau_hr16: accept both TS 101 318 and RFC 5993 payload formats

by falconia

falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37151?usp=email ) Change subject: rtp2trau_hr16: accept both TS 101 318 and RFC 5993 payload formats ...................................................................... rtp2trau_hr16: accept both TS 101 318 and RFC 5993 payload formats OsmoBTS already accepts both payload formats for HRv1 - do likewise when interfacing to E1-based BTS. While OsmoMGW does have a vty config option to convert between TS 101 318 and RFC 5993 payload formats on the fly, it should be considered deprecated, and we should be moving toward recommended configurations with that option disabled. Change-Id: I125d57d3451b030e35a7b2b95a45e38b4581626c --- M src/trau/trau_rtp_conv.c 1 file changed, 29 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/51/37151/1 diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c index bad63ac..e1e0391 100644 --- a/src/trau/trau_rtp_conv.c +++ b/src/trau/trau_rtp_conv.c @@ -367,8 +367,20 @@ static int rtp2trau_hr16(struct osmo_trau_frame *tf, const uint8_t *data, size_t data_len) { - if (data_len < GSM_HR_BYTES && data_len != 0) + /* accept both TS 101 318 and RFC 5993 payloads */ + switch (data_len) { + case GSM_HR_BYTES: + break; + case GSM_HR_BYTES_RTP_RFC5993: + data++; + data_len--; + break; + case 0: + /* accept no-data input */ + break; + default: return -EINVAL; + } tf->type = OSMO_TRAU16_FT_HR; -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37151?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: I125d57d3451b030e35a7b2b95a45e38b4581626c Gerrit-Change-Number: 37151 Gerrit-PatchSet: 1 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in libosmo-abis[master]: rtp2trau_hr16: set D bits correctly

by falconia

falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37150?usp=email ) Change subject: rtp2trau_hr16: set D bits correctly ...................................................................... rtp2trau_hr16: set D bits correctly The original code failed to do the step of osmo_pbit2ubit() for transferring HRv1 payload bits from packed to unpacked form, instead doing the bogon of memcpy()ing the RTP payload directly into tf->d_bits array - fix it. Also set all D bits to zeros in the case of empty payload input - not ideal, but better than transmitting uninitialized memory content. Change-Id: Icb6a21a12fe82f6637f327d45bd843686a90a458 --- M src/trau/trau_rtp_conv.c 1 file changed, 19 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/50/37150/1 diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c index 4a62cc0..bad63ac 100644 --- a/src/trau/trau_rtp_conv.c +++ b/src/trau/trau_rtp_conv.c @@ -425,7 +425,9 @@ tf->ufi = 1; /* CRC is computed by TRAU frame encoder */ if (data_len) - memcpy(tf->d_bits, data, GSM_HR_BYTES); + osmo_pbit2ubit(tf->d_bits, data, 112); + else + memset(tf->d_bits, 0, 112); return 0; } -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37150?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: Icb6a21a12fe82f6637f327d45bd843686a90a458 Gerrit-Change-Number: 37150 Gerrit-PatchSet: 1 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in libosmo-abis[master]: TRAU<->RTP HRv1: fix SID frame definition

by falconia

falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37149?usp=email ) Change subject: TRAU<->RTP HRv1: fix SID frame definition ...................................................................... TRAU<->RTP HRv1: fix SID frame definition HRv1 SID frame consists of 33 bits of comfort noise parameters followed by 79 bits of all-1s SID codeword. The RTP-encoded representation of this construct in trau_rtp_conv.c was off by one bit - fix it. Change-Id: I4554a70f05bee428e0fb304868e25ee61ff375a1 --- M src/trau/trau_rtp_conv.c 1 file changed, 15 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/49/37149/1 diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c index c70736d..4a62cc0 100644 --- a/src/trau/trau_rtp_conv.c +++ b/src/trau/trau_rtp_conv.c @@ -145,7 +145,7 @@ FT_NO_DATA = 7, }; -static const uint8_t rtp_hr_sid[14] = { 0x00, 0x00, 0x00, 0x00, 0x3f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; +static const uint8_t rtp_hr_sid[14] = { 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; /*! Generate the 14 bytes ETSI TS 101 318 RTP payload for HR from a decoded 16k TRAU frame. * Note that thsi differs from the IETF RFC5993 format. However, as OsmoBTS implements -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37149?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: I4554a70f05bee428e0fb304868e25ee61ff375a1 Gerrit-Change-Number: 37149 Gerrit-PatchSet: 1 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[S] Change in libosmo-abis[master]: rtp2trau_hr16: fix UFE bit setting

by falconia

falconia has uploaded this change for review. ( https://gerrit.osmocom.org/c/libosmo-abis/+/37148?usp=email ) Change subject: rtp2trau_hr16: fix UFE bit setting ...................................................................... rtp2trau_hr16: fix UFE bit setting Per TS 48.061 section 5.1.4.1.1, UFE=1 means UL was good and UFE=0 means UL was bad. In the absence of logic that reports the actual state of UL, we need to tell the BTS that UL was good (like we do for FR & EFR) - hence set UFE=1. Change-Id: Ibeb8db332f2e20806bebb077844a509064b2d89d --- M src/trau/trau_rtp_conv.c 1 file changed, 15 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-abis refs/changes/48/37148/1 diff --git a/src/trau/trau_rtp_conv.c b/src/trau/trau_rtp_conv.c index 5c87c46..c70736d 100644 --- a/src/trau/trau_rtp_conv.c +++ b/src/trau/trau_rtp_conv.c @@ -407,7 +407,7 @@ tf->c_bits[15] = 0; /* C16: SP */ tf->c_bits[16] = 0; /* C17: DTXd shall not be applied */ } else { - tf->c_bits[11] = 0; /* C12: UFE */ + tf->c_bits[11] = 1; /* C12: UFE */ tf->c_bits[12] = 1; /* C13: spare */ tf->c_bits[13] = 1; /* C14: spare */ tf->c_bits[14] = 1; /* C15: spare */ -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/37148?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: Ibeb8db332f2e20806bebb077844a509064b2d89d Gerrit-Change-Number: 37148 Gerrit-PatchSet: 1 Gerrit-Owner: falconia <falcon(a)freecalypso.org> Gerrit-MessageType: newchange

1 year

1
0
0 0

[M] Change in osmo-hnbgw[master]: hnb_persistent: introduce disconnected timeout

by neels

neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email ) Change subject: hnb_persistent: introduce disconnected timeout ...................................................................... hnb_persistent: introduce disconnected timeout Add timer hnbgw X35: Clean up all hNodeB persistent state after this time of the hNodeB being disconnected. Set to zero to never clear hNodeB persistent state. (default is 60*60*24*27 = a week). The idea is to bound memory usage at sites where hNodeB do not stay on one fixed cell id, but use a different cell id after each Iuh reconnection. Related: SYS#6773 Related: osmo-ttcn3-hacks Ibec009203d38f65714561b7c28edbdbd8b34e704 Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307 --- M include/osmocom/hnbgw/hnbgw.h M src/osmo-hnbgw/hnbgw.c M src/osmo-hnbgw/tdefs.c 3 files changed, 58 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved osmith: Looks good to me, but someone else must approve diff --git a/include/osmocom/hnbgw/hnbgw.h b/include/osmocom/hnbgw/hnbgw.h index c28f8bc..36358b1 100644 --- a/include/osmocom/hnbgw/hnbgw.h +++ b/include/osmocom/hnbgw/hnbgw.h @@ -412,6 +412,8 @@ struct nft_kpi_val v; } dl; } nft_kpi; + + struct osmo_timer_list disconnected_timeout; }; struct ue_context { diff --git a/src/osmo-hnbgw/hnbgw.c b/src/osmo-hnbgw/hnbgw.c index 20d6aa6..6f74d04 100644 --- a/src/osmo-hnbgw/hnbgw.c +++ b/src/osmo-hnbgw/hnbgw.c @@ -44,6 +44,7 @@ #include <osmocom/hnbgw/hnbgw_cn.h> #include <osmocom/hnbgw/context_map.h> #include <osmocom/hnbgw/mgw_fsm.h> +#include <osmocom/hnbgw/tdefs.h> struct hnbgw *g_hnbgw = NULL; @@ -560,6 +561,24 @@ .item_desc = hnb_stat_desc, }; +static void hnb_persistent_disconnected_timeout_cb(void *data) +{ + hnb_persistent_free(data); +} + +static void hnb_persistent_disconnected_timeout_schedule(struct hnb_persistent *hnbp) +{ + unsigned long period_s = osmo_tdef_get(hnbgw_T_defs, -35, OSMO_TDEF_S, 60*60*24*7); + if (period_s < 1) { + LOG_HNBP(hnbp, LOGL_INFO, + "timer X35 is zero, not setting a disconnected timeout for this hnb-persistent instance.\n"); + return; + } + /* It is fine if the timer is already active, osmo_timer_del() is done implicitly by the osmo_timer API. */ + osmo_timer_setup(&hnbp->disconnected_timeout, hnb_persistent_disconnected_timeout_cb, hnbp); + osmo_timer_schedule(&hnbp->disconnected_timeout, period_s, 0); +} + struct hnb_persistent *hnb_persistent_alloc(const struct umts_cell_id *id) { struct hnb_persistent *hnbp = talloc_zero(g_hnbgw, struct hnb_persistent); @@ -583,6 +602,11 @@ if (g_hnbgw->nft_kpi.active) nft_kpi_hnb_persistent_add(hnbp); + /* Normally the disconnected timer runs only when the hNodeB is not currently connected on Iuh. This here is paranoia: + * In case we have to HNBAP HNB Register Reject, the disconnected timer should be active on this unused hnbp. + * On success, hnb_persistent_registered() will stop the disconnected timer directly after this. */ + hnb_persistent_disconnected_timeout_schedule(hnbp); + return hnbp; out_free_ctrs: @@ -645,6 +669,9 @@ return; } + /* The hNodeB is now connected, i.e. not disconnected. */ + osmo_timer_del(&hnbp->disconnected_timeout); + /* start counting traffic */ if (g_hnbgw->nft_kpi.active) hnb_persistent_update_remote_addr(hnbp); @@ -664,11 +691,15 @@ /* stop counting traffic */ nft_kpi_hnb_stop(hnbp); + + /* The hNodeB is now disconnected. Clear out hnb_persistent when the disconnected timeout has passed. */ + hnb_persistent_disconnected_timeout_schedule(hnbp); } void hnb_persistent_free(struct hnb_persistent *hnbp) { /* FIXME: check if in use? */ + osmo_timer_del(&hnbp->disconnected_timeout); nft_kpi_hnb_stop(hnbp); nft_kpi_hnb_persistent_remove(hnbp); osmo_stat_item_group_free(hnbp->statg); diff --git a/src/osmo-hnbgw/tdefs.c b/src/osmo-hnbgw/tdefs.c index cfcd4c2..5092922 100644 --- a/src/osmo-hnbgw/tdefs.c +++ b/src/osmo-hnbgw/tdefs.c @@ -36,6 +36,12 @@ {.T = 4, .default_val = 5, .desc = "Timeout to receive RANAP RESET ACKNOWLEDGE from an MSC/SGSN" }, {.T = -31, .default_val = 15, .desc = "Timeout for establishing and releasing context maps (RUA <-> SCCP)" }, {.T = -34, .default_val = 1000, .unit = OSMO_TDEF_MS, .desc = "Period to query network traffic stats from netfilter" }, + { + .T = -35, + .default_val = 60*60*24*7, + .desc = "Clean up all hNodeB persistent state after this time of the hNodeB being disconnected." + " Set to zero to never clear hNodeB persistent state. (default is 60*60*24*27 = a week)", + }, {.T = -1002, .default_val = 10, .desc = "Timeout for the HNB to respond to PS RAB Assignment Request" }, { } }; -- To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-hnbgw Gerrit-Branch: master Gerrit-Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307 Gerrit-Change-Number: 36894 Gerrit-PatchSet: 3 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-MessageType: merged

1 year

1
0
0 0

[M] Change in osmo-hnbgw[master]: hnb_persistent: introduce disconnected timeout

by neels

neels has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email ) Change subject: hnb_persistent: introduce disconnected timeout ...................................................................... Patch Set 3: -Code-Review (2 comments) Patchset: PS3: I figured out that segfault, it is unrelated to this patch. PS3: > let's delay this a bit until https://osmocom. […] Done -- To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/36894?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-hnbgw Gerrit-Branch: master Gerrit-Change-Id: Ic819d7cbc03fb39e98c204b70d016c5170dc6307 Gerrit-Change-Number: 36894 Gerrit-PatchSet: 3 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Mon, 10 Jun 2024 01:15:50 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: neels <nhofmeyr(a)sysmocom.de> Gerrit-MessageType: comment

1 year

1
0
0 0

[S] Change in osmo-hnbgw[master]: prevent use-after-free after FSM instance termination

by neels

neels has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-hnbgw/+/37147?usp=email ) Change subject: prevent use-after-free after FSM instance termination ...................................................................... prevent use-after-free after FSM instance termination - Set osmo_fsm_set_dealloc_ctx(OTC_SELECT) in osmo-hnbgw's main(). - Only dispatch RANAP when FSM instances aren't terminated. This way we possibly pre-empt use-after-free crashes for deallocating FSM "nests" for obscure corner cases. Use-after-free is a general problem for FSM design. For this, we created osmo_fsm_set_dealloc_ctx(): When an FSM is terminated, move it to a separate talloc context, instead of being deallocated. An actual use-after-free was observed as described in OS#6484, but that needs a separate, orthogonal fix: When the Iuh link is lost while the CN link is waiting for SCCP CC or CREF -- the better solution is described in OS#6085: don't wait for CC at all, just dispatch DISCONN to SCCP-SCOC. So even though the code where a crash was observed will be removed, this patch is a general safeguard against corner case crashes, improving general stability. Related: OS#6484 Change-Id: Ib41e1a996aaa03221e73643636140947ac8f99e2 --- M src/osmo-hnbgw/context_map_rua.c M src/osmo-hnbgw/context_map_sccp.c M src/osmo-hnbgw/osmo_hnbgw_main.c 3 files changed, 42 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-hnbgw refs/changes/47/37147/1 diff --git a/src/osmo-hnbgw/context_map_rua.c b/src/osmo-hnbgw/context_map_rua.c index 3c6ea1e..7286906 100644 --- a/src/osmo-hnbgw/context_map_rua.c +++ b/src/osmo-hnbgw/context_map_rua.c @@ -158,6 +158,11 @@ static int handle_rx_rua(struct osmo_fsm_inst *fi, struct msgb *ranap_msg) { struct hnbgw_context_map *map = fi->priv; + + /* If the FSM instance has already terminated, don't dispatch anything. */ + if (fi->proc.terminating) + return 0; + if (!msg_has_l2_data(ranap_msg)) return 0; diff --git a/src/osmo-hnbgw/context_map_sccp.c b/src/osmo-hnbgw/context_map_sccp.c index 10ddaf2..511577c 100644 --- a/src/osmo-hnbgw/context_map_sccp.c +++ b/src/osmo-hnbgw/context_map_sccp.c @@ -198,6 +198,10 @@ struct hnbgw_context_map *map = fi->priv; int rc; + /* If the FSM instance has already terminated, don't dispatch anything. */ + if (fi->proc.terminating) + return 0; + /* When there was no message received along with the received event, then there is nothing to forward to RUA. */ if (!msg_has_l2_data(ranap_msg)) return 0; diff --git a/src/osmo-hnbgw/osmo_hnbgw_main.c b/src/osmo-hnbgw/osmo_hnbgw_main.c index 2f71251..3e715b0 100644 --- a/src/osmo-hnbgw/osmo_hnbgw_main.c +++ b/src/osmo-hnbgw/osmo_hnbgw_main.c @@ -360,6 +360,8 @@ signal(SIGUSR2, &signal_handler); osmo_init_ignore_signals(); + osmo_fsm_set_dealloc_ctx(OTC_SELECT); + while (1) { rc = osmo_select_main_ctx(0); if (rc < 0) -- To view, visit https://gerrit.osmocom.org/c/osmo-hnbgw/+/37147?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-hnbgw Gerrit-Branch: master Gerrit-Change-Id: Ib41e1a996aaa03221e73643636140947ac8f99e2 Gerrit-Change-Number: 37147 Gerrit-PatchSet: 1 Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de> Gerrit-MessageType: newchange

1 year

1
0
0 0

2025

2024

2023

2022

gerrit-log June 2024