October 2026 - gerrit-log - lists.osmocom.org

[M] Change in libosmo-sigtran[master]: ss7_asp_peer: Improvements in ss7_asp_peer_snprintf()
by pespin 07 Oct '26

07 Oct '26

Attention is currently required from: fixeria, jolly, osmith, pespin. Hello Jenkins Builder, fixeria, jolly, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43753?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: ss7_asp_peer: Improvements in ss7_asp_peer_snprintf() ...................................................................... ss7_asp_peer: Improvements in ss7_asp_peer_snprintf() Convert it to osmo_strbuf, which simplifies the logic of the function, taking osmo_multiaddr_ip_and_port_snprintf() as reference to implement it. As a result: * Single IPv6 addresses now get properly enclosed in [], eg: "[::]:2905". * We avoid passing NULL to snprintf(), which is unspecified on some platforms. Change-Id: I115951627adb0c6778a9a36159237c3eea130300 --- M src/ss7_asp_peer.c M tests/ss7/ss7_test.err M tests/ss7/ss7_test.ok 3 files changed, 31 insertions(+), 30 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/53/43753/5 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43753?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I115951627adb0c6778a9a36159237c3eea130300 Gerrit-Change-Number: 43753 Gerrit-PatchSet: 5 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: tests: ss7_test: Check stderr output
by pespin 07 Oct '26

07 Oct '26

Attention is currently required from: fixeria, pespin. Hello Jenkins Builder, fixeria, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43797?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by fixeria, Verified+1 by Jenkins Builder Change subject: tests: ss7_test: Check stderr output ...................................................................... tests: ss7_test: Check stderr output The content of the file was outdated since it wasn't being checked, update it. Change-Id: I285eaeaa05e3651b0e4a69b3982d9b750cec92f0 --- M tests/ss7/ss7_test.c M tests/ss7/ss7_test.err M tests/testsuite.at 3 files changed, 100 insertions(+), 51 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/97/43797/2 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43797?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I285eaeaa05e3651b0e4a69b3982d9b750cec92f0 Gerrit-Change-Number: 43797 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in libosmo-sigtran[master]: xua_srv: Introduce log macro LOGPOXS()
by pespin 07 Oct '26

07 Oct '26

Attention is currently required from: pespin. Hello Jenkins Builder, fixeria, jolly, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43754?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: xua_srv: Introduce log macro LOGPOXS() ...................................................................... xua_srv: Introduce log macro LOGPOXS() Use the macro in multiple places, improve logging around it. Change-Id: Ibd24de79048161450c868dc28987307f25365704 --- M src/ss7_xua_srv.c M src/ss7_xua_srv.h 2 files changed, 20 insertions(+), 13 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/54/43754/5 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43754?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ibd24de79048161450c868dc28987307f25365704 Gerrit-Change-Number: 43754 Gerrit-PatchSet: 5 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in libosmo-sigtran[master]: vty: Implement '[no] shutdown' in 'listen' node
by pespin 07 Oct '26

07 Oct '26

Attention is currently required from: pespin. Hello Jenkins Builder, fixeria, jolly, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43755?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: vty: Implement '[no] shutdown' in 'listen' node ...................................................................... vty: Implement '[no] shutdown' in 'listen' node Prior to this patch, there was no way to stop the listening socket and resume it without erasing it from configuration with "no listen" VTY command. It is sometimes useful to pause it to avoid serving clients for a while for administrative purposes. Related: OS#7039 Change-Id: I18bae91fdf5b820138bc54e6f4751c3d0b8eee28 --- M contrib/test/osmo-stp.cfg M doc/examples/osmo-stp-multihome.cfg M doc/examples/osmo-stp.cfg M src/sccp_instance.c M src/ss7_xua_srv.c M src/ss7_xua_srv.h M src/ss7_xua_srv_vty.c M tests/vty/osmo_stp_route_prio.vty M tests/vty/osmo_stp_test.vty M tests/vty/vty_test_runner.py 10 files changed, 119 insertions(+), 10 deletions(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/55/43755/5 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43755?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: I18bae91fdf5b820138bc54e6f4751c3d0b8eee28 Gerrit-Change-Number: 43755 Gerrit-PatchSet: 5 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in libosmo-sigtran[master]: xua_msg: Drop __thread attribute on static buf
by pespin 07 Oct '26

07 Oct '26

Attention is currently required from: pespin. Hello Jenkins Builder, osmith, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43761?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: xua_msg: Drop __thread attribute on static buf ...................................................................... xua_msg: Drop __thread attribute on static buf libosmo-sigtran is not thread safe, and hence makes no sense to have only this static buffer (out of dozens declared) as TLS. Related: OS#7061 Change-Id: Ia023b8df32494bc705326106753f17e7eeaf89cf --- M src/xua_msg.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/libosmo-sigtran refs/changes/61/43761/3 -- To view, visit https://gerrit.osmocom.org/c/libosmo-sigtran/+/43761?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: libosmo-sigtran Gerrit-Branch: master Gerrit-Change-Id: Ia023b8df32494bc705326106753f17e7eeaf89cf Gerrit-Change-Number: 43761 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in osmo-sgsn[master]: Remove authentication acls and auth policy != REMOTE
by lynxis lazus 07 Oct '26

07 Oct '26

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43798?usp=email ) Change subject: Remove authentication acls and auth policy != REMOTE ...................................................................... Remove authentication acls and auth policy != REMOTE In prepration to rework the SGSN and integrate libvlr, remove auth policies for now. It may be reintroduced later in a similar way as the MSC is supporting it. Change-Id: Iea267bfbd9e0f3d1ba00c6d8d8f308b24e8ec6d4 --- M debian/osmo-sgsn.install M doc/manuals/chapters/configuration.adoc M include/osmocom/sgsn/auth.h M include/osmocom/sgsn/sgsn.h M src/sgsn/sgsn.c M src/sgsn/sgsn_auth.c M src/sgsn/sgsn_vty.c M tests/Makefile.am D tests/osmo-sgsn-accept-all.cfg R tests/osmo-sgsn-remote.cfg M tests/osmo-sgsn_test-nodes.vty M tests/sgsn/sgsn_test.c M tests/sgsn/sgsn_test.ok M tests/vty_test_runner.py 14 files changed, 24 insertions(+), 361 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/98/43798/1 diff --git a/debian/osmo-sgsn.install b/debian/osmo-sgsn.install index b9a46ab..91ef8e6 100644 --- a/debian/osmo-sgsn.install +++ b/debian/osmo-sgsn.install @@ -2,4 +2,3 @@ lib/systemd/system/osmo-sgsn.service usr/bin/osmo-sgsn usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn.cfg usr/share/doc/osmo-sgsn/examples -usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg usr/share/doc/osmo-sgsn/examples diff --git a/doc/manuals/chapters/configuration.adoc b/doc/manuals/chapters/configuration.adoc index d6ddcd3..14b1b36 100644 --- a/doc/manuals/chapters/configuration.adoc +++ b/doc/manuals/chapters/configuration.adoc @@ -127,30 +127,14 @@ rejected. The possible options range from accepting just all subscribers without further checking, to a fine grained access-control, handled by an external HLR. -accept-all:: All subscribers that attempt to attach to the GPRS network are -accepted without further checking. This option is intended to be used for -testing in a controlled environment only. A wide-open network may attract -subscribers from foreign networks and disrupt their service. It is highly -recommended to pick one of the options below. +accept-all:: Deprecated. remote:: This option allows to connect OsmoSGSN to an external HLR via the GSUP protocol. This will be the preferred option in larger networks. -acl-only:: If no external HLR is available, the network operator has the -option to control the access using an access control list. The access control -list contains the IMSI numbers of the allowed subscribers. This method offers -fine grained access control and is ideal for small networks and lab test -environments. +acl-only:: Deprecated. -closed:: This policy mode softens the strict *acl-only* only mode by also -implicitly accepting home network subscribers. The decision is made by the MCC -and MNC part of the IMSI number. The combination of MCC and MNC fully identifies -a subscribers home network, also known as a Home Network Identity (HNI, i.e. -MCC and MNC found at the start of the IMSI, e.g. MCC 901 and MNC 700 with -IMSI 901700000003080). - -NOTE: The policy mode *closed* must not be confused with the equally named -policy that is defined for osmo-nitb! +closed:: Deprecated. .Example: Assign or change authorization policy @@ -158,39 +142,17 @@ OsmoSGSN> enable OsmoSGSN# configure terminal OsmoSGSN(config)# sgsn -OsmoSGSN(config-sgsn)# auth-policy acl-only <1> +OsmoSGSN(config-sgsn)# auth-policy remote <1> OsmoSGSN(config-sgsn)# write <2> Configuration saved to sgsn.cfg OsmoSGSN(config-sgsn)# end OsmoSGSN# disable OsmoSGSN> ---- -<1> 'acl-only' is selected as authorization policy +<1> 'remote' is selected as authorization policy <2> Saves current changes to cofiguration to make this policy persistent -.Example: Access control list ----- -sgsn - auth-policy acl-only <1> - imsi-acl add 001010000000003 - imsi-acl add 001010000000002 - imsi-acl add 001010000000001 - imsi-acl add 901700000000068 <2> ----- -<1> Set the authorization policy -<2> Add as many subscribers as required - -=== Subscriber Configuration - -As opposed to OsmoNITB, OsmoSGSN does not feature a built-in HLR. - -It can thus operate only in the following two modes: - -. Accessing an external HLR (or HLR gateway) via the GSUP protocol -. Accepting subscribers based on internal ACL (access control list), - see also <<auth-pol>> - ==== Accessing an external HLR via GSUP The non-standard GSUP protocol was created to provide OsmoSGSN with @@ -214,14 +176,9 @@ ---- OsmoSGSN(config-sgsn)# gsup remote-ip 2.3.4.5 <1> OsmoSGSN(config-sgsn)# gsup remote-port 10000 <2> -OsmoSGSN(config-sgsn)# gsup oap-k 000102030405060708090a0b0c0d0e0f <3> -OsmoSGSN(config-sgsn)# gsup oap-opc 101112131415161718191a1b1c1d1e1f <4> ---- <1> Configure the IP address of the (remote) HLR or HLR-GW <2> Configure the TCP port of the (remote) HLR or HLR-GW -<3> Specify the OAP shared key -<4> Specify the OAP shared OPC - === CDR configuration diff --git a/include/osmocom/sgsn/auth.h b/include/osmocom/sgsn/auth.h index a46fb16..fbb0555 100644 --- a/include/osmocom/sgsn/auth.h +++ b/include/osmocom/sgsn/auth.h @@ -19,21 +19,9 @@ extern const struct value_string *sgsn_auth_state_names; -void sgsn_auth_init(struct sgsn_instance *sgsn); /* Request authorization */ enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mm); int sgsn_auth_request(struct sgsn_mm_ctx *mm); void sgsn_auth_update(struct sgsn_mm_ctx *mm); struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx, unsigned key_seq); - -/* - * Authorization/ACL handling - */ -struct imsi_acl_entry { - struct llist_head list; - char imsi[OSMO_IMSI_BUF_SIZE]; -}; -struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg); -int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg); -int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg); diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h index 8524dd7..d9be0ea 100644 --- a/include/osmocom/sgsn/sgsn.h +++ b/include/osmocom/sgsn/sgsn.h @@ -85,7 +85,6 @@ enum sgsn_auth_policy auth_policy; uint8_t gea_encryption_mask; uint8_t uea_encryption_mask; - struct llist_head imsi_acl; struct sockaddr_in gsup_server_addr; int gsup_server_port; diff --git a/src/sgsn/sgsn.c b/src/sgsn/sgsn.c index fe52e6c..a163f4f 100644 --- a/src/sgsn/sgsn.c +++ b/src/sgsn/sgsn.c @@ -187,7 +187,7 @@ talloc_set_destructor(inst, sgsn_instance_talloc_destructor); inst->cfg.gtp_statedir = talloc_strdup(inst, "./"); - inst->cfg.auth_policy = SGSN_AUTH_POLICY_CLOSED; + inst->cfg.auth_policy = SGSN_AUTH_POLICY_REMOTE; inst->cfg.gea_encryption_mask = (1 << GPRS_ALGO_GEA0); /* no encryption */ inst->cfg.uea_encryption_mask = (1 << OSMO_UTRAN_UEA2) | (1 << OSMO_UTRAN_UEA1); inst->cfg.require_authentication = true; /* only applies if auth_policy is REMOTE */ @@ -215,7 +215,6 @@ osmo_timer_setup(&inst->llme_timer, sgsn_llme_check_cb, NULL); osmo_timer_schedule(&inst->llme_timer, GPRS_LLME_CHECK_TICK, 0); /* These are mostly setting up stuff not related to VTY cfg, so they can be set up here: */ - sgsn_auth_init(inst); sgsn_cdr_init(inst); sgsn_ra_init(inst); return inst; diff --git a/src/sgsn/sgsn_auth.c b/src/sgsn/sgsn_auth.c index 2f5bc8c..5fbe0be 100644 --- a/src/sgsn/sgsn_auth.c +++ b/src/sgsn/sgsn_auth.c @@ -38,72 +38,15 @@ const struct value_string *sgsn_auth_state_names = auth_state_names; -void sgsn_auth_init(struct sgsn_instance *sgsn) -{ - INIT_LLIST_HEAD(&sgsn->cfg.imsi_acl); -} - -struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - llist_for_each_entry(acl, &cfg->imsi_acl, list) { - if (!strcmp(imsi, acl->imsi)) - return acl; - } - return NULL; -} - -int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - - if (sgsn_acl_lookup(imsi, cfg)) - return -EEXIST; - - acl = talloc_zero(NULL, struct imsi_acl_entry); - if (!acl) - return -ENOMEM; - osmo_strlcpy(acl->imsi, imsi, sizeof(acl->imsi)); - - llist_add(&acl->list, &cfg->imsi_acl); - - return 0; -} - -int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - - acl = sgsn_acl_lookup(imsi, cfg); - if (!acl) - return -ENODEV; - - llist_del(&acl->list); - talloc_free(acl); - - return 0; -} - enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mmctx) { - char mccmnc[16]; - int check_net = 0; - int check_acl = 0; - OSMO_ASSERT(mmctx); switch (sgsn->cfg.auth_policy) { case SGSN_AUTH_POLICY_OPEN: - return SGSN_AUTH_ACCEPTED; - case SGSN_AUTH_POLICY_CLOSED: - check_net = 1; - check_acl = 1; - break; - case SGSN_AUTH_POLICY_ACL_ONLY: - check_acl = 1; - break; + return SGSN_AUTH_REJECTED; case SGSN_AUTH_POLICY_REMOTE: if (!mmctx->subscr) @@ -129,19 +72,6 @@ return SGSN_AUTH_UNKNOWN; } - if (check_net) { - /* We simply assume that the IMSI exists, as long as it is part - * of 'our' network */ - snprintf(mccmnc, sizeof(mccmnc), "%s%s", - osmo_mcc_name(mmctx->ra.lac.plmn.mcc), - osmo_mnc_name(mmctx->ra.lac.plmn.mnc, mmctx->ra.lac.plmn.mnc_3_digits)); - if (strncmp(mccmnc, mmctx->imsi, mmctx->ra.lac.plmn.mnc_3_digits ? 6 : 5) == 0) - return SGSN_AUTH_ACCEPTED; - } - - if (check_acl && sgsn_acl_lookup(mmctx->imsi, &sgsn->cfg)) - return SGSN_AUTH_ACCEPTED; - return SGSN_AUTH_REJECTED; } diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c index 3d8a3bd..b7df7f8 100644 --- a/src/sgsn/sgsn_vty.c +++ b/src/sgsn/sgsn_vty.c @@ -249,7 +249,6 @@ static int config_write_sgsn(struct vty *vty) { struct sgsn_ggsn_ctx *gctx; - struct imsi_acl_entry *acl; struct apn_ctx *actx; struct ares_addr_node *server; struct sgsn_mme_ctx *mme; @@ -329,9 +328,6 @@ osmo_hexdump_nospc(g_cfg->oap.secret_opc, sizeof(g_cfg->oap.secret_opc)), VTY_NEWLINE); - llist_for_each_entry(acl, &g_cfg->imsi_acl, list) - vty_out(vty, " imsi-acl add %s%s", acl->imsi, VTY_NEWLINE); - if (llist_empty(&sgsn->apn_list)) vty_out(vty, " ! apn * ggsn 0%s", VTY_NEWLINE); llist_for_each_entry(actx, &sgsn->apn_list, list) { @@ -781,44 +777,15 @@ return CMD_SUCCESS; } - -DEFUN(imsi_acl, cfg_imsi_acl_cmd, +DEFUN_DEPRECATED(imsi_acl, cfg_imsi_acl_cmd, "imsi-acl (add|del) IMSI", "Access Control List of foreign IMSIs\n" "Add IMSI to ACL\n" "Remove IMSI from ACL\n" "IMSI of subscriber\n") { - char imsi_sanitized[GSM23003_IMSI_MAX_DIGITS + 1]; - const char *op = argv[0]; - const char *imsi = imsi_sanitized; - size_t len = strnlen(argv[1], GSM23003_IMSI_MAX_DIGITS + 1); - int rc; - - memset(imsi_sanitized, '0', GSM23003_IMSI_MAX_DIGITS); - imsi_sanitized[GSM23003_IMSI_MAX_DIGITS] = '\0'; - - /* Sanitize IMSI */ - if (len > GSM23003_IMSI_MAX_DIGITS) { - vty_out(vty, "%% IMSI (%s) too long (max %u digits) -- ignored!%s", - argv[1], GSM23003_IMSI_MAX_DIGITS, VTY_NEWLINE); - return CMD_WARNING; - } - - osmo_strlcpy(imsi_sanitized + GSM23003_IMSI_MAX_DIGITS - len, argv[1], - sizeof(imsi_sanitized) - (GSM23003_IMSI_MAX_DIGITS - len)); - - if (!strcmp(op, "add")) - rc = sgsn_acl_add(imsi, g_cfg); - else - rc = sgsn_acl_del(imsi, g_cfg); - - if (rc < 0) { - vty_out(vty, "%% unable to %s ACL%s", op, VTY_NEWLINE); - return CMD_WARNING; - } - - return CMD_SUCCESS; + vty_out(vty, "ACL based on IMSI has been deprecated.%s", VTY_NEWLINE); + return CMD_WARNING; } DEFUN_DEPRECATED(cfg_encrypt, cfg_encrypt_cmd, @@ -956,11 +923,18 @@ " permitted to register to the network.\n" "Accept all IMSIs (DANGEROUS)\n" "Accept only home network subscribers or those in the ACL\n" - "Accept only subscribers in the ACL\n" + "Accept only subscribers in the ACL. Deprecated.\n" "Use remote subscription data only (HLR)\n") { int val = get_string_value(sgsn_auth_pol_strs, argv[0]); OSMO_ASSERT(val >= SGSN_AUTH_POLICY_OPEN && val <= SGSN_AUTH_POLICY_REMOTE); + + if (val == SGSN_AUTH_POLICY_ACL_ONLY) { + vty_out(vty, "acl-only authentication is deprecated and not implemented anymore.%s", + VTY_NEWLINE); + return CMD_WARNING; + } + g_cfg->auth_policy = val; g_cfg->require_update_location = (val == SGSN_AUTH_POLICY_REMOTE); diff --git a/tests/Makefile.am b/tests/Makefile.am index 9d429d7..c907ab3 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -33,7 +33,6 @@ $(TESTSUITE) \ vty_test_runner.py \ ctrl_test_runner.py \ - osmo-sgsn-accept-all.cfg \ osmo-sgsn.cfg \ osmo-sgsn_test-nodes.vty \ $(NULL) diff --git a/tests/osmo-sgsn-accept-all.cfg b/tests/osmo-sgsn-accept-all.cfg deleted file mode 100644 index 46a5d61..0000000 --- a/tests/osmo-sgsn-accept-all.cfg +++ /dev/null @@ -1,38 +0,0 @@ -# Same as doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg, but without 'gtp state-dir' -! -! Osmocom SGSN configuration -! -! -log stderr - logging color 1 - logging print category-hex 0 - logging print category 1 - logging timestamp 0 - logging print file basename last - logging print level 1 - -line vty - no login -! -sgsn - gtp local-ip 127.0.0.1 - ggsn 0 remote-ip 127.0.0.2 - ggsn 0 gtp-version 1 - ggsn 0 echo-interval 60 - authentication optional - auth-policy accept-all -! -ns - timer tns-block 3 - timer tns-block-retries 3 - timer tns-reset 3 - timer tns-reset-retries 3 - timer tns-test 30 - timer tns-alive 3 - timer tns-alive-retries 10 - bind udp local - listen 127.0.0.1 23000 - accept-ipaccess -! -bssgp -! diff --git a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg b/tests/osmo-sgsn-remote.cfg similarity index 88% rename from doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg rename to tests/osmo-sgsn-remote.cfg index 9bc1520..e5cd1f9 100644 --- a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg +++ b/tests/osmo-sgsn-remote.cfg @@ -14,13 +14,13 @@ no login ! sgsn - gtp state-dir /var/lib/osmocom/osmo-sgsn gtp local-ip 127.0.0.1 ggsn 0 remote-ip 127.0.0.2 ggsn 0 gtp-version 1 ggsn 0 echo-interval 60 authentication optional - auth-policy accept-all + auth-policy remote + gsup remote-ip 127.0.0.1 ! ns timer tns-block 3 diff --git a/tests/osmo-sgsn_test-nodes.vty b/tests/osmo-sgsn_test-nodes.vty index 031ccfa..1bc28ba 100644 --- a/tests/osmo-sgsn_test-nodes.vty +++ b/tests/osmo-sgsn_test-nodes.vty @@ -33,7 +33,6 @@ ggsn <0-255> gtp-version (0|1) ggsn <0-255> echo-interval <1-36000> ggsn <0-255> no echo-interval - imsi-acl (add|del) IMSI auth-policy (accept-all|closed|acl-only|remote) authentication (optional|required) encryption gea <0-4> [<0-4>] [<0-4>] [<0-4>] [<0-4>] diff --git a/tests/sgsn/sgsn_test.c b/tests/sgsn/sgsn_test.c index 6dcda84..7a53716 100644 --- a/tests/sgsn/sgsn_test.c +++ b/tests/sgsn/sgsn_test.c @@ -65,16 +65,6 @@ TALLOC_FREE(sgsn); } -static uint32_t get_new_ptmsi(const struct gprs_gb_parse_context *parse_ctx) -{ - uint32_t new_ptmsi = GSM_RESERVED_TMSI; - - if (parse_ctx->new_ptmsi_enc) - gprs_parse_tmsi(parse_ctx->new_ptmsi_enc, &new_ptmsi); - - return new_ptmsi; -} - /* override */ int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime, struct bssgp_dl_ud_par *dup) @@ -1232,118 +1222,6 @@ cleanup_test(); } -/* - * Test cancellation of attached MM contexts - */ -static void test_gmm_cancel(void) -{ - struct osmo_routing_area_id raid = { 0, }; - struct sgsn_mm_ctx *ctx = NULL; - struct sgsn_mm_ctx *ictx; - uint32_t ptmsi1; - uint32_t foreign_tlli; - uint32_t local_tlli = 0; - struct gprs_llc_lle *lle; - - sgsn = sgsn_instance_alloc(tall_sgsn_ctx); - sgsn->cfg.gea_encryption_mask = 0x1; - const enum sgsn_auth_policy saved_auth_policy = sgsn->cfg.auth_policy; - - /* DTAP - Attach Request */ - /* The P-TMSI is not known by the SGSN */ - static const unsigned char attach_req[] = { - 0x08, 0x01, 0x02, 0xf5, 0xe0, 0x21, 0x08, 0x02, 0x05, 0xf4, - 0xfb, 0xc5, 0x46, 0x79, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, - 0x19, 0x18, 0xb3, 0x43, 0x2b, 0x25, 0x96, 0x62, 0x00, 0x60, - 0x80, 0x9a, 0xc2, 0xc6, 0x62, 0x00, 0x60, 0x80, 0xba, 0xc8, - 0xc6, 0x62, 0x00, 0x60, 0x80, 0x00 - }; - - /* DTAP - Identity Response IMEI */ - static const unsigned char ident_resp_imei[] = { - 0x08, 0x16, 0x08, 0x9a, 0x78, 0x56, 0x34, 0x12, 0x90, 0x78, - 0x56 - }; - - /* DTAP - Identity Response IMSI */ - static const unsigned char ident_resp_imsi[] = { - 0x08, 0x16, 0x08, 0x19, 0x32, 0x54, 0x76, 0x98, 0x10, 0x32, - 0x54 - }; - - /* DTAP - Attach Complete */ - static const unsigned char attach_compl[] = { - 0x08, 0x03 - }; - - printf("Testing cancellation\n"); - sgsn->cfg.auth_policy = SGSN_AUTH_POLICY_OPEN; - - foreign_tlli = gprs_tmsi2tlli(0xc0000023, TLLI_FOREIGN); - - /* Create a LLE/LLME */ - OSMO_ASSERT(count(gprs_llme_list()) == 0); - lle = gprs_lle_get_or_create(foreign_tlli, 3); - OSMO_ASSERT(count(gprs_llme_list()) == 1); - - /* inject the attach request */ - send_0408_message(lle->llme, foreign_tlli, &raid, - attach_req, ARRAY_SIZE(attach_req)); - - ctx = sgsn_mm_ctx_by_tlli(foreign_tlli, &raid); - OSMO_ASSERT(ctx != NULL); - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT); - - /* we expect an identity request (IMEI) */ - OSMO_ASSERT(sgsn_tx_counter == 1); - - /* inject the identity response (IMEI) */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - ident_resp_imei, ARRAY_SIZE(ident_resp_imei)); - - /* we expect an identity request (IMSI) */ - OSMO_ASSERT(sgsn_tx_counter == 1); - - /* inject the identity response (IMSI) */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - ident_resp_imsi, ARRAY_SIZE(ident_resp_imsi)); - - /* check that the MM context has not been removed due to a failed - * authorization */ - OSMO_ASSERT(ctx == sgsn_mm_ctx_by_tlli(foreign_tlli, &raid)); - - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT); - - /* we expect an attach accept/reject */ - OSMO_ASSERT(sgsn_tx_counter == 1); - ptmsi1 = get_new_ptmsi(&last_dl_parse_ctx); - OSMO_ASSERT(ptmsi1 != GSM_RESERVED_TMSI); - - /* this has been randomly assigned by the SGSN */ - local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL); - - /* inject the attach complete */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - attach_compl, ARRAY_SIZE(attach_compl)); - - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_REGISTERED_NORMAL); - - /* we don't expect a response */ - OSMO_ASSERT(sgsn_tx_counter == 0); - - /* cancel */ - gsm0408_gprs_access_cancelled(ctx, 0); - - /* verify that things are gone */ - OSMO_ASSERT(count(gprs_llme_list()) == 0); - ictx = sgsn_mm_ctx_by_tlli(local_tlli, &raid); - OSMO_ASSERT(!ictx); - - sgsn->cfg.auth_policy = saved_auth_policy; - - cleanup_test(); -} - static void test_apn_matching(void) { struct apn_ctx *actx, *actxs[9]; @@ -1670,7 +1548,6 @@ test_gmm_detach_accept_unexpected(); test_gmm_status_no_mmctx(); test_gmm_reject(); - test_gmm_cancel(); test_apn_matching(); test_ggsn_selection(); test_pdp_status_has_active_nsapis(); diff --git a/tests/sgsn/sgsn_test.ok b/tests/sgsn/sgsn_test.ok index 35b1d7b..20c9a73 100644 --- a/tests/sgsn/sgsn_test.ok +++ b/tests/sgsn/sgsn_test.ok @@ -21,7 +21,6 @@ - Routing Area Update Request (valid) - Routing Area Update Request (invalid type) - Routing Area Update Request (invalid CAP length) -Testing cancellation Testing APN matching Testing GGSN selection Testing pdp_status_has_active_nsapis diff --git a/tests/vty_test_runner.py b/tests/vty_test_runner.py index aaa76ed..34c3dee 100755 --- a/tests/vty_test_runner.py +++ b/tests/vty_test_runner.py @@ -70,7 +70,7 @@ class TestVTYSGSN(TestVTYBase): def vty_command(self): - return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn-accept-all.cfg"] + return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn-remote.cfg"] def vty_app(self): return (4245, "./src/sgsn/osmo-sgsn", "OsmoSGSN", "sgsn") @@ -98,7 +98,9 @@ self.assertTrue(self.vty.verify('show bssgp stats', [''])) self.assertTrue(self.vty.verify('show bssgp nsei 123', [''])) self.assertTrue(self.vty.verify('show bssgp nsei 123 stats', [''])) - self.assertTrue(self.vty.verify('show sgsn', [' GSN: signalling 127.0.0.1, user traffic 127.0.0.1'])) + self.assertTrue(self.vty.verify('show sgsn', [ + ' Remote authorization: not connected to 127.0.0.1:4222 via GSUP', + ' GSN: signalling 127.0.0.1, user traffic 127.0.0.1'])) self.assertTrue(self.vty.verify('show mm-context all', [''])) self.assertTrue(self.vty.verify('show mm-context imsi 000001234567', ['No MM context for IMSI 000001234567'])) self.assertTrue(self.vty.verify('show pdp-context all', [''])) @@ -109,27 +111,6 @@ res = self.vty.command("show llc") self.assertTrue(res.find('State of LLC Entities') >= 0) - def testVtyAuth(self): - self.vty.enable() - self.assertTrue(self.vty.verify('configure terminal', [''])) - self.assertEqual(self.vty.node(), 'config') - self.assertTrue(self.vty.verify('sgsn', [''])) - self.assertEqual(self.vty.node(), 'config-sgsn') - self.assertTrue(self.vty.verify('auth-policy accept-all', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy accept-all') > 0) - self.assertTrue(self.vty.verify('auth-policy acl-only', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy acl-only') > 0) - self.assertTrue(self.vty.verify('auth-policy closed', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy closed') > 0) - self.assertTrue(self.vty.verify('gsup remote-ip 127.0.0.4', [''])) - self.assertTrue(self.vty.verify('gsup remote-port 2222', [''])) - self.assertTrue(self.vty.verify('auth-policy remote', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy remote') > 0) - def testVtySubscriber(self): self.vty.enable() res = self.vty.command('show subscriber cache') -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43798?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: Iea267bfbd9e0f3d1ba00c6d8d8f308b24e8ec6d4 Gerrit-Change-Number: 43798 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XS] Change in osmo-sgsn[master]: mmctx: only dispatch mm_state_fsm when not DETACHED/IDLE
by lynxis lazus 07 Oct '26

07 Oct '26

Attention is currently required from: lynxis lazus, pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43697?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: mmctx: only dispatch mm_state_fsm when not DETACHED/IDLE ...................................................................... mmctx: only dispatch mm_state_fsm when not DETACHED/IDLE When the mm state fsm is in it's DETACH/IDLE state, there is no need to dispatch an detach event. Hides a log warning about an event not permitted. Change-Id: Ieec94bf0e762fd8c4ecc1e4dea5bb7c1cb23165c --- M src/sgsn/gprs_gmm.c 1 file changed, 4 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/97/43697/5 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43697?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: Ieec94bf0e762fd8c4ecc1e4dea5bb7c1cb23165c Gerrit-Change-Number: 43697 Gerrit-PatchSet: 5 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[S] Change in osmo-sgsn[master]: mmctx: don't leak a vlr vsub reference
by lynxis lazus 07 Oct '26

07 Oct '26

Attention is currently required from: lynxis lazus. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43696?usp=email to look at the new patch set (#5). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: mmctx: don't leak a vlr vsub reference ...................................................................... mmctx: don't leak a vlr vsub reference When assigning a vsub to a mmctx, ensure it is not already assigned and if so, release the old one. Change-Id: Ia3ee3997541640d33f761851b805251d4a77f2f1 --- M src/sgsn/gprs_gmm.c M src/sgsn/mmctx.c 2 files changed, 12 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/96/43696/5 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43696?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: Ia3ee3997541640d33f761851b805251d4a77f2f1 Gerrit-Change-Number: 43696 Gerrit-PatchSet: 5 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

[XL] Change in osmo-sgsn[master]: Rework SGSN code to use new libvlr code
by lynxis lazus 07 Oct '26

07 Oct '26

Attention is currently required from: pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email to look at the new patch set (#24). The following approvals got outdated and were removed: Code-Review+1 by pespin, Verified+1 by Jenkins Builder Change subject: Rework SGSN code to use new libvlr code ...................................................................... Rework SGSN code to use new libvlr code The libvlr code will take most of the logic of the Routing Area handling. By using the new libvlr code, the ACL and usage of the SGSN without the HLR has been removed. Change-Id: I9c5b4ec1b337c35e85c2d1a3d09b318380ae6ef8 --- M include/osmocom/sgsn/Makefile.am M include/osmocom/sgsn/debug.h A include/osmocom/sgsn/gmm_rau_fsm.h M include/osmocom/sgsn/gprs_gmm.h M include/osmocom/sgsn/gprs_gmm_attach.h M include/osmocom/sgsn/gprs_gmm_fsm.h M include/osmocom/sgsn/gprs_subscriber.h M include/osmocom/sgsn/mmctx.h M include/osmocom/sgsn/sgsn.h M src/sgsn/Makefile.am A src/sgsn/gmm_rau_fsm.c M src/sgsn/gprs_gmm.c M src/sgsn/gprs_gmm_attach.c M src/sgsn/gprs_gmm_fsm.c M src/sgsn/gprs_ranap.c M src/sgsn/gprs_subscriber.c M src/sgsn/mmctx.c M src/sgsn/sgsn.c M src/sgsn/sgsn_auth.c M src/sgsn/sgsn_libgtp.c M src/sgsn/sgsn_main.c M src/sgsn/sgsn_vty.c M tests/gprs_routing_area/Makefile.am M tests/sgsn/Makefile.am M tests/sgsn/sgsn_test.c M tests/sgsn/sgsn_test.ok M tests/vty_test_runner.py 27 files changed, 1,445 insertions(+), 3,643 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/62/39562/24 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I9c5b4ec1b337c35e85c2d1a3d09b318380ae6ef8 Gerrit-Change-Number: 39562 Gerrit-PatchSet: 24 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-sgsn[master]: sgsn_libgtp.c: cosmetic white space fix
by lynxis lazus 07 Oct '26

07 Oct '26

Attention is currently required from: lynxis lazus. Hello Jenkins Builder, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43640?usp=email to look at the new patch set (#7). The following approvals got outdated and were removed: Verified+1 by Jenkins Builder The change is no longer submittable: Verified is unsatisfied now. Change subject: sgsn_libgtp.c: cosmetic white space fix ...................................................................... sgsn_libgtp.c: cosmetic white space fix Change-Id: I7ec15c54a5352ab5bde0671cc329ae54099cc4fc --- M src/sgsn/sgsn_libgtp.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/40/43640/7 -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43640?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: I7ec15c54a5352ab5bde0671cc329ae54099cc4fc Gerrit-Change-Number: 43640 Gerrit-PatchSet: 7 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>

1 0

2026

2025

2024

2023

2022

gerrit-log October 2026