[XL] Change in osmo-sgsn[master]: Rework SGSN code to use new libvlr code
by Jenkins Builder 16 Feb '25
by Jenkins Builder 16 Feb '25
16 Feb '25
Jenkins Builder has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email )
Change subject: Rework SGSN code to use new libvlr code
......................................................................
Patch Set 1:
(24 comments)
File src/sgsn/gprs_gmm.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/f4546836_af02ab2d?us… :
PS1, Line 1220: if (req.mi.type == GSM_MI_TYPE_IMSI) {
braces {} are not necessary for any arm of this statement
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/103a87db_0238802d?us… :
PS1, Line 1290: if (!mmctx->attach_rau.rau_fsm || rc != 0) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/9cce0fbf_56c27305?us… :
PS1, Line 1551: else {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/cced6a4c_63e09afa?us… :
PS1, Line 1555: if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_PTMSI_TYPE)) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/5c18c175_c4f2682c?us… :
PS1, Line 1673: if (!foreign_ra &&
that open brace { should be on the previous line
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/3bd9406c_0d20d8f0?us… :
PS1, Line 1759: if (!strlen(mmctx->imsi) && strlen(mmctx->vsub->imsi)) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/b5b51a77_b2b71dd7?us… :
PS1, Line 1787: if (mmctx) {
braces {} are not necessary for any arm of this statement
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/45cf1271_4ff351ce?us… :
PS1, Line 1817: if (!mmctx->attach_rau.rau_fsm || rc != 0) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/05e1fca8_4cc277a4?us… :
PS1, Line 1964: } else {
else is not generally useful after a break or return
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/c81f22a1_37ccf196?us… :
PS1, Line 2321: if (!strlen(mmctx->imsi) && strlen(mmctx->vsub->imsi)) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/7792bd12_b75727ce?us… :
PS1, Line 2345: /* FIXME: when loosing the VLR subscriber, we should ensure the GMM is in IDLE (same for PMM) */
'loosing' may be misspelled - perhaps 'losing'?
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/7bb73ce0_a67e41c1?us… :
PS1, Line 2372: if (ctx->p_tmsi != send_tmsi && ctx->p_tmsi != GSM_RESERVED_TMSI && send_tmsi != GSM_RESERVED_TMSI)
that open brace { should be on the previous line
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/c3a34be0_6b96e70e?us… :
PS1, Line 2387: if (ctx->attach_rau.rau_fsm) {
braces {} are not necessary for single statement blocks
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/690716a0_85a4972f?us… :
PS1, Line 2393: switch(ctx->ran_type) {
space required before the open parenthesis '('
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/eede8c1e_b85d86d5?us… :
PS1, Line 2431: if (ctx->iu.mm_state_fsm->state == ST_PMM_CONNECTED) {
braces {} are not necessary for single statement blocks
File src/sgsn/gprs_rau_fsm.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/64690db2_f9f2bdc8?us… :
PS1, Line 206: switch(mmctx->ran_type) {
space required before the open parenthesis '('
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/7dd40395_3cf17296?us… :
PS1, Line 231: switch(mmctx->ran_type) {
space required before the open parenthesis '('
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/16017a94_5baa8d03?us… :
PS1, Line 304: .in_event_mask = S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
need consistent spacing around '|' (ctx:VxW) (or typedef missing in osmo-ci/lint/checkpatch/typedefs_osmo.txt?)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/5f50de23_b1e5b8f1?us… :
PS1, Line 310: .in_event_mask = S(GMM_RAU_E_UE_RAU_COMPLETE) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
need consistent spacing around '|' (ctx:VxW) (or typedef missing in osmo-ci/lint/checkpatch/typedefs_osmo.txt?)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/b2ec7b75_daf7c40f?us… :
PS1, Line 339: static __attribute__((constructor)) void gmm_rau_fsm_init()
Bad function definition - void gmm_rau_fsm_init() should probably be void gmm_rau_fsm_init(void)
File src/sgsn/mmctx.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/3e834192_7f149831?us… :
PS1, Line 619: if (!strlen(mm->imsi) && strlen(mm->vsub->imsi)) {
braces {} are not necessary for single statement blocks
File src/sgsn/sgsn_libgtp.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/68795780_9c510da6?us… :
PS1, Line 537: if (cause != GTPCAUSE_NON_EXIST) {
braces {} are not necessary for single statement blocks
File src/sgsn/sgsn_main.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/4ff120bb_904b53ab?us… :
PS1, Line 360: [DVLR] = {
please, no spaces at the start of a line
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21544):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39562/comment/76ce0eef_8fadfaf6?us… :
PS1, Line 364: },
please, no spaces at the start of a line
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I9c5b4ec1b337c35e85c2d1a3d09b318380ae6ef8
Gerrit-Change-Number: 39562
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-CC: Jenkins Builder
Gerrit-Comment-Date: Sun, 16 Feb 2025 21:09:25 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
1
0
[XL] Change in osmo-sgsn[master]: add libvlr based on MSC commit 25362cc295036a4671804db9003c3d22a88309d2
by Jenkins Builder 16 Feb '25
by Jenkins Builder 16 Feb '25
16 Feb '25
Jenkins Builder has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39560?usp=email )
Change subject: add libvlr based on MSC commit 25362cc295036a4671804db9003c3d22a88309d2
......................................................................
Patch Set 1:
(32 comments)
File include/osmocom/vlr/vlr.h:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/30ce14a4_08927aae?us… :
PS1, Line 121: long long unsigned int id;
type 'long long unsigned int' should be specified in [[un]signed] [short|int|long|long long] order
File src/libvlr/vlr.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/36ee17ed_45d98a9a?us… :
PS1, Line 238: OSMO_STRBUF_PRINTF(sb, "%sMSISDN-%s", present? ":" : "", vsub->msisdn);
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/3282d6e5_97653293?us… :
PS1, Line 242: OSMO_STRBUF_PRINTF(sb, "%sTMSI-0x%08X", present? ":" : "", vsub->tmsi);
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/943adeb0_b4c9dcfd?us… :
PS1, Line 246: OSMO_STRBUF_PRINTF(sb, "%sTMSInew-0x%08X", present? ":" : "", vsub->tmsi_new);
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/8f9191d6_2c999b1b?us… :
PS1, Line 258: char *name = (char*)vlr_subscr_name(vsub);
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/efcaf8d6_9afc23dd?us… :
PS1, Line 263: strcpy(name + maxlen - 2, "..");
Instead of strncpy()/strcpy(), use osmo_strlcpy() or OSMO_STRLCPY_ARRAY()
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/7fece6d8_db49bf31?us… :
PS1, Line 380: vlr_subscr_name(vsub), (e->count - old_use_count) > 0? "+" : "-", e->use,
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/50e3dc39_8e6b6088?us… :
PS1, Line 705: osmo_plmn_name(&vsub->sgs.last_eutran_plmn) :
code indent should use tabs where possible
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/6d83c633_5dad5863?us… :
PS1, Line 810: struct sgsn_subscriber_pdp_data* pdata;
"foo* bar" should be "foo *bar"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/057b7867_ccfe033c?us… :
PS1, Line 1447: VLR_AUTH_E_MS_ID_IMSI, (void*)mi->imsi);
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/c8536e10_790fb350?us… :
PS1, Line 1455: return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMSI, (void*)mi->imsi);
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/83436984_94a4b401?us… :
PS1, Line 1457: return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMEI, (void*)mi->imei);
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/4fdd2728_87f519a6?us… :
PS1, Line 1459: return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMEISV, (void*)mi->imeisv);
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/d79a85bc_dc68315a?us… :
PS1, Line 1716: struct vlr_subscr **fsub = (void*)&target->filter_data[LOG_FLT_VLR_SUBSCR];
"(foo*)" should be "(foo *)"
File src/libvlr/vlr_access_req_fsm.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/9f6e2d3d_6fd08ab1?us… :
PS1, Line 111: return par->result? gsm48_reject_value_name(par->result) : "PASSED";
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/179c7ad1_d8c6cb00?us… :
PS1, Line 415: } else {
else is not generally useful after a break or return
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/2ae208fe_b94e8551?us… :
PS1, Line 421: } else {
else is not generally useful after a break or return
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/6e21decb_2609fbec?us… :
PS1, Line 496: result = *(enum vlr_ciph_result_cause*)data;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/48f07d72_f27f4e87?us… :
PS1, Line 791: .in_event_mask = ,
space prohibited before that ',' (ctx:WxE)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/3b3c69d6_368843aa?us… :
PS1, Line 798: .in_event_mask = ,
space prohibited before that ',' (ctx:WxE)
File src/libvlr/vlr_auth_fsm.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/920afee1_07203e97?us… :
PS1, Line 199: res_len, (res_len == vec->res_len)? "valid" : "INVALID on UTRAN");
spaces required around that '?' (ctx:VxW)
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/2d1bb2f0_42445ac2?us… :
PS1, Line 216: } else {
else is not generally useful after a break or return
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/37626023_63c0098a?us… :
PS1, Line 543: strncpy(vsub->imsi, mi_string, sizeof(vsub->imsi));
Instead of strncpy()/strcpy(), use osmo_strlcpy() or OSMO_STRLCPY_ARRAY()
File src/libvlr/vlr_lu_fsm.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/1c28cb02_9f6ca16b?us… :
PS1, Line 160: return (struct vlr_subscr*)fi->priv;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/bf8da292_430f6f9f?us… :
PS1, Line 272: return (struct vlr_subscr*)fi->priv;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/68c2689f_61e794bb?us… :
PS1, Line 667: return (struct lu_compl_vlr_priv*)fi->priv;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/8b0ad4b4_1bdf0d3a?us… :
PS1, Line 1282: result = *(enum vlr_ciph_result_cause*)data;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/a4c2e520_c43a72b6?us… :
PS1, Line 1404: cause = *(uint8_t*)data;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/f7020fbb_5031d517?us… :
PS1, Line 1436: cause = *(uint8_t*)data;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/a8430c51_9c812556?us… :
PS1, Line 1643: return (struct lu_fsm_priv*)fi->priv;
"(foo*)" should be "(foo *)"
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/5e65665a_c59f8cbc?us… :
PS1, Line 1691: strncpy(lfp->imsi, imsi, sizeof(lfp->imsi)-1);
Instead of strncpy()/strcpy(), use osmo_strlcpy() or OSMO_STRLCPY_ARRAY()
File src/libvlr/vlr_sgs.c:
Robot Comment from checkpatch (run ID jenkins-gerrit-lint-21542):
https://gerrit.osmocom.org/c/osmo-sgsn/+/39560/comment/9f6a889d_c1208a9b?us… :
PS1, Line 324: }
void function return statements are not generally useful
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39560?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I221114e00e6f338a75ae0dd7ac285e262b23635d
Gerrit-Change-Number: 39560
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-CC: Jenkins Builder
Gerrit-Comment-Date: Sun, 16 Feb 2025 21:09:07 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
1
0
[XL] Change in osmo-sgsn[master]: add libvlr based on MSC commit 25362cc295036a4671804db9003c3d22a88309d2
by lynxis lazus 16 Feb '25
by lynxis lazus 16 Feb '25
16 Feb '25
lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39560?usp=email )
Change subject: add libvlr based on MSC commit 25362cc295036a4671804db9003c3d22a88309d2
......................................................................
add libvlr based on MSC commit 25362cc295036a4671804db9003c3d22a88309d2
Change-Id: I221114e00e6f338a75ae0dd7ac285e262b23635d
---
M configure.ac
A include/osmocom/vlr/Makefile.am
A include/osmocom/vlr/vlr.h
A include/osmocom/vlr/vlr_sgs.h
M src/Makefile.am
A src/libvlr/Makefile.am
A src/libvlr/vlr.c
A src/libvlr/vlr_access_req_fsm.c
A src/libvlr/vlr_access_req_fsm.h
A src/libvlr/vlr_auth_fsm.c
A src/libvlr/vlr_auth_fsm.h
A src/libvlr/vlr_core.h
A src/libvlr/vlr_logging.c
A src/libvlr/vlr_lu_fsm.c
A src/libvlr/vlr_lu_fsm.h
A src/libvlr/vlr_sgs.c
A src/libvlr/vlr_sgs_fsm.c
A src/libvlr/vlr_sgs_fsm.h
M src/sgsn/Makefile.am
M tests/gprs_routing_area/Makefile.am
M tests/sgsn/Makefile.am
21 files changed, 6,729 insertions(+), 0 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/60/39560/1
diff --git a/configure.ac b/configure.ac
index 17a0236..fb45d4a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -237,6 +237,7 @@
include/osmocom/gtphub/Makefile
include/osmocom/sgsn/Makefile
src/Makefile
+ src/libvlr/Makefile
src/gprs/Makefile
src/sgsn/Makefile
src/gtphub/Makefile
diff --git a/include/osmocom/vlr/Makefile.am b/include/osmocom/vlr/Makefile.am
new file mode 100644
index 0000000..f47da40
--- /dev/null
+++ b/include/osmocom/vlr/Makefile.am
@@ -0,0 +1,4 @@
+noinst_HEADERS = \
+ vlr.h \
+ vlr_sgs.h \
+ $(NULL)
diff --git a/include/osmocom/vlr/vlr.h b/include/osmocom/vlr/vlr.h
new file mode 100644
index 0000000..03b76f3
--- /dev/null
+++ b/include/osmocom/vlr/vlr.h
@@ -0,0 +1,506 @@
+#pragma once
+
+#include <stdint.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/use_count.h>
+#include <osmocom/core/stat_item.h>
+#include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/protocol/gsm_23_003.h>
+#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
+#include <osmocom/gsm/gsm23003.h>
+#include <osmocom/gsm/gsm0808.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/gsm/ipa.h>
+#include <osmocom/gsupclient/gsup_client.h>
+#include <osmocom/vlr/vlr_sgs.h>
+
+struct log_target;
+struct osmo_mobile_identity;
+
+#define VLR_SUBSCRIBER_NO_EXPIRATION 0
+#define VLR_SUBSCRIBER_LU_EXPIRATION_INTERVAL 60 /* in seconds */
+
+#define VSUB_USE_ATTACHED "attached"
+
+/* from 3s to 10s */
+#define GSM_29002_TIMER_S 10
+/* from 15s to 30s */
+#define GSM_29002_TIMER_M 30
+/* from 1min to 10min */
+#define GSM_29002_TIMER_ML (10*60)
+/* from 28h to 38h */
+#define GSM_29002_TIMER_L (32*60*60)
+
+/* VLR subscriber authentication state */
+enum vlr_subscr_auth_state {
+ /* subscriber needs to be authenticated */
+ VLR_SUB_AS_NEEDS_AUTH,
+ /* waiting for AuthInfo from HLR/AUC */
+ VLR_SUB_AS_NEEDS_AUTH_WAIT_AI,
+ /* waiting for response from subscriber */
+ VLR_SUB_AS_WAIT_RESP,
+ /* successfully authenticated */
+ VLR_SUB_AS_AUTHENTICATED,
+ /* subscriber needs re-sync */
+ VLR_SUB_AS_NEEDS_RESYNC,
+ /* waiting for AuthInfo with ReSync */
+ VLR_SUB_AS_NEEDS_AUTH_WAIT_SAI_RESYNC,
+ /* waiting for response from subscr, resync case */
+ VLR_SUB_AS_WAIT_RESP_RESYNC,
+ /* waiting for IMSI from subscriber */
+ VLR_SUB_AS_WAIT_ID_IMSI,
+ /* authentication has failed */
+ VLR_SUB_AS_AUTH_FAILED,
+};
+
+enum vlr_lu_event {
+ VLR_ULA_E_UPDATE_LA, /* Initial trigger (LU from MS) */
+ VLR_ULA_E_SEND_ID_ACK, /* Result of Send-ID from PVLR */
+ VLR_ULA_E_SEND_ID_NACK, /* Result of Send-ID from PVLR */
+ VLR_ULA_E_AUTH_SUCCESS, /* Successful result of auth procedure */
+ VLR_ULA_E_AUTH_NO_INFO, /* HLR returned SAI NACK, possibly continue without auth */
+ VLR_ULA_E_AUTH_FAILURE, /* Auth procedure failed */
+ VLR_ULA_E_CIPH_RES, /* Result of Ciphering Mode Command */
+ VLR_ULA_E_ID_IMSI, /* IMSI received from MS */
+ VLR_ULA_E_ID_IMEI, /* IMEI received from MS */
+ VLR_ULA_E_ID_IMEISV, /* IMEISV received from MS */
+ VLR_ULA_E_HLR_IMEI_ACK, /* Check_IMEI_VLR result from HLR */
+ VLR_ULA_E_HLR_IMEI_NACK,/* Check_IMEI_VLR result from HLR */
+ VLR_ULA_E_HLR_LU_RES, /* HLR UpdateLocation result */
+ VLR_ULA_E_UPD_HLR_COMPL,/* UpdatE_HLR_VLR result */
+ VLR_ULA_E_LU_COMPL_SUCCESS,/* Location_Update_Completion_VLR result */
+ VLR_ULA_E_LU_COMPL_FAILURE,/* Location_Update_Completion_VLR result */
+ VLR_ULA_E_NEW_TMSI_ACK, /* TMSI Reallocation Complete */
+};
+
+enum vlr_ciph_result_cause {
+ VLR_CIPH_REJECT, /* ? */
+ VLR_CIPH_COMPL,
+};
+
+struct vlr_auth_tuple {
+ int use_count;
+ int key_seq;
+ struct osmo_auth_vector vec;
+};
+#define VLR_KEY_SEQ_INVAL 7 /* GSM 04.08 - 10.5.1.2 */
+
+
+enum vlr_subscr_security_context {
+ VLR_SEC_CTX_NONE,
+ VLR_SEC_CTX_GSM,
+ VLR_SEC_CTX_UMTS,
+};
+
+enum vlr_lu_type {
+ VLR_LU_TYPE_PERIODIC,
+ VLR_LU_TYPE_IMSI_ATTACH,
+ VLR_LU_TYPE_REGULAR,
+};
+
+#define OSMO_LBUF_DECL(name, xlen) \
+ struct { \
+ uint8_t buf[xlen]; \
+ size_t len; \
+ } name
+
+struct sgsn_mm_ctx;
+struct vlr_instance;
+
+#define VLR_NAME_LENGTH 160
+
+/* The VLR subscriber is the part of the GSM subscriber state in VLR (CS) or
+ * SGSN (PS), particularly while interacting with the HLR via GSUP */
+struct vlr_subscr {
+ struct llist_head list;
+ struct vlr_instance *vlr;
+
+ /* TODO either populate from HLR or drop this completely? */
+ long long unsigned int id;
+
+ /* Data from HLR */ /* 3GPP TS 23.008 */
+ /* Always use vlr_subscr_set_imsi() to write to imsi[] */
+ char imsi[GSM23003_IMSI_MAX_DIGITS+1]; /* 2.1.1.1 */
+ char msisdn[GSM23003_MSISDN_MAX_DIGITS+1]; /* 2.1.2 */
+ char name[VLR_NAME_LENGTH+1]; /* proprietary */
+ OSMO_LBUF_DECL(hlr, 16); /* 2.4.7 */
+ uint32_t age_indicator; /* 2.17.1 */
+
+ /* Authentication Data */
+ struct vlr_auth_tuple auth_tuples[5]; /* 2.3.1-2.3.4 */
+ struct vlr_auth_tuple *last_tuple;
+ enum vlr_subscr_security_context sec_ctx;
+
+ /* Data local to VLR is below */
+ uint32_t tmsi; /* 2.1.4 */
+ /* Newly allocated TMSI that was not yet acked by MS */
+ uint32_t tmsi_new;
+
+ struct osmo_cell_global_id cgi; /* 2.4.16 */
+
+ char imeisv[GSM23003_IMEISV_NUM_DIGITS+1]; /* 2.2.3 */
+ char imei[GSM23003_IMEI_NUM_DIGITS_NO_CHK+1]; /* 2.1.9 */
+ bool imsi_detached_flag; /* 2.7.1 */
+ bool conf_by_radio_contact_ind; /* 2.7.4.1 */
+ bool sub_dataconf_by_hlr_ind; /* 2.7.4.2 */
+ bool loc_conf_in_hlr_ind; /* 2.7.4.3 */
+ bool dormant_ind; /* 2.7.8 */
+ bool cancel_loc_rx; /* 2.7.8A */
+ bool ms_not_reachable_flag; /* 2.10.2 (MNRF) */
+ bool la_allowed;
+
+ struct osmo_use_count use_count;
+ struct osmo_use_count_entry use_count_buf[8];
+ int32_t max_total_use_count;
+
+ struct osmo_fsm_inst *lu_fsm;
+ struct osmo_fsm_inst *auth_fsm;
+ struct osmo_fsm_inst *proc_arq_fsm;
+ struct osmo_fsm_inst *sgs_fsm;
+
+ bool lu_complete;
+ time_t expire_lu;
+
+ void *msc_conn_ref;
+
+ /* PS (SGSN) specific parts */
+ struct {
+ struct llist_head pdp_list;
+ } ps;
+ /* CS (NITB/CSCN) specific parts */
+ struct {
+ /* pending requests */
+ bool is_paging;
+ struct osmo_timer_list paging_response_timer;
+ /* list of struct subscr_request */
+ struct llist_head requests;
+ uint8_t lac;
+ enum osmo_rat_type attached_via_ran;
+ } cs;
+ /* SGs (MME) specific parts */
+ struct {
+ struct vlr_sgs_cfg cfg;
+ char mme_name[SGS_MME_NAME_LEN + 1];
+ struct osmo_location_area_id lai;
+ vlr_sgs_lu_response_cb_t response_cb;
+ vlr_sgs_lu_paging_cb_t paging_cb;
+ vlr_sgs_lu_mminfo_cb_t mminfo_cb;
+ enum sgsap_service_ind paging_serv_ind;
+ struct osmo_timer_list Ts5;
+ bool last_eutran_plmn_present;
+ struct osmo_plmn_id last_eutran_plmn;
+ } sgs;
+
+ struct osmo_gsm48_classmark classmark;
+};
+
+enum vlr_ciph {
+ VLR_CIPH_NONE = 0, /*< A5/0, no encryption */
+ VLR_CIPH_A5_1 = 1, /*< A5/1, encryption */
+ VLR_CIPH_A5_2 = 2, /*< A5/2, deprecated export-grade encryption */
+ VLR_CIPH_A5_3 = 3, /*< A5/3, 'new secure' encryption */
+};
+
+static inline uint8_t vlr_ciph_to_gsm0808_alg_id(enum vlr_ciph ciph)
+{
+ switch (ciph) {
+ case VLR_CIPH_NONE:
+ return GSM0808_ALG_ID_A5_0;
+ case VLR_CIPH_A5_1:
+ return GSM0808_ALG_ID_A5_1;
+ case VLR_CIPH_A5_2:
+ return GSM0808_ALG_ID_A5_2;
+ case VLR_CIPH_A5_3:
+ return GSM0808_ALG_ID_A5_3;
+ default:
+ return GSM0808_ALG_ID_A5_7;
+ }
+}
+
+struct vlr_ops {
+ /* encode + transmit an AUTH REQ towards the MS.
+ * \param[in] at auth tuple providing rand, key_seq and autn.
+ * \param[in] send_autn True to send AUTN, for r99 UMTS auth.
+ */
+ int (*tx_auth_req)(void *msc_conn_ref, struct vlr_auth_tuple *at,
+ bool send_autn);
+ /* encode + transmit an AUTH REJECT towards the MS */
+ int (*tx_auth_rej)(void *msc_conn_ref);
+
+ /* encode + transmit an IDENTITY REQUEST towards the MS */
+ int (*tx_id_req)(void *msc_conn_ref, uint8_t mi_type);
+
+ int (*tx_lu_acc)(void *msc_conn_ref, uint32_t send_tmsi, enum vlr_lu_type lu_type);
+ int (*tx_lu_rej)(void *msc_conn_ref, enum gsm48_reject_value cause, enum vlr_lu_type lu_type);
+ int (*tx_cm_serv_acc)(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type);
+ int (*tx_cm_serv_rej)(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type,
+ enum gsm48_reject_value cause);
+
+ int (*set_ciph_mode)(void *msc_conn_ref, bool umts_aka, bool retrieve_imeisv);
+
+ int (*tx_common_id)(void *msc_conn_ref);
+
+ int (*tx_mm_info)(void *msc_conn_ref);
+
+ /* notify MSC/SGSN that the subscriber data in VLR has been updated */
+ void (*subscr_update)(struct vlr_subscr *vsub);
+ /* notify MSC/SGSN that the given subscriber has been associated
+ * with this msc_conn_ref */
+ int (*subscr_assoc)(void *msc_conn_ref, struct vlr_subscr *vsub);
+ /* notify MSC that the given subscriber is no longer valid.
+ * If cancel_by_update, the MSC doesn't inform the MS/UE about it.
+ */
+ void (*subscr_inval)(void *msc_conn_ref, struct vlr_subscr *vsub,
+ enum gsm48_reject_value cause, bool cancel_by_update);
+};
+
+/* An instance of the VLR codebase */
+struct vlr_instance {
+ struct llist_head subscribers;
+ struct llist_head operations;
+ struct gsup_client_mux *gcm;
+ struct vlr_ops ops;
+ struct osmo_timer_list lu_expire_timer;
+ struct {
+ bool retrieve_imeisv_early;
+ bool retrieve_imeisv_ciphered;
+ bool assign_tmsi;
+ bool check_imei_rqd;
+ int auth_tuple_max_reuse_count;
+ bool auth_reuse_old_sets_on_error;
+ bool parq_retrieve_imsi;
+ bool is_ps;
+ uint8_t nri_bitlen;
+ struct osmo_nri_ranges *nri_ranges;
+ } cfg;
+ struct osmo_stat_item_group *statg;
+ struct rate_ctr_group *ctrg;
+ /* A free-form pointer for use by the caller */
+ void *user_ctx;
+};
+
+extern const struct value_string vlr_ciph_names[];
+static inline const char *vlr_ciph_name(enum vlr_ciph val)
+{
+ return get_value_string(vlr_ciph_names, val);
+}
+
+/* Location Updating request */
+struct osmo_fsm_inst *
+vlr_loc_update(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_lu_type lu_type, uint32_t tmsi, const char *imsi,
+ const struct osmo_location_area_id *old_lai,
+ const struct osmo_location_area_id *new_lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran,
+ bool assign_tmsi);
+
+void vlr_loc_update_cancel(struct osmo_fsm_inst *fi,
+ enum osmo_fsm_term_cause fsm_cause,
+ uint8_t gsm48_cause);
+
+/* tell the VLR that the RAN connection is gone */
+int vlr_subscr_disconnected(struct vlr_subscr *vsub);
+bool vlr_subscr_expire(struct vlr_subscr *vsub);
+int vlr_subscr_rx_id_resp(struct vlr_subscr *vsub, const struct osmo_mobile_identity *mi);
+int vlr_subscr_rx_auth_resp(struct vlr_subscr *vsub, bool is_r99, bool is_utran,
+ const uint8_t *res, uint8_t res_len);
+int vlr_subscr_rx_auth_fail(struct vlr_subscr *vsub, const uint8_t *auts);
+int vlr_subscr_tx_auth_fail_rep(const struct vlr_subscr *vsub) __attribute__((warn_unused_result));
+void vlr_subscr_rx_ciph_res(struct vlr_subscr *vsub, enum vlr_ciph_result_cause result);
+int vlr_subscr_rx_tmsi_reall_compl(struct vlr_subscr *vsub);
+int vlr_subscr_rx_imsi_detach(struct vlr_subscr *vsub);
+
+struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops, bool is_ps);
+int vlr_start(struct vlr_instance *vlr, struct gsup_client_mux *gcm);
+int vlr_gsup_rx(struct gsup_client_mux *gcm, void *data, const struct osmo_gsup_message *gsup_msg);
+
+static inline bool vlr_is_cs(struct vlr_instance *vlr) { return !vlr->cfg.is_ps; };
+static inline bool vlr_is_ps(struct vlr_instance *vlr) { return vlr->cfg.is_ps; };
+
+/* internal use only */
+
+void sub_pres_vlr_fsm_start(struct osmo_fsm_inst **fsm,
+ struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ uint32_t term_event);
+struct osmo_fsm_inst *
+upd_hlr_vlr_proc_start(struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ uint32_t parent_event);
+
+struct osmo_fsm_inst *
+lu_compl_vlr_proc_start(struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ void *msc_conn_ref,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure);
+
+
+const char *vlr_subscr_name(const struct vlr_subscr *vsub);
+const char *vlr_subscr_short_name(const struct vlr_subscr *vsub, unsigned int maxlen);
+const char *vlr_subscr_msisdn_or_name(const struct vlr_subscr *vsub);
+
+#define vlr_subscr_find_by_imsi(vlr, imsi, USE) \
+ _vlr_subscr_find_by_imsi(vlr, imsi, USE, __FILE__, __LINE__)
+#define vlr_subscr_find_or_create_by_imsi(vlr, imsi, USE, created) \
+ _vlr_subscr_find_or_create_by_imsi(vlr, imsi, USE, created, \
+ __FILE__, __LINE__)
+
+#define vlr_subscr_find_by_tmsi(vlr, tmsi, USE) \
+ _vlr_subscr_find_by_tmsi(vlr, tmsi, USE, __FILE__, __LINE__)
+#define vlr_subscr_find_or_create_by_tmsi(vlr, tmsi, USE, created) \
+ _vlr_subscr_find_or_create_by_tmsi(vlr, tmsi, USE, created, \
+ __FILE__, __LINE__)
+
+#define vlr_subscr_find_by_msisdn(vlr, msisdn, USE) \
+ _vlr_subscr_find_by_msisdn(vlr, msisdn, USE, __FILE__, __LINE__)
+
+#define vlr_subscr_find_by_mi(vlr, mi, USE) \
+ _vlr_subscr_find_by_mi(vlr, mi, USE, __FILE__, __LINE__)
+
+struct vlr_subscr *_vlr_subscr_find_by_imsi(struct vlr_instance *vlr,
+ const char *imsi,
+ const char *use,
+ const char *file, int line);
+struct vlr_subscr *_vlr_subscr_find_or_create_by_imsi(struct vlr_instance *vlr,
+ const char *imsi,
+ const char *use,
+ bool *created,
+ const char *file,
+ int line);
+
+struct vlr_subscr *_vlr_subscr_find_by_tmsi(struct vlr_instance *vlr,
+ uint32_t tmsi,
+ const char *use,
+ const char *file, int line);
+struct vlr_subscr *_vlr_subscr_find_or_create_by_tmsi(struct vlr_instance *vlr,
+ uint32_t tmsi,
+ const char *use,
+ bool *created,
+ const char *file,
+ int line);
+
+struct vlr_subscr *_vlr_subscr_find_by_msisdn(struct vlr_instance *vlr,
+ const char *msisdn,
+ const char *use,
+ const char *file, int line);
+
+struct vlr_subscr *_vlr_subscr_find_by_mi(struct vlr_instance *vlr,
+ const struct osmo_mobile_identity *mi,
+ const char *use,
+ const char *file, int line);
+
+#define vlr_subscr_get(VSUB, USE) vlr_subscr_get_src(VSUB, USE, __FILE__, __LINE__)
+#define vlr_subscr_put(VSUB, USE) vlr_subscr_put_src(VSUB, USE, __FILE__, __LINE__)
+
+#define vlr_subscr_get_src(VSUB, USE, SRCFILE, SRCLINE) \
+ OSMO_ASSERT((VSUB) && _osmo_use_count_get_put(&(VSUB)->use_count, USE, 1, SRCFILE, SRCLINE) == 0)
+#define vlr_subscr_put_src(VSUB, USE, SRCFILE, SRCLINE) \
+ OSMO_ASSERT((VSUB) && _osmo_use_count_get_put(&(VSUB)->use_count, USE, -1, SRCFILE, SRCLINE) == 0)
+
+void vlr_subscr_free(struct vlr_subscr *vsub);
+int vlr_subscr_alloc_tmsi(struct vlr_subscr *vsub);
+
+void vlr_subscr_set_imsi(struct vlr_subscr *vsub, const char *imsi);
+void vlr_subscr_set_imei(struct vlr_subscr *vsub, const char *imei);
+void vlr_subscr_set_imeisv(struct vlr_subscr *vsub, const char *imeisv);
+void vlr_subscr_set_msisdn(struct vlr_subscr *vsub, const char *msisdn);
+void vlr_subscr_set_last_used_eutran_plmn_id(struct vlr_subscr *vsub,
+ const struct osmo_plmn_id *last_eutran_plmn);
+
+bool vlr_subscr_matches_imsi(struct vlr_subscr *vsub, const char *imsi);
+bool vlr_subscr_matches_tmsi(struct vlr_subscr *vsub, uint32_t tmsi);
+bool vlr_subscr_matches_msisdn(struct vlr_subscr *vsub, const char *msisdn);
+bool vlr_subscr_matches_imei(struct vlr_subscr *vsub, const char *imei);
+
+unsigned long vlr_timer_secs(struct vlr_instance *vlr, int cs_timer, int ps_timer);
+
+/* vlr_tdefs is pointing to msc_tdefs_vlr or sgsn_tdefs_vlr depending on the domain*/
+extern struct osmo_tdef *vlr_tdefs;
+
+int vlr_subscr_changed(struct vlr_subscr *vsub);
+int vlr_subscr_purge(struct vlr_subscr *vsub) __attribute__((warn_unused_result));
+void vlr_subscr_cancel_attach_fsm(struct vlr_subscr *vsub,
+ enum osmo_fsm_term_cause fsm_cause,
+ enum gsm48_reject_value gsm48_cause);
+
+void vlr_subscr_enable_expire_lu(struct vlr_subscr *vsub);
+
+/* Process Access Request FSM */
+
+enum proc_arq_vlr_event {
+ PR_ARQ_E_START,
+ PR_ARQ_E_ID_IMSI,
+ PR_ARQ_E_AUTH_RES,
+ PR_ARQ_E_AUTH_NO_INFO,
+ PR_ARQ_E_AUTH_FAILURE,
+ PR_ARQ_E_CIPH_RES,
+ PR_ARQ_E_UPD_LOC_RES,
+ PR_ARQ_E_TRACE_RES,
+ PR_ARQ_E_IMEI_RES,
+ PR_ARQ_E_PRES_RES,
+ PR_ARQ_E_TMSI_ACK,
+};
+
+enum vlr_parq_type {
+ VLR_PR_ARQ_T_INVALID = 0, /* to guard against unset vars */
+ VLR_PR_ARQ_T_CM_SERV_REQ,
+ VLR_PR_ARQ_T_PAGING_RESP,
+ VLR_PR_ARQ_T_CM_RE_ESTABLISH_REQ,
+ /* FIXME: differentiate between services of 24.008 10.5.3.3 */
+};
+
+/* Process Access Request (CM SERV REQ / PAGING RESP) */
+void
+vlr_proc_acc_req(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_parq_type type, enum osmo_cm_service_type cm_service_type,
+ const struct osmo_mobile_identity *mi,
+ const struct osmo_location_area_id *lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran);
+
+void vlr_parq_cancel(struct osmo_fsm_inst *fi,
+ enum osmo_fsm_term_cause fsm_cause,
+ enum gsm48_reject_value gsm48_cause);
+
+int vlr_set_ciph_mode(struct vlr_instance *vlr,
+ struct osmo_fsm_inst *fi,
+ void *msc_conn_ref,
+ bool umts_aka,
+ bool retrieve_imeisv);
+
+bool vlr_use_umts_aka(struct osmo_auth_vector *vec, bool is_r99);
+
+void log_set_filter_vlr_subscr(struct log_target *target,
+ struct vlr_subscr *vlr_subscr);
+
+enum gsm48_reject_value vlr_gmm_cause_to_reject_cause(enum gsm48_gmm_cause gmm_cause);
+enum gsm48_reject_value vlr_gmm_cause_to_reject_cause_domain(enum gsm48_gmm_cause gmm_cause, bool is_cs);
+enum gsm48_reject_value vlr_reject_causes_cs(enum gsm48_reject_value reject_cause);
+enum gsm48_reject_value vlr_reject_causes_ps(enum gsm48_reject_value reject_cause);
+
+/* logging */
+enum osmo_vlr_cat {
+ OSMO_VLR_LOGC_VLR,
+ OSMO_VLR_LOGC_SGS,
+ _OSMO_VLR_LOGC_MAX,
+};
+
+void osmo_vlr_set_log_cat(enum osmo_vlr_cat logc, int logc_num);
diff --git a/include/osmocom/vlr/vlr_sgs.h b/include/osmocom/vlr/vlr_sgs.h
new file mode 100644
index 0000000..7193fa5
--- /dev/null
+++ b/include/osmocom/vlr/vlr_sgs.h
@@ -0,0 +1,111 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+#include <osmocom/gsm/gsm29118.h>
+
+enum vlr_lu_type;
+struct vlr_subscr;
+struct vlr_instance;
+
+#define VSUB_USE_SGS_LU "SGs-lu"
+#define VSUB_USE_SGS_PAGING_REQ "SGs-paging-req"
+
+/* See also 3GPP TS 29.118, chapter 4.2.2 States at the VLR */
+enum sgs_ue_fsm_state {
+ SGS_UE_ST_NULL,
+ SGS_UE_ST_LA_UPD_PRES,
+ SGS_UE_ST_ASSOCIATED,
+};
+
+enum vlr_sgs_state_tmr {
+ /* Started when sending the SGsAP-PAGING-REQUEST, implemented in vlr_sgs.c */
+ SGS_STATE_TS5,
+ /* TMSI reallocation, 5.2.3.5, implemented by fsm in vlr_sgs_fsm.c */
+ SGS_STATE_TS6_2,
+ /* Started when SGsAP-ALERT-REQUEST is sent 5.3.2.1, not implemented yet */
+ SGS_STATE_TS7,
+ /* Reset ack timeout, implemnted in sgs_iface.c */
+ SGS_STATE_TS11,
+ /* Started when SGsAP-SERVICE-REQUEST is received 5.15.1, not implemented yet */
+ SGS_STATE_TS14,
+ /* Started when SGsAP-MO-CSFB-INDICATION is received 5.16.3 (UE fallback, not implemented yet) */
+ SGS_STATE_TS15,
+ _NUM_SGS_STATE_TIMERS
+};
+
+enum vlr_sgs_state_ctr {
+ /* Alert request retransmit count */
+ SGS_STATE_NS7,
+ /* Reset repeat count */
+ SGS_STATE_NS11,
+ _NUM_SGS_STATE_COUNTERS
+};
+
+extern const struct value_string sgs_state_timer_names[];
+static inline const char *vlr_sgs_state_timer_name(enum vlr_sgs_state_tmr Ts)
+{
+ return get_value_string(sgs_state_timer_names, Ts);
+}
+
+extern const struct value_string sgs_state_counter_names[];
+static inline const char *vlr_sgs_state_counter_name(enum vlr_sgs_state_ctr Ns)
+{
+ return get_value_string(sgs_state_counter_names, Ns);
+}
+
+/* This callback function is called when an SGs location update is complete */
+struct sgs_lu_response {
+ bool accepted;
+ bool error;
+ struct vlr_subscr *vsub;
+};
+typedef void (*vlr_sgs_lu_response_cb_t) (struct sgs_lu_response *response);
+
+/* This callback function is called in cases where a paging request is required
+ * after the LU is completed or when a paging expired */
+typedef int (*vlr_sgs_lu_paging_cb_t) (struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind);
+
+/* This callback function is called to send the MM info to the UE. */
+typedef void (*vlr_sgs_lu_mminfo_cb_t) (struct vlr_subscr *vsub);
+
+/* Configuration parameters for the SGs FSM */
+struct vlr_sgs_cfg {
+ unsigned int timer[_NUM_SGS_STATE_TIMERS];
+ unsigned int counter[_NUM_SGS_STATE_COUNTERS];
+};
+
+void vlr_sgs_reset(struct vlr_instance *vlr);
+int vlr_sgs_loc_update(struct vlr_instance *vlr, struct vlr_sgs_cfg *cfg,
+ vlr_sgs_lu_response_cb_t response_cb, vlr_sgs_lu_paging_cb_t paging_cb,
+ vlr_sgs_lu_mminfo_cb_t mminfo_cb, char *mme_name, enum vlr_lu_type type, const char *imsi,
+ struct osmo_location_area_id *new_lai, struct osmo_plmn_id *last_eutran_plmn);
+void vlr_sgs_loc_update_acc_sent(struct vlr_subscr *vsub);
+void vlr_sgs_loc_update_rej_sent(struct vlr_subscr *vsub);
+void vlr_sgs_detach(struct vlr_instance *vlr, const char *imsi, bool eps);
+void vlr_sgs_imsi_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_noneps_type type);
+void vlr_sgs_eps_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_eps_type type);
+void vlr_sgs_tmsi_reall_compl(struct vlr_instance *vlr, const char *imsi);
+void vlr_sgs_pag_rej(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause);
+void vlr_sgs_pag_ack(struct vlr_instance *vlr, const char *imsi);
+void vlr_sgs_ue_unr(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause);
+void vlr_sgs_pag(struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind);
+bool vlr_sgs_pag_pend(struct vlr_subscr *vsub);
diff --git a/src/Makefile.am b/src/Makefile.am
index e389b7f..6f8eaa5 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,4 +1,5 @@
SUBDIRS = \
+ libvlr \
gprs \
sgsn \
gtphub \
diff --git a/src/libvlr/Makefile.am b/src/libvlr/Makefile.am
new file mode 100644
index 0000000..49bf573
--- /dev/null
+++ b/src/libvlr/Makefile.am
@@ -0,0 +1,32 @@
+AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include -I$(top_builddir)
+AM_CFLAGS= \
+ -Wall \
+ $(LIBOSMOCORE_CFLAGS) \
+ $(LIBOSMOVTY_CFLAGS) \
+ $(LIBOSMOSIGTRAN_CFLAGS) \
+ $(LIBOSMOMGCPCLIENT_CFLAGS) \
+ $(LIBOSMOGSUPCLIENT_CFLAGS) \
+ $(LIBOSMOABIS_CFLAGS) \
+ $(LIBOSMORANAP_CFLAGS) \
+ $(LIBOSMOGSM_CFLAGS) \
+ $(COVERAGE_CFLAGS) \
+ $(NULL)
+
+noinst_HEADERS = \
+ vlr_access_req_fsm.h \
+ vlr_auth_fsm.h \
+ vlr_core.h \
+ vlr_lu_fsm.h \
+ vlr_sgs_fsm.h \
+ $(NULL)
+
+noinst_LIBRARIES = libvlr.a
+
+libvlr_a_SOURCES = \
+ vlr.c \
+ vlr_access_req_fsm.c \
+ vlr_auth_fsm.c \
+ vlr_lu_fsm.c \
+ vlr_sgs.c \
+ vlr_sgs_fsm.c \
+ $(NULL)
diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
new file mode 100644
index 0000000..2b56a8b
--- /dev/null
+++ b/src/libvlr/vlr.c
@@ -0,0 +1,1754 @@
+/* Osmocom Visitor Location Register (VLR) code base */
+
+/* (C) 2016 by Harald Welte <laforge(a)gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/stats.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/tdef.h>
+#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
+#include <osmocom/gsm/gsm23236.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/gsm/apn.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/gsm/ipa.h>
+#include <osmocom/gsupclient/gsup_client.h>
+#include <osmocom/vlr/vlr_sgs.h>
+#include <osmocom/vlr/vlr.h>
+#include <osmocom/gsupclient/gsup_client_mux.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <errno.h>
+
+#include "vlr_core.h"
+#include "vlr_auth_fsm.h"
+#include "vlr_lu_fsm.h"
+#include "vlr_access_req_fsm.h"
+#include "vlr_sgs_fsm.h"
+
+#define SGSN_SUBSCR_MAX_RETRIES 3
+#define SGSN_SUBSCR_RETRY_INTERVAL 10
+
+enum vlr_stat_item_idx {
+ VLR_STAT_SUBSCRIBER_COUNT,
+ VLR_STAT_PDP_COUNT,
+};
+
+static const struct osmo_stat_item_desc vlr_stat_item_desc[] = {
+ [VLR_STAT_SUBSCRIBER_COUNT] = { "subscribers",
+ "Number of subscribers present in VLR" },
+ [VLR_STAT_PDP_COUNT] = { "pdp",
+ "Number of PDP records present in VLR" },
+};
+
+static const struct osmo_stat_item_group_desc vlr_statg_desc = {
+ "vlr",
+ "visitor location register",
+ OSMO_STATS_CLASS_GLOBAL,
+ ARRAY_SIZE(vlr_stat_item_desc),
+ vlr_stat_item_desc,
+};
+
+enum vlr_rate_ctr_idx {
+ VLR_CTR_GSUP_RX_UNKNOWN_IMSI,
+ VLR_CTR_GSUP_RX_PURGE_NO_SUBSCR,
+ VLR_CTR_GSUP_RX_TUPLES,
+ VLR_CTR_GSUP_RX_UL_RES,
+ VLR_CTR_GSUP_RX_UL_ERR,
+ VLR_CTR_GSUP_RX_SAI_RES,
+ VLR_CTR_GSUP_RX_SAI_ERR,
+ VLR_CTR_GSUP_RX_ISD_REQ,
+ VLR_CTR_GSUP_RX_CANCEL_REQ,
+ VLR_CTR_GSUP_RX_CHECK_IMEI_RES,
+ VLR_CTR_GSUP_RX_CHECK_IMEI_ERR,
+ VLR_CTR_GSUP_RX_PURGE_MS_RES,
+ VLR_CTR_GSUP_RX_PURGE_MS_ERR,
+ VLR_CTR_GSUP_RX_DELETE_DATA_REQ,
+ VLR_CTR_GSUP_RX_UNKNOWN,
+
+ VLR_CTR_GSUP_TX_UL_REQ,
+ VLR_CTR_GSUP_TX_ISD_RES,
+ VLR_CTR_GSUP_TX_SAI_REQ,
+ VLR_CTR_GSUP_TX_PURGE_MS_REQ,
+ VLR_CTR_GSUP_TX_CHECK_IMEI_REQ,
+ VLR_CTR_GSUP_TX_AUTH_FAIL_REP,
+ VLR_CTR_GSUP_TX_CANCEL_RES,
+
+ VLR_CTR_DETACH_BY_REQ,
+ VLR_CTR_DETACH_BY_CANCEL,
+ VLR_CTR_DETACH_BY_T3212,
+};
+
+static const struct rate_ctr_desc vlr_ctr_desc[] = {
+ [VLR_CTR_GSUP_RX_UNKNOWN_IMSI] = { "gsup:rx:unknown_imsi",
+ "Received GSUP messages for unknown IMSI" },
+ [VLR_CTR_GSUP_RX_PURGE_NO_SUBSCR] = { "gsup:rx:purge_no_subscr",
+ "Received GSUP purge for unknown subscriber" },
+ [VLR_CTR_GSUP_RX_TUPLES] = { "gsup:rx:auth_tuples",
+ "Received GSUP authentication tuples" },
+ [VLR_CTR_GSUP_RX_UL_RES] = { "gsup:rx:upd_loc:res",
+ "Received GSUP Update Location Result messages" },
+ [VLR_CTR_GSUP_RX_UL_ERR] = { "gsup:rx:upd_loc:err",
+ "Received GSUP Update Location Error messages" },
+ [VLR_CTR_GSUP_RX_SAI_RES] = { "gsup:rx:send_auth_info:res",
+ "Received GSUP Send Auth Info Result messages" },
+ [VLR_CTR_GSUP_RX_SAI_ERR] = { "gsup:rx:send_auth_info:err",
+ "Received GSUP Send Auth Info Error messages" },
+ [VLR_CTR_GSUP_RX_ISD_REQ] = { "gsup:rx:ins_sub_data:req",
+ "Received GSUP Insert Subscriber Data Request messages" },
+ [VLR_CTR_GSUP_RX_CANCEL_REQ] = { "gsup:rx:cancel:req",
+ "Received GSUP Cancel Subscriber messages" },
+ [VLR_CTR_GSUP_RX_CHECK_IMEI_RES] = { "gsup:rx:check_imei:res",
+ "Received GSUP Check IMEI Result messages" },
+ [VLR_CTR_GSUP_RX_CHECK_IMEI_ERR] = { "gsup:rx:check_imei:err",
+ "Received GSUP Check IMEI Error messages" },
+ [VLR_CTR_GSUP_RX_PURGE_MS_RES] = { "gsup:rx:purge_ms:res",
+ "Received GSUP Purge MS Result messages" },
+ [VLR_CTR_GSUP_RX_PURGE_MS_ERR] = { "gsup:rx:purge_ms:err",
+ "Received GSUP Purge MS Error messages" },
+ [VLR_CTR_GSUP_RX_DELETE_DATA_REQ] = { "gsup:rx:del_sub_data:req",
+ "Received GSUP Delete Subscriber Data Request messages" },
+ [VLR_CTR_GSUP_RX_UNKNOWN] = { "gsup:rx:unknown_msgtype",
+ "Received GSUP message of unknown type" },
+
+ [VLR_CTR_GSUP_TX_UL_REQ] = { "gsup:tx:upd_loc:req",
+ "Transmitted GSUP Update Location Request messages" },
+ [VLR_CTR_GSUP_TX_ISD_RES] = { "gsup:tx:ins_sub_data:res",
+ "Transmitted GSUP Insert Subscriber Data Result messages" },
+ [VLR_CTR_GSUP_TX_SAI_REQ] = { "gsup:tx:send_auth_info:res",
+ "Transmitted GSUP Send Auth Info Request messages" },
+ [VLR_CTR_GSUP_TX_PURGE_MS_REQ] = { "gsup:tx:purge_ms:req",
+ "Transmitted GSUP Purge MS Request messages" },
+ [VLR_CTR_GSUP_TX_CHECK_IMEI_REQ] = { "gsup:tx:check_imei:req",
+ "Transmitted GSUP Check IMEI Request messages" },
+ [VLR_CTR_GSUP_TX_AUTH_FAIL_REP] = { "gsup:tx:auth_fail:rep",
+ "Transmitted GSUP Auth Fail Report messages" },
+ [VLR_CTR_GSUP_TX_CANCEL_RES] = { "gsup:tx:cancel:res",
+ "Transmitted GSUP Cancel Result messages" },
+
+ [VLR_CTR_DETACH_BY_REQ] = { "detach:imsi_det_req",
+ "VLR Subscriber Detach by IMSI DETACH REQ" },
+ [VLR_CTR_DETACH_BY_CANCEL] = { "detach:gsup_cancel_req",
+ "VLR Subscriber Detach by GSUP CANCEL REQ" },
+ [VLR_CTR_DETACH_BY_T3212] = { "detach:t3212_timeout",
+ "VLR Subscriber Detach by T3212 timeout" },
+};
+
+static const struct rate_ctr_group_desc vlr_ctrg_desc = {
+ "vlr",
+ "visitor location register",
+ OSMO_STATS_CLASS_GLOBAL,
+ ARRAY_SIZE(vlr_ctr_desc),
+ vlr_ctr_desc,
+};
+
+
+#define vlr_rate_ctr_inc(vlr, idx) \
+ rate_ctr_inc(rate_ctr_group_get_ctr((vlr)->ctrg, idx))
+#define vlr_rate_ctr_add(vlr, idx, val) \
+ rate_ctr_add(rate_ctr_group_get_ctr((vlr)->ctrg, idx), val)
+
+#define vlr_stat_item_inc(vlr, idx) \
+ osmo_stat_item_inc(osmo_stat_item_group_get_item((vlr)->statg, idx), 1)
+#define vlr_stat_item_dec(vlr, idx) \
+ osmo_stat_item_dec(osmo_stat_item_group_get_item((vlr)->statg, idx), 1)
+#define vlr_stat_item_set(vlr, idx, val) \
+ osmo_stat_item_set(osmo_stat_item_group_get_item((vlr)->statg, idx), val)
+
+/***********************************************************************
+ * Convenience functions
+ ***********************************************************************/
+
+static int vlr_subscr_detach(struct vlr_subscr *vsub);
+
+const struct value_string vlr_ciph_names[] = {
+ OSMO_VALUE_STRING(VLR_CIPH_NONE),
+ OSMO_VALUE_STRING(VLR_CIPH_A5_1),
+ OSMO_VALUE_STRING(VLR_CIPH_A5_2),
+ OSMO_VALUE_STRING(VLR_CIPH_A5_3),
+ { 0, NULL }
+};
+
+/* 3GPP TS 24.008, table 11.2 Mobility management timers (network-side) */
+struct osmo_tdef msc_tdefs_vlr[] = {
+ { .T = 3212, .default_val = 60, .unit = OSMO_TDEF_M, .desc = "Subscriber expiration timeout" },
+ { .T = 3250, .default_val = 12, .desc = "TMSI Reallocation procedure" },
+ { .T = 3260, .default_val = 12, .desc = "Authentication procedure" },
+ { .T = 3270, .default_val = 12, .desc = "Identification procedure" },
+ { /* terminator */ }
+};
+
+/* 3GPP TS 24.008, table 11.2 Mobility management timers (network-side) */
+struct osmo_tdef sgsn_tdefs_vlr[] = {
+ { .T = 3312, .default_val = 60, .unit = OSMO_TDEF_M, .desc = "Subscriber expiration timeout" },
+ { .T = 3350, .default_val = 6, .desc = "Attach/RAU Complete Reallocation procedure" },
+ { .T = 3360, .default_val = 6, .desc = "Authentication procedure" },
+ { .T = 3370, .default_val = 6, .desc = "Identification procedure" },
+ { /* terminator */ }
+};
+
+struct osmo_tdef *vlr_tdefs;
+
+/* This is just a wrapper around the osmo_tdef API.
+ * TODO: we should start using osmo_tdef_fsm_inst_state_chg() */
+unsigned long vlr_timer_secs(struct vlr_instance *vlr, int cs_timer, int ps_timer)
+{
+ /* NOTE: since we usually do not need more than one instance of the VLR,
+ * and since libosmocore's osmo_tdef API does not (yet) support dynamic
+ * configuration, we always use the global instance of msc_tdefs_vlr. */
+ if (vlr_is_cs(vlr))
+ return osmo_tdef_get(vlr_tdefs, cs_timer, OSMO_TDEF_S, 0);
+ else
+ return osmo_tdef_get(vlr_tdefs, ps_timer, OSMO_TDEF_S, 0);
+}
+
+/* return static buffer with printable name of VLR subscriber */
+const char *vlr_subscr_name(const struct vlr_subscr *vsub)
+{
+ static char buf[128];
+ struct osmo_strbuf sb = { .buf = buf, .len = sizeof(buf) };
+ bool present = false;
+ if (!vsub)
+ return "unknown";
+ if (vsub->imsi[0]) {
+ OSMO_STRBUF_PRINTF(sb, "IMSI-%s", vsub->imsi);
+ present = true;
+ }
+ if (vsub->msisdn[0]) {
+ OSMO_STRBUF_PRINTF(sb, "%sMSISDN-%s", present? ":" : "", vsub->msisdn);
+ present = true;
+ }
+ if (vsub->tmsi != GSM_RESERVED_TMSI) {
+ OSMO_STRBUF_PRINTF(sb, "%sTMSI-0x%08X", present? ":" : "", vsub->tmsi);
+ present = true;
+ }
+ if (vsub->tmsi_new != GSM_RESERVED_TMSI) {
+ OSMO_STRBUF_PRINTF(sb, "%sTMSInew-0x%08X", present? ":" : "", vsub->tmsi_new);
+ present = true;
+ }
+ if (!present)
+ return "unknown";
+
+ return buf;
+}
+
+const char *vlr_subscr_short_name(const struct vlr_subscr *vsub, unsigned int maxlen)
+{
+ /* cast away the const so we can shorten the string within the static buffer */
+ char *name = (char*)vlr_subscr_name(vsub);
+ size_t len = strlen(name);
+ if (maxlen < 2)
+ return "-";
+ if (len > maxlen)
+ strcpy(name + maxlen - 2, "..");
+ return name;
+}
+
+const char *vlr_subscr_msisdn_or_name(const struct vlr_subscr *vsub)
+{
+ if (!vsub || !vsub->msisdn[0])
+ return vlr_subscr_name(vsub);
+ return vsub->msisdn;
+}
+
+struct vlr_subscr *_vlr_subscr_find_by_imsi(struct vlr_instance *vlr,
+ const char *imsi,
+ const char *use,
+ const char *file, int line)
+{
+ struct vlr_subscr *vsub;
+
+ if (!imsi || !*imsi)
+ return NULL;
+
+ llist_for_each_entry(vsub, &vlr->subscribers, list) {
+ if (vlr_subscr_matches_imsi(vsub, imsi)) {
+ if (use)
+ vlr_subscr_get_src(vsub, use, file, line);
+ return vsub;
+ }
+ }
+ return NULL;
+}
+
+struct vlr_subscr *_vlr_subscr_find_by_tmsi(struct vlr_instance *vlr,
+ uint32_t tmsi,
+ const char *use,
+ const char *file, int line)
+{
+ struct vlr_subscr *vsub;
+
+ if (tmsi == GSM_RESERVED_TMSI)
+ return NULL;
+
+ llist_for_each_entry(vsub, &vlr->subscribers, list) {
+ if (vlr_subscr_matches_tmsi(vsub, tmsi)) {
+ vlr_subscr_get_src(vsub, use, file, line);
+ return vsub;
+ }
+ }
+ return NULL;
+}
+
+struct vlr_subscr *_vlr_subscr_find_by_msisdn(struct vlr_instance *vlr,
+ const char *msisdn,
+ const char *use,
+ const char *file, int line)
+{
+ struct vlr_subscr *vsub;
+
+ if (!msisdn || !*msisdn)
+ return NULL;
+
+ llist_for_each_entry(vsub, &vlr->subscribers, list) {
+ if (vlr_subscr_matches_msisdn(vsub, msisdn)) {
+ vlr_subscr_get_src(vsub, use, file, line);
+ return vsub;
+ }
+ }
+ return NULL;
+}
+
+struct vlr_subscr *_vlr_subscr_find_by_mi(struct vlr_instance *vlr,
+ const struct osmo_mobile_identity *mi,
+ const char *use,
+ const char *file, int line)
+{
+ switch (mi->type) {
+ case GSM_MI_TYPE_IMSI:
+ return _vlr_subscr_find_by_imsi(vlr, mi->imsi, use, file, line);
+ case GSM_MI_TYPE_TMSI:
+ return _vlr_subscr_find_by_tmsi(vlr, mi->tmsi, use, file, line);
+ default:
+ return NULL;
+ }
+}
+
+/* Transmit GSUP message for subscriber to HLR, using IMSI from subscriber */
+static int vlr_subscr_tx_gsup_message(const struct vlr_subscr *vsub,
+ struct osmo_gsup_message *gsup_msg)
+{
+ struct vlr_instance *vlr = vsub->vlr;
+
+ if (strlen(gsup_msg->imsi) == 0)
+ OSMO_STRLCPY_ARRAY(gsup_msg->imsi, vsub->imsi);
+
+ gsup_msg->message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT;
+
+ return gsup_client_mux_tx(vlr->gcm, gsup_msg);
+}
+
+static int vlr_subscr_use_cb(struct osmo_use_count_entry *e, int32_t old_use_count, const char *file, int line)
+{
+ struct vlr_subscr *vsub = e->use_count->talloc_object;
+ char buf[128];
+ int32_t total;
+ int level;
+
+ if (!e->use)
+ return -EINVAL;
+
+ total = osmo_use_count_total(&vsub->use_count);
+
+ if (total == 0
+ || (total == 1 && old_use_count == 0 && e->count == 1))
+ level = LOGL_INFO;
+ else
+ level = LOGL_DEBUG;
+
+ LOGPSRC(g_vlr_log_cat[OSMO_VLR_LOGC_VLR], level, file, line, "VLR subscr %s %s %s: now used by %s\n",
+ vlr_subscr_name(vsub), (e->count - old_use_count) > 0? "+" : "-", e->use,
+ osmo_use_count_name_buf(buf, sizeof(buf), e->use_count));
+
+ if (e->count < 0)
+ return -ERANGE;
+
+ vsub->max_total_use_count = OSMO_MAX(vsub->max_total_use_count, total);
+
+ if (total <= 0)
+ vlr_subscr_free(vsub);
+ return 0;
+}
+
+/* Allocate a new subscriber and insert it into list */
+static struct vlr_subscr *_vlr_subscr_alloc(struct vlr_instance *vlr)
+{
+ struct vlr_subscr *vsub;
+ int i;
+
+ vsub = talloc_zero(vlr, struct vlr_subscr);
+ *vsub = (struct vlr_subscr){
+ .vlr = vlr,
+ .tmsi = GSM_RESERVED_TMSI,
+ .tmsi_new = GSM_RESERVED_TMSI,
+ .use_count = (struct osmo_use_count){
+ .talloc_object = vsub,
+ .use_cb = vlr_subscr_use_cb,
+ },
+ .expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION,
+ };
+ osmo_use_count_make_static_entries(&vsub->use_count, vsub->use_count_buf, ARRAY_SIZE(vsub->use_count_buf));
+
+ for (i = 0; i < ARRAY_SIZE(vsub->auth_tuples); i++)
+ vsub->auth_tuples[i].key_seq = VLR_KEY_SEQ_INVAL;
+
+ INIT_LLIST_HEAD(&vsub->cs.requests);
+ INIT_LLIST_HEAD(&vsub->ps.pdp_list);
+
+ /* Create an SGs FSM, which is needed to control CSFB,
+ * in cases where CSFB/SGs is not in use, this FSM will
+ * just do nothing. (see also: sgs_iface.c) */
+ vlr_sgs_fsm_create(vsub);
+
+ llist_add_tail(&vsub->list, &vlr->subscribers);
+ vlr_stat_item_inc(vlr, VLR_STAT_SUBSCRIBER_COUNT);
+ return vsub;
+}
+
+/* Send a GSUP Purge MS request.
+ * TODO: this should be sent to the *previous* VLR when this VLR is "taking"
+ * this subscriber, not to the HLR? */
+int vlr_subscr_purge(struct vlr_subscr *vsub)
+{
+ struct osmo_gsup_message gsup_msg = {0};
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_PURGE_MS_REQ);
+
+ gsup_msg.message_type = OSMO_GSUP_MSGT_PURGE_MS_REQUEST;
+
+ /* provide HLR number in case we know it */
+ if (vsub->hlr.len) {
+ gsup_msg.hlr_enc_len = vsub->hlr.len;
+ gsup_msg.hlr_enc = vsub->hlr.buf;
+ }
+
+ gsup_msg.cn_domain = vlr_is_cs(vsub->vlr) ? OSMO_GSUP_CN_DOMAIN_CS : OSMO_GSUP_CN_DOMAIN_PS;
+
+ return vlr_subscr_tx_gsup_message(vsub, &gsup_msg);
+}
+
+void vlr_subscr_cancel_attach_fsm(struct vlr_subscr *vsub,
+ enum osmo_fsm_term_cause fsm_cause,
+ enum gsm48_reject_value gsm48_cause)
+{
+ if (!vsub)
+ return;
+
+ vlr_subscr_get(vsub, __func__);
+ if (vsub->lu_fsm)
+ vlr_loc_update_cancel(vsub->lu_fsm, fsm_cause, gsm48_cause);
+ if (vsub->proc_arq_fsm)
+ vlr_parq_cancel(vsub->proc_arq_fsm, fsm_cause, gsm48_cause);
+ vlr_subscr_put(vsub, __func__);
+}
+
+/* Call vlr_subscr_cancel(), then completely drop the entry from the VLR */
+void vlr_subscr_free(struct vlr_subscr *vsub)
+{
+ llist_del(&vsub->list);
+ vlr_stat_item_dec(vsub->vlr, VLR_STAT_SUBSCRIBER_COUNT);
+ LOGVSUBP(LOGL_DEBUG, vsub, "freeing VLR subscr (max total use count was %d)\n",
+ vsub->max_total_use_count);
+
+ /* Make sure SGs timer Ts5 is removed */
+ osmo_timer_del(&vsub->sgs.Ts5);
+
+ /* Remove SGs FSM (see also: sgs_iface.c) */
+ vlr_sgs_fsm_remove(vsub);
+
+ talloc_free(vsub);
+}
+
+/* Generate a new TMSI and store in vsub->tmsi_new.
+ * Search all known subscribers to ensure that the TMSI is unique. */
+int vlr_subscr_alloc_tmsi(struct vlr_subscr *vsub)
+{
+ struct vlr_instance *vlr = vsub->vlr;
+ uint32_t tmsi;
+ int tried, rc;
+ struct vlr_subscr *other_vsub;
+
+ for (tried = 0; tried < 100; tried++) {
+ rc = osmo_get_rand_id((uint8_t *) &tmsi, sizeof(tmsi));
+ if (rc < 0) {
+ LOGVLR(LOGL_ERROR, "osmo_get_rand_id() failed: %s\n", strerror(-rc));
+ return rc;
+ }
+
+ if (!llist_empty(&vlr->cfg.nri_ranges->entries)) {
+ int16_t nri_v;
+ osmo_tmsi_nri_v_limit_by_ranges(&tmsi, vlr->cfg.nri_ranges, vlr->cfg.nri_bitlen);
+ osmo_tmsi_nri_v_get(&nri_v, tmsi, vlr->cfg.nri_bitlen);
+ LOGVLR(LOGL_DEBUG, "New NRI from range [%s] = 0x%x --> TMSI 0x%08x\n",
+ osmo_nri_ranges_to_str_c(OTC_SELECT, vlr->cfg.nri_ranges), nri_v, tmsi);
+ }
+
+ /* throw the dice again, if the TSMI doesn't fit */
+ if (tmsi == GSM_RESERVED_TMSI)
+ continue;
+
+ /* Section 2.4 of 23.003: MSC has two MSB 00/01/10, SGSN 11 */
+ if (vlr->cfg.is_ps) {
+ /* SGSN */
+ tmsi |= GSM23003_TMSI_SGSN_MASK;
+ } else {
+ /* MSC */
+ if ((tmsi & GSM23003_TMSI_SGSN_MASK) == GSM23003_TMSI_SGSN_MASK)
+ tmsi &= ~GSM23003_TMSI_SGSN_MASK;
+ }
+
+ /* If this TMSI is already in use, try another one. */
+ if ((other_vsub = vlr_subscr_find_by_tmsi(vlr, tmsi, __func__))) {
+ vlr_subscr_put(other_vsub, __func__);
+ continue;
+ }
+
+ vsub->tmsi_new = tmsi;
+ vsub->vlr->ops.subscr_update(vsub);
+ return 0;
+ }
+
+ LOGVSUBP(LOGL_ERROR, vsub, "Unable to generate valid TMSI"
+ " after %d tries\n", tried);
+ return -1;
+}
+
+/* Find subscriber by IMSI, or create new subscriber if not found.
+ * \param[in] vlr VLR instance.
+ * \param[in] imsi IMSI string.
+ * \param[out] created if non-NULL, returns whether a new entry was created. */
+struct vlr_subscr *_vlr_subscr_find_or_create_by_imsi(struct vlr_instance *vlr,
+ const char *imsi,
+ const char *use,
+ bool *created,
+ const char *file,
+ int line)
+{
+ struct vlr_subscr *vsub;
+ vsub = _vlr_subscr_find_by_imsi(vlr, imsi, use, file, line);
+ if (vsub) {
+ if (created)
+ *created = false;
+ return vsub;
+ }
+
+ vsub = _vlr_subscr_alloc(vlr);
+ if (!vsub)
+ return NULL;
+ vlr_subscr_get_src(vsub, use, file, line);
+ vlr_subscr_set_imsi(vsub, imsi);
+ LOGVLR(LOGL_INFO, "New subscr, IMSI: %s\n", vsub->imsi);
+ if (created)
+ *created = true;
+ return vsub;
+}
+
+/* Find subscriber by TMSI, or create new subscriber if not found.
+ * \param[in] vlr VLR instance.
+ * \param[in] tmsi TMSI.
+ * \param[out] created if non-NULL, returns whether a new entry was created. */
+struct vlr_subscr *_vlr_subscr_find_or_create_by_tmsi(struct vlr_instance *vlr,
+ uint32_t tmsi,
+ const char *use,
+ bool *created,
+ const char *file,
+ int line)
+{
+ struct vlr_subscr *vsub;
+ vsub = _vlr_subscr_find_by_tmsi(vlr, tmsi, use, file, line);
+ if (vsub) {
+ if (created)
+ *created = false;
+ return vsub;
+ }
+
+ vsub = _vlr_subscr_alloc(vlr);
+ if (!vsub)
+ return NULL;
+ vlr_subscr_get_src(vsub, use, file, line);
+ vsub->tmsi = tmsi;
+ LOGVLR(LOGL_INFO, "New subscr, TMSI: 0x%08x\n", vsub->tmsi);
+ if (created)
+ *created = true;
+ return vsub;
+}
+
+static void dedup_vsub(struct vlr_subscr *exists, struct vlr_subscr *vsub)
+{
+ struct vlr_instance *vlr = exists->vlr;
+ int i;
+ int j;
+ LOGVSUBP(LOGL_NOTICE, vsub,
+ "There is an existing subscriber for IMSI %s used by %s, replacing with this VLR subscr, used by %s\n",
+ exists->imsi, osmo_use_count_to_str_c(OTC_SELECT, &exists->use_count),
+ osmo_use_count_to_str_c(OTC_SELECT, &vsub->use_count));
+
+ if (!vsub->msisdn[0])
+ OSMO_STRLCPY_ARRAY(vsub->msisdn, exists->msisdn);
+ if (!vsub->name[0])
+ OSMO_STRLCPY_ARRAY(vsub->name, exists->name);
+ /* Copy valid auth tuples we may already have, to reduce the need to ask for new ones from the HLR */
+ for (i = 0; i < ARRAY_SIZE(exists->auth_tuples); i++) {
+ if (exists->auth_tuples[i].key_seq == VLR_KEY_SEQ_INVAL)
+ continue;
+ for (j = 0; j < ARRAY_SIZE(vsub->auth_tuples); j++) {
+ if (vsub->auth_tuples[j].key_seq != VLR_KEY_SEQ_INVAL)
+ continue;
+ vsub->auth_tuples[j] = exists->auth_tuples[i];
+ }
+ }
+
+ if (exists->msc_conn_ref)
+ LOGVSUBP(LOGL_ERROR, vsub,
+ "There is an existing VLR entry for this same subscriber with an active connection."
+ " That should not be possible. Discarding old subscriber entry %s.\n",
+ exists->imsi);
+
+ if (vlr->ops.subscr_inval)
+ vlr->ops.subscr_inval(exists->msc_conn_ref, exists, 0, true);
+ vlr_subscr_free(exists);
+}
+
+void vlr_subscr_set_imsi(struct vlr_subscr *vsub, const char *imsi)
+{
+ struct vlr_subscr *exists;
+ if (!vsub)
+ return;
+
+ /* If the same IMSI is already set, nothing changes. */
+ if (!strcmp(vsub->imsi, imsi))
+ return;
+
+ /* We've just learned about this new IMSI, our primary key in the VLR. make sure to invalidate any prior VLR
+ * entries for this IMSI. */
+ exists = vlr_subscr_find_by_imsi(vsub->vlr, imsi, NULL);
+
+ if (exists)
+ dedup_vsub(exists, vsub);
+
+ /* Set the IMSI on the new subscriber, here. */
+ if (OSMO_STRLCPY_ARRAY(vsub->imsi, imsi) >= sizeof(vsub->imsi)) {
+ LOGVLR(LOGL_NOTICE, "IMSI was truncated: full IMSI=%s, truncated IMSI=%s\n",
+ imsi, vsub->imsi);
+ /* XXX Set truncated IMSI anyway, we currently cannot return an error from here. */
+ }
+
+ vsub->id = atoll(vsub->imsi);
+ LOGVLR(LOGL_DEBUG, "set IMSI on subscriber; IMSI=%s id=%llu\n",
+ vsub->imsi, vsub->id);
+}
+
+void vlr_subscr_set_imei(struct vlr_subscr *vsub, const char *imei)
+{
+ if (!vsub)
+ return;
+ OSMO_STRLCPY_ARRAY(vsub->imei, imei);
+ LOGVLR(LOGL_DEBUG, "set IMEI on subscriber; IMSI=%s IMEI=%s\n",
+ vsub->imsi, vsub->imei);
+}
+
+void vlr_subscr_set_imeisv(struct vlr_subscr *vsub, const char *imeisv)
+{
+ if (!vsub)
+ return;
+ OSMO_STRLCPY_ARRAY(vsub->imeisv, imeisv);
+ LOGVLR(LOGL_DEBUG, "set IMEISV on subscriber; IMSI=%s IMEISV=%s\n",
+ vsub->imsi, vsub->imeisv);
+
+ /* Copy IMEISV to IMEI (additional SV digits get cut off) */
+ vlr_subscr_set_imei(vsub, imeisv);
+}
+
+/* Safely copy the given MSISDN string to vsub->msisdn */
+void vlr_subscr_set_msisdn(struct vlr_subscr *vsub, const char *msisdn)
+{
+ if (!vsub)
+ return;
+ OSMO_STRLCPY_ARRAY(vsub->msisdn, msisdn);
+ LOGVLR(LOGL_DEBUG, "set MSISDN on subscriber; IMSI=%s MSISDN=%s\n",
+ vsub->imsi, vsub->msisdn);
+}
+
+void vlr_subscr_set_last_used_eutran_plmn_id(struct vlr_subscr *vsub,
+ const struct osmo_plmn_id *last_eutran_plmn)
+{
+ if (!vsub)
+ return;
+ if (last_eutran_plmn) {
+ vsub->sgs.last_eutran_plmn_present = true;
+ memcpy(&vsub->sgs.last_eutran_plmn, last_eutran_plmn, sizeof(*last_eutran_plmn));
+ } else {
+ vsub->sgs.last_eutran_plmn_present = false;
+ }
+ LOGVLR(LOGL_DEBUG, "set Last E-UTRAN PLMN ID on subscriber: %s\n",
+ vsub->sgs.last_eutran_plmn_present ?
+ osmo_plmn_name(&vsub->sgs.last_eutran_plmn) :
+ "(none)");
+}
+
+bool vlr_subscr_matches_imsi(struct vlr_subscr *vsub, const char *imsi)
+{
+ return vsub && imsi && vsub->imsi[0] && !strcmp(vsub->imsi, imsi);
+}
+
+bool vlr_subscr_matches_tmsi(struct vlr_subscr *vsub, uint32_t tmsi)
+{
+ return vsub && tmsi != GSM_RESERVED_TMSI
+ && (vsub->tmsi == tmsi || vsub->tmsi_new == tmsi);
+}
+
+bool vlr_subscr_matches_msisdn(struct vlr_subscr *vsub, const char *msisdn)
+{
+ return vsub && msisdn && vsub->msisdn[0]
+ && !strcmp(vsub->msisdn, msisdn);
+}
+
+bool vlr_subscr_matches_imei(struct vlr_subscr *vsub, const char *imei)
+{
+ return vsub && imei && vsub->imei[0]
+ && !strcmp(vsub->imei, imei);
+}
+
+/* Send updated subscriber information to HLR */
+int vlr_subscr_changed(struct vlr_subscr *vsub)
+{
+ /* FIXME */
+ LOGVLR(LOGL_ERROR, "Not implemented: %s\n", __func__);
+ return 0;
+}
+
+void vlr_subscr_enable_expire_lu(struct vlr_subscr *vsub)
+{
+ struct timespec now;
+
+ /* Mark the subscriber as inactive if it stopped to do periodical location updates. */
+ if (osmo_clock_gettime(CLOCK_MONOTONIC, &now) == 0) {
+ vsub->expire_lu = now.tv_sec + vlr_timer_secs(vsub->vlr, 3212, 3312);
+ } else {
+ LOGVSUBP(LOGL_ERROR, vsub,
+ "Could not enable Location Update expiry: unable to read current time\n");
+ /* Disable LU expiry for this subscriber. This subscriber will only be freed after an explicit IMSI detach. */
+ vsub->expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION;
+ }
+}
+
+void vlr_subscr_expire_lu(void *data)
+{
+ struct vlr_instance *vlr = data;
+ struct vlr_subscr *vsub, *vsub_tmp;
+ struct timespec now;
+
+ /* Periodic location update might be disabled from the VTY,
+ * so we shall not expire subscribers until explicit IMSI Detach. */
+ if (!vlr_timer_secs(vlr, 3212, 3312))
+ goto done;
+
+ if (llist_empty(&vlr->subscribers))
+ goto done;
+
+ if (osmo_clock_gettime(CLOCK_MONOTONIC, &now) != 0) {
+ LOGVLR(LOGL_ERROR, "Skipping Location Update expiry: Could not read current time\n");
+ goto done;
+ }
+
+ llist_for_each_entry_safe(vsub, vsub_tmp, &vlr->subscribers, list) {
+ if (vsub->expire_lu == VLR_SUBSCRIBER_NO_EXPIRATION || vsub->expire_lu > now.tv_sec)
+ continue;
+
+ LOGVLR(LOGL_DEBUG, "%s: Location Update expired\n", vlr_subscr_name(vsub));
+ vlr_rate_ctr_inc(vlr, VLR_CTR_DETACH_BY_T3212);
+ vlr_subscr_detach(vsub);
+ }
+
+done:
+ osmo_timer_schedule(&vlr->lu_expire_timer, VLR_SUBSCRIBER_LU_EXPIRATION_INTERVAL, 0);
+}
+
+/***********************************************************************
+ * PDP context data
+ ***********************************************************************/
+
+#define GSM_APN_LENGTH 102
+
+/* see GSM 09.02, 17.7.1, PDP-Context and GPRSSubscriptionData */
+/* see GSM 09.02, B.1, gprsSubscriptionData */
+struct sgsn_subscriber_pdp_data {
+ struct llist_head list;
+
+ unsigned int context_id;
+ enum gsm48_pdp_type_org pdp_type_org;
+ enum gsm48_pdp_type_nr pdp_type_nr;
+ struct osmo_sockaddr pdp_address[2];
+ char apn_str[GSM_APN_LENGTH];
+ uint8_t qos_subscribed[20];
+ size_t qos_subscribed_len;
+};
+
+struct sgsn_subscriber_pdp_data *
+vlr_subscr_pdp_data_alloc(struct vlr_subscr *vsub)
+{
+ struct sgsn_subscriber_pdp_data* pdata;
+
+ pdata = talloc_zero(vsub, struct sgsn_subscriber_pdp_data);
+
+ llist_add_tail(&pdata->list, &vsub->ps.pdp_list);
+ vlr_stat_item_inc(vsub->vlr, VLR_STAT_PDP_COUNT);
+
+ return pdata;
+}
+
+static int vlr_subscr_pdp_data_clear(struct vlr_subscr *vsub)
+{
+ struct sgsn_subscriber_pdp_data *pdp, *pdp2;
+ int count = 0;
+
+ llist_for_each_entry_safe(pdp, pdp2, &vsub->ps.pdp_list, list) {
+ llist_del(&pdp->list);
+ vlr_stat_item_dec(vsub->vlr, VLR_STAT_PDP_COUNT);
+ talloc_free(pdp);
+ count += 1;
+ }
+
+ return count;
+}
+
+static struct sgsn_subscriber_pdp_data *
+vlr_subscr_pdp_data_get_by_id(struct vlr_subscr *vsub, unsigned context_id)
+{
+ struct sgsn_subscriber_pdp_data *pdp;
+
+ llist_for_each_entry(pdp, &vsub->ps.pdp_list, list) {
+ if (pdp->context_id == context_id)
+ return pdp;
+ }
+
+ return NULL;
+}
+
+/***********************************************************************
+ * Actual Implementation
+ ***********************************************************************/
+
+static int vlr_rx_gsup_unknown_imsi(struct vlr_instance *vlr,
+ const struct osmo_gsup_message *gsup_msg)
+{
+ if (OSMO_GSUP_IS_MSGT_REQUEST(gsup_msg->message_type)) {
+ LOGVLR(LOGL_NOTICE,
+ "Unknown IMSI %s, discarding GSUP request "
+ "of type 0x%02x\n",
+ gsup_msg->imsi, gsup_msg->message_type);
+ gsup_client_mux_tx_error_reply(vlr->gcm, gsup_msg, GMM_CAUSE_IMSI_UNKNOWN);
+ } else if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
+ LOGVLR(LOGL_NOTICE,
+ "Unknown IMSI %s, discarding GSUP error "
+ "of type 0x%02x, cause '%s' (%d)\n",
+ gsup_msg->imsi, gsup_msg->message_type,
+ get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
+ gsup_msg->cause);
+ } else {
+ LOGVLR(LOGL_NOTICE,
+ "Unknown IMSI %s, discarding GSUP response "
+ "of type 0x%02x\n",
+ gsup_msg->imsi, gsup_msg->message_type);
+ }
+
+ return -GMM_CAUSE_IMSI_UNKNOWN;
+}
+
+static int vlr_rx_gsup_purge_no_subscr(struct vlr_instance *vlr,
+ const struct osmo_gsup_message *gsup_msg)
+{
+ if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
+ LOGGSUPP(LOGL_NOTICE, gsup_msg,
+ "Purge MS has failed with cause '%s' (%d)\n",
+ get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
+ gsup_msg->cause);
+ return -gsup_msg->cause;
+ }
+ LOGGSUPP(LOGL_INFO, gsup_msg, "Completing purge MS\n");
+ return 0;
+}
+
+/* VLR internal call to request UpdateLocation from HLR */
+int vlr_subscr_req_lu(struct vlr_subscr *vsub)
+{
+ struct osmo_gsup_message gsup_msg = {0};
+ int rc;
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_UL_REQ);
+
+ gsup_msg.message_type = OSMO_GSUP_MSGT_UPDATE_LOCATION_REQUEST;
+ gsup_msg.cn_domain = vlr_is_cs(vsub->vlr) ? OSMO_GSUP_CN_DOMAIN_CS : OSMO_GSUP_CN_DOMAIN_PS;
+ rc = vlr_subscr_tx_gsup_message(vsub, &gsup_msg);
+
+ return rc;
+}
+
+/* VLR internal call to request tuples from HLR */
+int vlr_subscr_req_sai(struct vlr_subscr *vsub,
+ const uint8_t *auts, const uint8_t *auts_rand)
+{
+ struct osmo_gsup_message gsup_msg = {0};
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_SAI_REQ);
+
+ gsup_msg.message_type = OSMO_GSUP_MSGT_SEND_AUTH_INFO_REQUEST;
+ gsup_msg.auts = auts;
+ gsup_msg.rand = auts_rand;
+ gsup_msg.cn_domain = vlr_is_cs(vsub->vlr) ? OSMO_GSUP_CN_DOMAIN_CS : OSMO_GSUP_CN_DOMAIN_PS;
+
+ return vlr_subscr_tx_gsup_message(vsub, &gsup_msg);
+}
+
+/* Initiate Check_IMEI_VLR Procedure (23.018 Chapter 7.1.2.9) */
+int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub)
+{
+ struct osmo_gsup_message gsup_msg = {
+ .message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT,
+ .message_type = OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST,
+ };
+ uint8_t imei_enc[GSM23003_IMEI_NUM_DIGITS+2]; /* +2: IE header */
+ int len;
+
+ /* Encode IMEI */
+ len = gsm48_encode_bcd_number(imei_enc, sizeof(imei_enc), 0, vsub->imei);
+ if (len < 1) {
+ LOGVSUBP(LOGL_ERROR, vsub, "Error: cannot encode IMEI '%s'\n", vsub->imei);
+ return -ENOSPC;
+ }
+ gsup_msg.imei_enc = imei_enc;
+ gsup_msg.imei_enc_len = len;
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_CHECK_IMEI_REQ);
+
+ /* Send CHECK_IMEI_REQUEST */
+ OSMO_STRLCPY_ARRAY(gsup_msg.imsi, vsub->imsi);
+ return gsup_client_mux_tx(vsub->vlr->gcm, &gsup_msg);
+}
+
+/* Tell HLR that authentication failure occurred */
+int vlr_subscr_tx_auth_fail_rep(const struct vlr_subscr *vsub)
+{
+ struct osmo_gsup_message gsup_msg = {
+ .message_class = OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT,
+ .message_type = OSMO_GSUP_MSGT_AUTH_FAIL_REPORT,
+ .cn_domain = vlr_is_cs(vsub->vlr) ? OSMO_GSUP_CN_DOMAIN_CS : OSMO_GSUP_CN_DOMAIN_PS,
+ };
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_AUTH_FAIL_REP);
+
+ OSMO_STRLCPY_ARRAY(gsup_msg.imsi, vsub->imsi);
+ return gsup_client_mux_tx(vsub->vlr->gcm, &gsup_msg);
+}
+
+/* Update the subscriber with GSUP-received auth tuples */
+void vlr_subscr_update_tuples(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup)
+{
+ unsigned int i;
+ unsigned int got_tuples;
+
+ if (gsup->num_auth_vectors) {
+ memset(&vsub->auth_tuples, 0, sizeof(vsub->auth_tuples));
+ for (i = 0; i < ARRAY_SIZE(vsub->auth_tuples); i++)
+ vsub->auth_tuples[i].key_seq = VLR_KEY_SEQ_INVAL;
+ }
+
+ got_tuples = 0;
+ for (i = 0; i < gsup->num_auth_vectors; i++) {
+ size_t key_seq = i;
+
+ if (key_seq >= ARRAY_SIZE(vsub->auth_tuples)) {
+ LOGVSUBP(LOGL_NOTICE, vsub,
+ "Skipping auth tuple with invalid cksn %zu\n",
+ key_seq);
+ continue;
+ }
+ vsub->auth_tuples[i].vec = gsup->auth_vectors[i];
+ vsub->auth_tuples[i].key_seq = key_seq;
+ got_tuples++;
+ }
+
+ LOGVSUBP(LOGL_DEBUG, vsub, "Received %u auth tuples\n", got_tuples);
+ vlr_rate_ctr_add(vsub->vlr, VLR_CTR_GSUP_RX_TUPLES, got_tuples);
+
+ if (!got_tuples) {
+ /* FIXME what now? */
+ // vlr_subscr_cancel(vsub, GMM_CAUSE_GSM_AUTH_UNACCEPT); ?
+ }
+
+ /* New tuples means last_tuple becomes invalid */
+ vsub->last_tuple = NULL;
+}
+
+/* Handle SendAuthInfo Result/Error from HLR */
+static int vlr_subscr_handle_sai_res(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup)
+{
+ struct osmo_fsm_inst *auth_fi = vsub->auth_fsm;
+ void *data = (void *) gsup;
+
+ if (!auth_fi) {
+ LOGVSUBP(LOGL_ERROR, vsub, "Received GSUP %s, but there is no auth_fsm\n",
+ osmo_gsup_message_type_name(gsup->message_type));
+ return -1;
+ }
+
+ switch (gsup->message_type) {
+ case OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT:
+ osmo_fsm_inst_dispatch(auth_fi, VLR_AUTH_E_HLR_SAI_ACK, data);
+ break;
+ case OSMO_GSUP_MSGT_SEND_AUTH_INFO_ERROR:
+ osmo_fsm_inst_dispatch(auth_fi, VLR_AUTH_E_HLR_SAI_NACK, data);
+ break;
+ default:
+ return -1;
+ }
+
+ return 0;
+}
+
+static void vlr_subscr_gsup_insert_data(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup_msg)
+{
+ unsigned idx;
+ int rc;
+
+ if (gsup_msg->msisdn_enc_len) {//FIXME: vlr_subscr_set_msisdn()?
+ gsm48_decode_bcd_number2(vsub->msisdn, sizeof(vsub->msisdn),
+ gsup_msg->msisdn_enc,
+ gsup_msg->msisdn_enc_len, 0);
+ LOGVLR(LOGL_DEBUG, "IMSI:%s has MSISDN:%s\n",
+ vsub->imsi, vsub->msisdn);
+ }
+
+ if (gsup_msg->hlr_enc) {
+ if (gsup_msg->hlr_enc_len > sizeof(vsub->hlr.buf)) {
+ LOGVLR(LOGL_ERROR, "HLR-Number too long (%zu)\n",
+ gsup_msg->hlr_enc_len);
+ vsub->hlr.len = 0;
+ } else {
+ memcpy(vsub->hlr.buf, gsup_msg->hlr_enc,
+ gsup_msg->hlr_enc_len);
+ vsub->hlr.len = gsup_msg->hlr_enc_len;
+ }
+ }
+
+ if (gsup_msg->pdp_info_compl) {
+ rc = vlr_subscr_pdp_data_clear(vsub);
+ if (rc > 0)
+ LOGVLR(LOGL_INFO, "Cleared existing PDP info\n");
+ }
+
+ for (idx = 0; idx < gsup_msg->num_pdp_infos; idx++) {
+ const struct osmo_gsup_pdp_info *pdp_info = &gsup_msg->pdp_infos[idx];
+ size_t ctx_id = pdp_info->context_id;
+ struct sgsn_subscriber_pdp_data *pdp_data;
+
+ if (pdp_info->apn_enc_len >= sizeof(pdp_data->apn_str)-1) {
+ LOGVSUBP(LOGL_ERROR, vsub,
+ "APN too long, context id = %zu, APN = %s\n",
+ ctx_id, osmo_hexdump(pdp_info->apn_enc,
+ pdp_info->apn_enc_len));
+ continue;
+ }
+
+ if (pdp_info->qos_enc_len > sizeof(pdp_data->qos_subscribed)) {
+ LOGVSUBP(LOGL_ERROR, vsub,
+ "QoS info too long (%zu)\n",
+ pdp_info->qos_enc_len);
+ continue;
+ }
+
+ LOGVSUBP(LOGL_INFO, vsub,
+ "Will set PDP info, context id = %zu, APN = %s\n",
+ ctx_id, osmo_hexdump(pdp_info->apn_enc, pdp_info->apn_enc_len));
+
+ /* Set PDP info [ctx_id] */
+ pdp_data = vlr_subscr_pdp_data_get_by_id(vsub, ctx_id);
+ if (!pdp_data) {
+ pdp_data = vlr_subscr_pdp_data_alloc(vsub);
+ pdp_data->context_id = ctx_id;
+ }
+
+ OSMO_ASSERT(pdp_data != NULL);
+ pdp_data->pdp_type_org = pdp_info->pdp_type_org;
+ pdp_data->pdp_type_nr = pdp_info->pdp_type_nr;
+ memcpy(&pdp_data->pdp_address[0], &pdp_info->pdp_address[0], sizeof(pdp_data->pdp_address[0]));
+ memcpy(&pdp_data->pdp_address[1], &pdp_info->pdp_address[1], sizeof(pdp_data->pdp_address[1]));
+ osmo_apn_to_str(pdp_data->apn_str,
+ pdp_info->apn_enc, pdp_info->apn_enc_len);
+ memcpy(pdp_data->qos_subscribed, pdp_info->qos_enc, pdp_info->qos_enc_len);
+ pdp_data->qos_subscribed_len = pdp_info->qos_enc_len;
+ }
+}
+
+
+/* Handle InsertSubscrData Result from HLR */
+static int vlr_subscr_handle_isd_req(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup)
+{
+ struct osmo_gsup_message gsup_reply = {0};
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_GSUP_TX_ISD_RES);
+
+ vlr_subscr_gsup_insert_data(vsub, gsup);
+ vsub->vlr->ops.subscr_update(vsub);
+
+ gsup_reply.message_type = OSMO_GSUP_MSGT_INSERT_DATA_RESULT;
+ return vlr_subscr_tx_gsup_message(vsub, &gsup_reply);
+}
+
+/* Handle UpdateLocation Result from HLR */
+static int vlr_subscr_handle_lu_res(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup)
+{
+ struct sgs_lu_response sgs_lu_response = {0};
+ bool sgs_lu_in_progress = false;
+
+ if (vsub->sgs_fsm->state == SGS_UE_ST_LA_UPD_PRES)
+ sgs_lu_in_progress = true;
+
+ if (!vsub->lu_fsm && !sgs_lu_in_progress) {
+ LOGVSUBP(LOGL_ERROR, vsub, "Rx GSUP LU Result "
+ "without LU in progress\n");
+ return -ENODEV;
+ }
+
+ /* contrary to MAP, we allow piggy-backing subscriber data onto the
+ * UPDATE LOCATION RESULT, and don't mandate the use of a separate
+ * nested INSERT SUBSCRIBER DATA transaction */
+ vlr_subscr_gsup_insert_data(vsub, gsup);
+
+ if (sgs_lu_in_progress) {
+ sgs_lu_response.accepted = true;
+ sgs_lu_response.vsub = vsub;
+ vsub->sgs.response_cb(&sgs_lu_response);
+ } else
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_LU_RES, NULL);
+
+ return 0;
+}
+
+/* Handle UpdateLocation Result from HLR */
+static int vlr_subscr_handle_lu_err(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup)
+{
+ struct sgs_lu_response sgs_lu_response = {0};
+ bool sgs_lu_in_progress = false;
+
+ if (vsub->sgs_fsm->state == SGS_UE_ST_LA_UPD_PRES)
+ sgs_lu_in_progress = true;
+
+ if (!vsub->lu_fsm && !sgs_lu_in_progress) {
+ LOGVSUBP(LOGL_ERROR, vsub, "Rx GSUP LU Error "
+ "without LU in progress\n");
+ return -ENODEV;
+ }
+
+ LOGVSUBP(LOGL_DEBUG, vsub, "UpdateLocation failed; gmm_cause: %s\n",
+ get_value_string(gsm48_gmm_cause_names, gsup->cause));
+
+ if (sgs_lu_in_progress) {
+ sgs_lu_response.accepted = false;
+ sgs_lu_response.vsub = vsub;
+ vsub->sgs.response_cb(&sgs_lu_response);
+ } else
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_LU_RES,
+ (void *)&gsup->cause);
+ return 0;
+}
+
+enum gsm48_reject_value vlr_gmm_cause_to_reject_cause_domain(enum gsm48_gmm_cause gmm_cause, bool is_cs)
+{
+ enum gsm48_reject_value reject_cause = vlr_gmm_cause_to_reject_cause(gmm_cause);
+ if (is_cs)
+ return vlr_reject_causes_cs(reject_cause);
+ else
+ return vlr_reject_causes_ps(reject_cause);
+}
+
+enum gsm48_reject_value vlr_gmm_cause_to_reject_cause(enum gsm48_gmm_cause gmm_cause)
+{
+ switch (gmm_cause) {
+ case GMM_CAUSE_IMSI_UNKNOWN:
+ return GSM48_REJECT_IMSI_UNKNOWN_IN_HLR;
+ case GMM_CAUSE_ILLEGAL_MS:
+ return GSM48_REJECT_ILLEGAL_MS;
+ case GMM_CAUSE_IMEI_NOT_ACCEPTED:
+ return GSM48_REJECT_IMEI_NOT_ACCEPTED;
+ case GMM_CAUSE_ILLEGAL_ME:
+ return GSM48_REJECT_ILLEGAL_ME;
+ case GMM_CAUSE_GPRS_NOTALLOWED:
+ return GSM48_REJECT_GPRS_NOT_ALLOWED;
+ case GMM_CAUSE_GPRS_OTHER_NOTALLOWED:
+ return GSM48_REJECT_SERVICES_NOT_ALLOWED;
+ case GMM_CAUSE_MS_ID_NOT_DERIVED:
+ return GSM48_REJECT_MS_IDENTITY_NOT_DERVIVABLE;
+ case GMM_CAUSE_IMPL_DETACHED:
+ return GSM48_REJECT_IMPLICITLY_DETACHED;
+ case GMM_CAUSE_PLMN_NOTALLOWED:
+ return GSM48_REJECT_PLMN_NOT_ALLOWED;
+ case GMM_CAUSE_LA_NOTALLOWED:
+ return GSM48_REJECT_LOC_NOT_ALLOWED;
+ case GMM_CAUSE_ROAMING_NOTALLOWED:
+ return GSM48_REJECT_ROAMING_NOT_ALLOWED;
+ case GMM_CAUSE_NO_GPRS_PLMN:
+ return GSM48_REJECT_GPRS_NOT_ALLOWED_IN_PLMN;
+ case GMM_CAUSE_MSC_TEMP_NOTREACH:
+ return GSM48_REJECT_MSC_TMP_NOT_REACHABLE;
+ case GMM_CAUSE_SYNC_FAIL:
+ return GSM48_REJECT_SYNCH_FAILURE;
+ case GMM_CAUSE_CONGESTION:
+ return GSM48_REJECT_CONGESTION;
+ case GMM_CAUSE_SEM_INCORR_MSG:
+ return GSM48_REJECT_INCORRECT_MESSAGE;
+ case GMM_CAUSE_INV_MAND_INFO:
+ return GSM48_REJECT_INVALID_MANDANTORY_INF;
+ case GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL:
+ return GSM48_REJECT_MSG_TYPE_NOT_IMPLEMENTED;
+ case GMM_CAUSE_MSGT_INCOMP_P_STATE:
+ return GSM48_REJECT_MSG_TYPE_NOT_COMPATIBLE;
+ case GMM_CAUSE_IE_NOTEXIST_NOTIMPL:
+ return GSM48_REJECT_INF_ELEME_NOT_IMPLEMENTED;
+ case GMM_CAUSE_COND_IE_ERR:
+ return GSM48_REJECT_CONDTIONAL_IE_ERROR;
+ case GMM_CAUSE_MSG_INCOMP_P_STATE:
+ return GSM48_REJECT_MSG_NOT_COMPATIBLE;
+ case GMM_CAUSE_PROTO_ERR_UNSPEC:
+ return GSM48_REJECT_PROTOCOL_ERROR;
+ case GMM_CAUSE_NO_SUIT_CELL_IN_LA:
+ return GSM48_REJECT_NO_SUIT_CELL_IN_LA;
+ case GMM_CAUSE_MAC_FAIL:
+ return GSM48_REJECT_MAC_FAILURE;
+ case GMM_CAUSE_GSM_AUTH_UNACCEPT:
+ return GSM48_REJECT_GSM_AUTH_UNACCEPTABLE;
+ case GMM_CAUSE_NOT_AUTH_FOR_CSG:
+ return GSM48_REJECT_NOT_AUTH_FOR_CSG;
+ case GMM_CAUSE_SMS_VIA_GPRS_IN_RA:
+ return GSM48_REJECT_SMS_PROV_VIA_GPRS_IN_RA;
+ case GMM_CAUSE_NO_PDP_ACTIVATED:
+ return GSM48_REJECT_NO_PDP_CONTEXT_ACTIVATED;
+ case GMM_CAUSE_NET_FAIL:
+ return GSM48_REJECT_NETWORK_FAILURE;
+ default:
+ return GSM48_REJECT_NETWORK_FAILURE;
+ }
+}
+
+enum gsm48_reject_value vlr_reject_causes_ps(enum gsm48_reject_value reject_cause)
+{
+ switch (reject_cause) {
+ case GSM48_REJECT_CALL_CAN_NOT_BE_IDENTIFIED:
+ return GSM48_REJECT_NETWORK_FAILURE;
+ default:
+ return reject_cause;
+ }
+}
+
+enum gsm48_reject_value vlr_reject_causes_cs(enum gsm48_reject_value reject_cause)
+{
+ switch (reject_cause) {
+ case GSM48_REJECT_NO_SUIT_CELL_IN_LA:
+ case GSM48_REJECT_MAC_FAILURE:
+ case GSM48_REJECT_GSM_AUTH_UNACCEPTABLE:
+ case GSM48_REJECT_NOT_AUTH_FOR_CSG:
+ case GSM48_REJECT_SMS_PROV_VIA_GPRS_IN_RA:
+ case GSM48_REJECT_NO_PDP_CONTEXT_ACTIVATED:
+ return GSM48_REJECT_NETWORK_FAILURE;
+ default:
+ return reject_cause;
+ }
+}
+
+/* Handle LOCATION CANCEL request from HLR */
+static int vlr_subscr_handle_cancel_req(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup_msg)
+{
+ enum gsm48_reject_value gsm48_rej;
+ enum osmo_fsm_term_cause fsm_cause = OSMO_FSM_TERM_ERROR;
+ struct vlr_instance *vlr = vsub->vlr;
+ struct osmo_gsup_message gsup_reply = {0};
+ int is_update_procedure = !gsup_msg->cancel_type ||
+ gsup_msg->cancel_type == OSMO_GSUP_CANCEL_TYPE_UPDATE;
+
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_TX_CANCEL_RES);
+
+ LOGVSUBP(LOGL_INFO, vsub, "Cancelling MS subscriber (%s)\n",
+ is_update_procedure ?
+ "update procedure" : "subscription withdraw");
+
+ gsm48_rej = vlr_gmm_cause_to_reject_cause_domain(gsup_msg->cause, vlr_is_cs(vlr));
+ vlr_subscr_cancel_attach_fsm(vsub, fsm_cause, gsm48_rej);
+
+ if (vlr->ops.subscr_inval)
+ vlr->ops.subscr_inval(vsub->msc_conn_ref, vsub, gsm48_rej, is_update_procedure);
+
+ vlr_rate_ctr_inc(vlr, VLR_CTR_DETACH_BY_CANCEL);
+ vlr_subscr_detach(vsub);
+
+ gsup_reply.message_type = OSMO_GSUP_MSGT_LOCATION_CANCEL_RESULT;
+ gsup_reply.cn_domain = vlr_is_cs(vlr) ? OSMO_GSUP_CN_DOMAIN_CS : OSMO_GSUP_CN_DOMAIN_PS;
+ return vlr_subscr_tx_gsup_message(vsub, &gsup_reply);
+}
+
+/* Handle Check_IMEI_VLR result and error from HLR */
+static int vlr_subscr_handle_check_imei(struct vlr_subscr *vsub, const struct osmo_gsup_message *gsup)
+{
+ if (!vsub->lu_fsm) {
+ LOGVSUBP(LOGL_ERROR, vsub, "Rx %s without LU in progress\n",
+ osmo_gsup_message_type_name(gsup->message_type));
+ return -ENODEV;
+ }
+
+ /* Dispatch result to vsub->lu_fsm, which will either handle the result by itself (Check IMEI early) or dispatch
+ * it further to lu_compl_vlr_fsm (Check IMEI after LU). */
+ if (gsup->message_type == OSMO_GSUP_MSGT_CHECK_IMEI_RESULT) {
+ if (gsup->imei_result == OSMO_GSUP_IMEI_RESULT_ACK)
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_ACK, NULL);
+ else
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_NACK, NULL);
+ } else {
+ LOGVSUBP(LOGL_ERROR, vsub, "Check_IMEI_VLR failed; gmm_cause: %s\n",
+ get_value_string(gsm48_gmm_cause_names, gsup->cause));
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_NACK, NULL);
+ }
+
+ return 0;
+}
+
+/* Incoming handler for GSUP from HLR.
+ * Keep this function non-static for direct invocation by unit tests. */
+int vlr_gsup_rx(struct gsup_client_mux *gcm, void *data, const struct osmo_gsup_message *gsup)
+{
+ struct vlr_instance *vlr = data;
+ struct vlr_subscr *vsub;
+ int rc = 0;
+
+ vsub = vlr_subscr_find_by_imsi(vlr, gsup->imsi, __func__);
+ if (!vsub) {
+ switch (gsup->message_type) {
+ case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
+ case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_PURGE_NO_SUBSCR);
+ return vlr_rx_gsup_purge_no_subscr(vlr, gsup);
+ default:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_UNKNOWN_IMSI);
+ return vlr_rx_gsup_unknown_imsi(vlr, gsup);
+ }
+ }
+
+ switch (gsup->message_type) {
+ case OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_SAI_RES);
+ rc = vlr_subscr_handle_sai_res(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_SEND_AUTH_INFO_ERROR:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_SAI_ERR);
+ rc = vlr_subscr_handle_sai_res(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_INSERT_DATA_REQUEST:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_ISD_REQ);
+ rc = vlr_subscr_handle_isd_req(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_LOCATION_CANCEL_REQUEST:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_CANCEL_REQ);
+ rc = vlr_subscr_handle_cancel_req(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_UPDATE_LOCATION_RESULT:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_UL_RES);
+ rc = vlr_subscr_handle_lu_res(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_UPDATE_LOCATION_ERROR:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_UL_ERR);
+ rc = vlr_subscr_handle_lu_err(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_PURGE_MS_ERR);
+ goto out_unimpl;
+ case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_PURGE_MS_RES);
+ goto out_unimpl;
+ case OSMO_GSUP_MSGT_DELETE_DATA_REQUEST:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_DELETE_DATA_REQ);
+ goto out_unimpl;
+ case OSMO_GSUP_MSGT_CHECK_IMEI_ERROR:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_CHECK_IMEI_ERR);
+ rc = vlr_subscr_handle_check_imei(vsub, gsup);
+ break;
+ case OSMO_GSUP_MSGT_CHECK_IMEI_RESULT:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_CHECK_IMEI_RES);
+ rc = vlr_subscr_handle_check_imei(vsub, gsup);
+ break;
+ default:
+ vlr_rate_ctr_inc(vlr, VLR_CTR_GSUP_RX_UNKNOWN);
+ LOGP(DLGSUP, LOGL_ERROR, "GSUP Message type not handled by VLR: %d\n", gsup->message_type);
+ rc = -EINVAL;
+ break;
+ }
+
+ vlr_subscr_put(vsub, __func__);
+ return rc;
+
+out_unimpl:
+ LOGVSUBP(LOGL_ERROR, vsub, "Rx GSUP msg_type=%d not yet implemented\n", gsup->message_type);
+ vlr_subscr_put(vsub, __func__);
+ return -GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL;
+}
+
+/* MSC->VLR: Subscriber has provided IDENTITY RESPONSE */
+int vlr_subscr_rx_id_resp(struct vlr_subscr *vsub, const struct osmo_mobile_identity *mi)
+{
+ /* update the vlr_subscr with the given identity */
+ switch (mi->type) {
+ case GSM_MI_TYPE_IMSI:
+ if (vsub->imsi[0]
+ && !vlr_subscr_matches_imsi(vsub, mi->imsi)) {
+ LOGVSUBP(LOGL_ERROR, vsub, "IMSI in ID RESP differs:"
+ " %s\n", mi->imsi);
+ /* XXX Should we return an error, e.g. -EINVAL ? */
+ } else
+ vlr_subscr_set_imsi(vsub, mi->imsi);
+ break;
+ case GSM_MI_TYPE_IMEI:
+ vlr_subscr_set_imei(vsub, mi->imei);
+ break;
+ case GSM_MI_TYPE_IMEISV:
+ vlr_subscr_set_imeisv(vsub, mi->imeisv);
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ if (vsub->auth_fsm) {
+ switch (mi->type) {
+ case GSM_MI_TYPE_IMSI:
+ return osmo_fsm_inst_dispatch(vsub->auth_fsm,
+ VLR_AUTH_E_MS_ID_IMSI, (void*)mi->imsi);
+ break;
+ }
+ }
+
+ if (vsub->lu_fsm) {
+ switch (mi->type) {
+ case GSM_MI_TYPE_IMSI:
+ return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMSI, (void*)mi->imsi);
+ case GSM_MI_TYPE_IMEI:
+ return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMEI, (void*)mi->imei);
+ case GSM_MI_TYPE_IMEISV:
+ return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_ID_IMEISV, (void*)mi->imeisv);
+ default:
+ return -EINVAL;
+ }
+ }
+
+ return 0;
+}
+
+/* MSC->VLR: Subscriber has provided IDENTITY RESPONSE */
+int vlr_subscr_rx_tmsi_reall_compl(struct vlr_subscr *vsub)
+{
+ if (vsub->lu_fsm) {
+ return osmo_fsm_inst_dispatch(vsub->lu_fsm,
+ VLR_ULA_E_NEW_TMSI_ACK, NULL);
+ } else if (vsub->proc_arq_fsm) {
+ return osmo_fsm_inst_dispatch(vsub->proc_arq_fsm,
+ PR_ARQ_E_TMSI_ACK, NULL);
+ } else {
+ LOGVSUBP(LOGL_NOTICE, vsub,
+ "gratuitous TMSI REALLOC COMPL\n");
+ return -EINVAL;
+ }
+}
+
+/* SGSN->VLR: Subscriber has provided ATTACH/RAU Complete */
+int vlr_subscr_rx_rau_complete(struct vlr_subscr *vsub)
+{
+ if (!vsub->lu_fsm)
+ return -EINVAL;
+
+ return osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_NEW_TMSI_ACK, NULL);
+}
+
+bool vlr_subscr_expire(struct vlr_subscr *vsub)
+{
+ if (vsub->lu_complete) {
+ /* balancing the get from vlr_lu_compl_fsm_success() */
+ vsub->lu_complete = false;
+ vlr_subscr_put(vsub, VSUB_USE_ATTACHED);
+
+ return true;
+ }
+
+ return false;
+}
+
+static int vlr_subscr_detach(struct vlr_subscr *vsub)
+{
+ /* paranoia: should any LU or PARQ FSMs still be running, stop them. */
+ vlr_subscr_cancel_attach_fsm(vsub, OSMO_FSM_TERM_ERROR, GSM48_REJECT_CONGESTION);
+
+ vsub->imsi_detached_flag = true;
+ vsub->expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION;
+
+ /* Inform the UE-SGs FSM that the subscriber has been detached */
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_DETACH_IND_FROM_UE, NULL);
+
+ vlr_subscr_expire(vsub);
+
+ return 0;
+}
+
+/* See TS 23.012 version 9.10.0 4.3.2.1 "Process Detach_IMSI_VLR" */
+int vlr_subscr_rx_imsi_detach(struct vlr_subscr *vsub)
+{
+ int rc = 0;
+
+ vlr_rate_ctr_inc(vsub->vlr, VLR_CTR_DETACH_BY_REQ);
+
+ if (!vsub->imsi_detached_flag)
+ rc = vlr_subscr_purge(vsub);
+
+ rc |= vlr_subscr_detach(vsub);
+ return rc;
+}
+
+/* Tear down any running FSMs due to MSC connection timeout.
+ * Visit all vsub->*_fsm pointers and give them a queue to send a final reject
+ * message before the entire connection is torn down.
+ * \param[in] vsub subscriber to tear down
+ */
+void vlr_ran_conn_timeout(struct vlr_subscr *vsub)
+{
+ vlr_subscr_cancel_attach_fsm(vsub, OSMO_FSM_TERM_TIMEOUT, GSM48_REJECT_CONGESTION);
+}
+
+struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops, bool is_ps)
+{
+ struct vlr_instance *vlr = talloc_zero(ctx, struct vlr_instance);
+ OSMO_ASSERT(vlr);
+
+ /* Some of these are needed only on UTRAN, but in case the caller wants
+ * only GERAN, she should just provide dummy callbacks. */
+ OSMO_ASSERT(ops->tx_auth_req);
+ OSMO_ASSERT(ops->tx_auth_rej);
+ OSMO_ASSERT(ops->tx_id_req);
+ OSMO_ASSERT(ops->tx_lu_acc);
+ OSMO_ASSERT(ops->tx_lu_rej);
+ OSMO_ASSERT(ops->tx_cm_serv_acc);
+ OSMO_ASSERT(ops->tx_cm_serv_rej);
+ OSMO_ASSERT(ops->set_ciph_mode);
+ OSMO_ASSERT(ops->tx_common_id);
+ OSMO_ASSERT(ops->subscr_update);
+ OSMO_ASSERT(ops->subscr_assoc);
+
+ INIT_LLIST_HEAD(&vlr->subscribers);
+ INIT_LLIST_HEAD(&vlr->operations);
+ memcpy(&vlr->ops, ops, sizeof(vlr->ops));
+
+ /* defaults */
+ vlr->cfg.is_ps = is_ps;
+ vlr->cfg.assign_tmsi = true;
+ vlr->cfg.nri_bitlen = OSMO_NRI_BITLEN_DEFAULT;
+ vlr->cfg.nri_ranges = osmo_nri_ranges_alloc(vlr);
+
+ vlr->statg = osmo_stat_item_group_alloc(vlr, &vlr_statg_desc, 0);
+ if (!vlr->statg)
+ goto err_free;
+
+ vlr->ctrg = rate_ctr_group_alloc(vlr, &vlr_ctrg_desc, 0);
+ if (!vlr->ctrg)
+ goto err_statg;
+
+ /* reset shared timer definitions */
+ osmo_tdefs_reset(msc_tdefs_vlr);
+ osmo_tdefs_reset(sgsn_tdefs_vlr);
+
+ /* osmo_auth_fsm.c */
+ vlr_auth_fsm_init(is_ps);
+
+ /* osmo_lu_fsm.c */
+ vlr_lu_fsm_init(is_ps);
+ /* vlr_access_request_fsm.c */
+ vlr_parq_fsm_init(is_ps);
+ /* vlr_sgs_fsm.c */
+ vlr_sgs_fsm_init();
+
+ if (is_ps)
+ vlr_tdefs = sgsn_tdefs_vlr;
+ else
+ vlr_tdefs = msc_tdefs_vlr;
+
+ return vlr;
+
+err_statg:
+ osmo_stat_item_group_free(vlr->statg);
+err_free:
+ talloc_free(vlr);
+ return NULL;
+}
+
+int vlr_start(struct vlr_instance *vlr, struct gsup_client_mux *gcm)
+{
+ OSMO_ASSERT(vlr);
+
+ vlr->gcm = gcm;
+ gcm->rx_cb[OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT] = (struct gsup_client_mux_rx_cb){
+ .func = vlr_gsup_rx,
+ .data = vlr,
+ };
+
+ osmo_timer_setup(&vlr->lu_expire_timer, vlr_subscr_expire_lu, vlr);
+ osmo_timer_schedule(&vlr->lu_expire_timer, VLR_SUBSCRIBER_LU_EXPIRATION_INTERVAL, 0);
+ return 0;
+}
+
+/* MSC->VLR: Subscriber has disconnected */
+int vlr_subscr_disconnected(struct vlr_subscr *vsub)
+{
+ /* This corresponds to a MAP-ABORT from MSC->VLR on a classic B
+ * interface */
+ if (vsub->lu_fsm)
+ osmo_fsm_inst_term(vsub->lu_fsm, OSMO_FSM_TERM_REQUEST, NULL);
+ if (vsub->auth_fsm)
+ osmo_fsm_inst_term(vsub->auth_fsm, OSMO_FSM_TERM_REQUEST, NULL);
+ vsub->msc_conn_ref = NULL;
+
+ return 0;
+}
+
+/* MSC->VLR: Receive Authentication Failure from Subscriber */
+int vlr_subscr_rx_auth_fail(struct vlr_subscr *vsub, const uint8_t *auts)
+{
+ struct vlr_auth_resp_par par = {0};
+ par.auts = auts;
+
+ osmo_fsm_inst_dispatch(vsub->auth_fsm, VLR_AUTH_E_MS_AUTH_FAIL, &par);
+ return 0;
+}
+
+/* MSC->VLR: Receive Authentication Response from MS
+ * \returns 1 in case of success, 0 in case of delay, -1 on auth error */
+int vlr_subscr_rx_auth_resp(struct vlr_subscr *vsub, bool is_r99,
+ bool is_utran, const uint8_t *res, uint8_t res_len)
+{
+ struct osmo_fsm_inst *auth_fi = vsub->auth_fsm;
+ struct vlr_auth_resp_par par;
+
+ par.is_r99 = is_r99;
+ par.is_utran = is_utran;
+ par.res = res;
+ par.res_len = res_len;
+ osmo_fsm_inst_dispatch(auth_fi, VLR_AUTH_E_MS_AUTH_RESP, (void *) &par);
+
+ return 0;
+}
+
+/* MSC->VLR: Receive result of Ciphering Mode Command from MS */
+void vlr_subscr_rx_ciph_res(struct vlr_subscr *vsub, enum vlr_ciph_result_cause result)
+{
+ if (vsub->lu_fsm && vsub->lu_fsm->state == VLR_ULA_S_WAIT_CIPH)
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_CIPH_RES, &result);
+ if (vsub->proc_arq_fsm
+ && vsub->proc_arq_fsm->state == PR_ARQ_S_WAIT_CIPH)
+ osmo_fsm_inst_dispatch(vsub->proc_arq_fsm, PR_ARQ_E_CIPH_RES, &result);
+}
+
+/* Internal evaluation of requested ciphering mode.
+ * Send set_ciph_mode() to MSC depending on the ciph_mode argument.
+ * \param[in] vlr VLR instance.
+ * \param[in] fi Calling FSM instance, for logging.
+ * \param[in] msc_conn_ref MSC conn to send to.
+ * \param[in] ciph_mode Ciphering config, to decide whether to do ciphering.
+ * \returns 0 if no ciphering is needed or message was sent successfully,
+ * or a negative value if ciph_mode is invalid or sending failed.
+ */
+int vlr_set_ciph_mode(struct vlr_instance *vlr,
+ struct osmo_fsm_inst *fi,
+ void *msc_conn_ref,
+ bool umts_aka,
+ bool retrieve_imeisv)
+{
+ LOGPFSML(fi, LOGL_DEBUG, "Set Ciphering Mode\n");
+ return vlr->ops.set_ciph_mode(msc_conn_ref, umts_aka, retrieve_imeisv);
+}
+
+/* Decide whether UMTS AKA should be used.
+ * UTRAN networks are by definition R99 capable, and the auth vector is required to contain UMTS AKA
+ * tokens. This is expected to be verified by the caller. On GERAN, UMTS AKA must be used iff MS and
+ * GERAN are R99 capable and UMTS AKA tokens are available.
+ * \param[in] vec Auth tokens (received from the HLR).
+ * \param[in] is_r99 True when BTS and GERAN are R99 capable.
+ * \returns true to use UMTS AKA, false to use pre-R99 GSM AKA.
+ */
+bool vlr_use_umts_aka(struct osmo_auth_vector *vec, bool is_r99)
+{
+ if (!is_r99)
+ return false;
+ if (!(vec->auth_types & OSMO_AUTH_TYPE_UMTS))
+ return false;
+ return true;
+}
+
+void log_set_filter_vlr_subscr(struct log_target *target,
+ struct vlr_subscr *vlr_subscr)
+{
+ struct vlr_subscr **fsub = (void*)&target->filter_data[LOG_FLT_VLR_SUBSCR];
+ const char *use = "logfilter";
+
+ /* free the old data */
+ if (*fsub) {
+ vlr_subscr_put(*fsub, use);
+ *fsub = NULL;
+ }
+
+ if (vlr_subscr) {
+ target->filter_map |= (1 << LOG_FLT_VLR_SUBSCR);
+ vlr_subscr_get(vlr_subscr, use);
+ *fsub = vlr_subscr;
+ } else
+ target->filter_map &= ~(1 << LOG_FLT_VLR_SUBSCR);
+}
+
+int g_vlr_log_cat[_OSMO_VLR_LOGC_MAX];
+
+void osmo_vlr_set_log_cat(enum osmo_vlr_cat logc, int logc_num)
+{
+ if (logc < OSMO_VLR_LOGC_VLR || logc >= _OSMO_VLR_LOGC_MAX)
+ return;
+
+ g_vlr_log_cat[logc] = logc_num;
+
+ switch (logc) {
+ case OSMO_VLR_LOGC_VLR:
+ vlr_auth_fsm_set_log_subsys(logc_num);
+ vlr_parq_fsm_set_log_subsys(logc_num);
+ vlr_lu_fsm_set_log_subsys(logc_num);
+ break;
+ case OSMO_VLR_LOGC_SGS:
+ vlr_sgs_fsm_set_log_subsys(logc_num);
+ break;
+ default:
+ break;
+ }
+}
diff --git a/src/libvlr/vlr_access_req_fsm.c b/src/libvlr/vlr_access_req_fsm.c
new file mode 100644
index 0000000..516f53d
--- /dev/null
+++ b/src/libvlr/vlr_access_req_fsm.c
@@ -0,0 +1,831 @@
+/* Osmocom Visitor Location Register (VLR): Access Request FSMs */
+
+/* (C) 2016 by Harald Welte <laforge(a)gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/tdef.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/vlr/vlr.h>
+
+#include "vlr_core.h"
+#include "vlr_auth_fsm.h"
+#include "vlr_lu_fsm.h"
+#include "vlr_access_req_fsm.h"
+
+#define S(x) (1 << (x))
+
+/***********************************************************************
+ * Process_Access_Request_VLR, TS 29.002 Chapter 25.4.2
+ ***********************************************************************/
+
+static const struct value_string proc_arq_vlr_event_names[] = {
+ OSMO_VALUE_STRING(PR_ARQ_E_START),
+ OSMO_VALUE_STRING(PR_ARQ_E_ID_IMSI),
+ OSMO_VALUE_STRING(PR_ARQ_E_AUTH_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_AUTH_NO_INFO),
+ OSMO_VALUE_STRING(PR_ARQ_E_AUTH_FAILURE),
+ OSMO_VALUE_STRING(PR_ARQ_E_CIPH_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_UPD_LOC_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_TRACE_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_IMEI_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_PRES_RES),
+ OSMO_VALUE_STRING(PR_ARQ_E_TMSI_ACK),
+ { 0, NULL }
+};
+
+struct osmo_tdef_state_timeout msc_parq_tdef_states[32] = {
+ [PR_ARQ_S_WAIT_CHECK_IMEI] = { .T = 3270 },
+ [PR_ARQ_S_WAIT_OBTAIN_IMSI] = { .T = 3270 },
+};
+
+struct osmo_tdef_state_timeout sgsn_parq_tdef_states[32] = {
+ [PR_ARQ_S_WAIT_CHECK_IMEI] = { .T = 3370 },
+ [PR_ARQ_S_WAIT_OBTAIN_IMSI] = { .T = 3370 },
+};
+
+struct osmo_tdef_state_timeout *parq_fsm_state_tdef;
+
+struct proc_arq_priv {
+ struct vlr_instance *vlr;
+ struct vlr_subscr *vsub;
+ void *msc_conn_ref;
+ struct osmo_fsm_inst *ul_child_fsm;
+ struct osmo_fsm_inst *sub_pres_vlr_fsm;
+ uint32_t parent_event_success;
+ uint32_t parent_event_failure;
+ void *parent_event_data;
+
+ enum vlr_parq_type type;
+ enum osmo_cm_service_type cm_service_type;
+ enum gsm48_reject_value result; /*< 0 on success */
+ bool by_tmsi;
+ char imsi[16];
+ uint32_t tmsi;
+ struct osmo_location_area_id lai;
+ bool authentication_required;
+ /* is_ciphering_to_be_attempted: true when any A5/n > 0 are enabled. Ciphering is allowed, always attempt to get Auth Info from
+ * the HLR. */
+ bool is_ciphering_to_be_attempted;
+ /* is_ciphering_required: true when A5/0 is disabled. If we cannot get Auth Info from the HLR, reject the
+ * subscriber. */
+ bool is_ciphering_required;
+ uint8_t key_seq;
+ bool is_r99;
+ bool is_utran;
+ bool implicitly_accepted_parq_by_ciphering_cmd;
+};
+
+static int assoc_par_with_subscr(struct osmo_fsm_inst *fi, struct vlr_subscr *vsub)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_instance *vlr = par->vlr;
+
+ vsub->msc_conn_ref = par->msc_conn_ref;
+ par->vsub = vsub;
+ /* Tell MSC to associate this subscriber with the given
+ * connection */
+ return vlr->ops.subscr_assoc(par->msc_conn_ref, par->vsub);
+}
+
+static const char *vlr_proc_arq_result_name(const struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ return par->result? gsm48_reject_value_name(par->result) : "PASSED";
+}
+
+#define proc_arq_fsm_done(fi, res) _proc_arq_fsm_done(fi, res, __FILE__, __LINE__)
+static void _proc_arq_fsm_done(struct osmo_fsm_inst *fi,
+ enum gsm48_reject_value gsm48_rej,
+ const char *file, int line)
+{
+ struct proc_arq_priv *par = fi->priv;
+ par->result = gsm48_rej;
+ LOGPFSMSRC(fi, file, line, "proc_arq_fsm_done(%s)\n", vlr_proc_arq_result_name(fi));
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_DONE, 0, 0);
+}
+
+static void proc_arq_vlr_dispatch_result(struct osmo_fsm_inst *fi,
+ uint32_t prev_state)
+{
+ struct proc_arq_priv *par = fi->priv;
+ bool success;
+ int rc;
+ LOGPFSM(fi, "Process Access Request result: %s\n", vlr_proc_arq_result_name(fi));
+
+ success = (par->result == 0);
+
+ /* It would be logical to first dispatch the success event to the
+ * parent FSM, but that could start actions that send messages to the
+ * MS. Rather send the CM Service Accept message first and then signal
+ * success. Since messages are handled synchronously, the success event
+ * will be processed before we handle new incoming data from the MS. */
+
+ if (par->type == VLR_PR_ARQ_T_CM_SERV_REQ) {
+ if (success
+ && !par->implicitly_accepted_parq_by_ciphering_cmd) {
+ rc = par->vlr->ops.tx_cm_serv_acc(par->msc_conn_ref,
+ par->cm_service_type);
+ if (rc) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "Failed to send CM Service Accept\n");
+ success = false;
+ }
+ }
+ if (!success) {
+ rc = par->vlr->ops.tx_cm_serv_rej(par->msc_conn_ref,
+ par->cm_service_type,
+ par->result);
+ if (rc)
+ LOGPFSML(fi, LOGL_ERROR,
+ "Failed to send CM Service Reject\n");
+ }
+ }
+
+ /* For VLR_PR_ARQ_T_PAGING_RESP, there is nothing to send. The conn_fsm
+ * will start handling pending paging transactions. */
+
+ if (!fi->proc.parent) {
+ LOGPFSML(fi, LOGL_ERROR, "No parent FSM\n");
+ return;
+ }
+ osmo_fsm_inst_dispatch(fi->proc.parent,
+ success ? par->parent_event_success
+ : par->parent_event_failure,
+ par->parent_event_data);
+}
+
+void proc_arq_vlr_cleanup(struct osmo_fsm_inst *fi,
+ enum osmo_fsm_term_cause cause)
+{
+ struct proc_arq_priv *par = fi->priv;
+ if (par->vsub && par->vsub->proc_arq_fsm == fi)
+ par->vsub->proc_arq_fsm = NULL;
+}
+
+static void _proc_arq_vlr_post_imei(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ /* See 3GPP TS 29.002 Proc_Acc_Req_VLR3. */
+ /* TODO: Identity := IMSI */
+ if (0 /* TODO: TMSI reallocation at access: vlr->cfg.alloc_tmsi_arq */) {
+ vlr_subscr_alloc_tmsi(vsub);
+ /* TODO: forward TMSI to MS, wait for TMSI
+ * REALLOC COMPLETE */
+ /* TODO: Freeze old TMSI */
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_TMSI_ACK, 0, 0);
+ return;
+ }
+
+ proc_arq_fsm_done(fi, 0);
+}
+
+static void _proc_arq_vlr_post_trace(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+ struct vlr_instance *vlr = vsub->vlr;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ /* Node 3 */
+ /* See 3GPP TS 29.002 Proc_Acc_Req_VLR3. */
+ if (0 /* IMEI check required */) {
+ /* Chck_IMEI_VLR */
+ vlr->ops.tx_id_req(par->msc_conn_ref, GSM_MI_TYPE_IMEI);
+ osmo_tdef_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_CHECK_IMEI, parq_fsm_state_tdef, vlr_tdefs, -1);
+ } else
+ _proc_arq_vlr_post_imei(fi);
+}
+
+/* After Subscriber_Present_VLR */
+static void _proc_arq_vlr_post_pres(struct osmo_fsm_inst *fi)
+{
+ LOGPFSM(fi, "%s()\n", __func__);
+ /* See 3GPP TS 29.002 Proc_Acc_Req_VLR3. */
+ if (0 /* TODO: tracing required */) {
+ /* TODO: Trace_Subscriber_Activity_VLR */
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_TRACE_SUB, 0, 0);
+ }
+ _proc_arq_vlr_post_trace(fi);
+}
+
+/* After Update_Location_Child_VLR */
+static void _proc_arq_vlr_node2_post_vlr(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ if (!vsub->sub_dataconf_by_hlr_ind) {
+ /* Set User Error: Unidentified Subscriber */
+ proc_arq_fsm_done(fi, GSM48_REJECT_IMSI_UNKNOWN_IN_HLR);
+ return;
+ }
+ /* We don't feature location area specific blocking (yet). */
+ if (0 /* roaming not allowed in LA */) {
+ /* Set User Error: Roaming not allowed in this LA */
+ proc_arq_fsm_done(fi, GSM48_REJECT_ROAMING_NOT_ALLOWED);
+ return;
+ }
+ vsub->imsi_detached_flag = false;
+ if (vsub->ms_not_reachable_flag) {
+ /* Start Subscriber_Present_VLR */
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_SUB_PRES, 0, 0);
+ sub_pres_vlr_fsm_start(&par->sub_pres_vlr_fsm, fi, vsub, PR_ARQ_E_PRES_RES);
+ return;
+ }
+ _proc_arq_vlr_post_pres(fi);
+}
+
+static void _proc_arq_vlr_node2_post_ciph(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+ int rc;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ rc = par->vlr->ops.tx_common_id(par->msc_conn_ref);
+ if (rc)
+ LOGPFSML(fi, LOGL_ERROR, "Error while sending Common ID (%d)\n", rc);
+
+ vsub->conf_by_radio_contact_ind = true;
+ if (vsub->loc_conf_in_hlr_ind == false) {
+ /* start Update_Location_Child_VLR. WE use
+ * Update_HLR_VLR instead, the differences appear
+ * insignificant for now. */
+ par->ul_child_fsm = upd_hlr_vlr_proc_start(fi, vsub,
+ PR_ARQ_E_UPD_LOC_RES);
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_UPD_LOC_CHILD, 0, 0);
+ return;
+ }
+ _proc_arq_vlr_node2_post_vlr(fi);
+}
+
+/* Return true when CipherModeCmd / SecurityModeCmd should be attempted. */
+static bool is_cmc_smc_to_be_attempted(struct proc_arq_priv *par)
+{
+ /* UTRAN: always send SecModeCmd, even if ciphering is not required.
+ * GERAN: avoid sending CiphModeCmd if ciphering is not required. */
+ return par->is_utran || par->is_ciphering_to_be_attempted;
+}
+
+static void _proc_arq_vlr_node2(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+ bool umts_aka;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ /* Continue with ciphering, if enabled.
+ * If auth/ciph is optional and the HLR returned no auth info, continue without ciphering. */
+ if (!is_cmc_smc_to_be_attempted(par)
+ || (vsub->sec_ctx == VLR_SEC_CTX_NONE && !par->is_ciphering_required)) {
+ _proc_arq_vlr_node2_post_ciph(fi);
+ return;
+ }
+
+ switch (vsub->sec_ctx) {
+ case VLR_SEC_CTX_GSM:
+ umts_aka = false;
+ break;
+ case VLR_SEC_CTX_UMTS:
+ umts_aka = true;
+ break;
+ default:
+ LOGPFSML(fi, LOGL_ERROR, "Cannot start ciphering, security context is not established\n");
+ proc_arq_fsm_done(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ if (vlr_set_ciph_mode(vsub->vlr, fi, par->msc_conn_ref,
+ umts_aka,
+ vsub->vlr->cfg.retrieve_imeisv_ciphered)) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "Failed to send Ciphering Mode Command\n");
+ proc_arq_fsm_done(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ par->implicitly_accepted_parq_by_ciphering_cmd = true;
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_CIPH, 0, 0);
+}
+
+static bool is_auth_to_be_attempted(struct proc_arq_priv *par)
+{
+ /* The cases where the authentication procedure should be used
+ * are defined in 3GPP TS 33.102 */
+ /* For now we use a default value passed in to vlr_lu_fsm(). */
+ return par->authentication_required ||
+ (par->is_ciphering_to_be_attempted && !auth_try_reuse_tuple(par->vsub, par->key_seq));
+}
+
+/* after the IMSI is known */
+static void proc_arq_vlr_fn_post_imsi(struct osmo_fsm_inst *fi)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_subscr *vsub = par->vsub;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ OSMO_ASSERT(vsub);
+
+ /* TODO: Identity IMEI -> System Failure */
+ if (is_auth_to_be_attempted(par)) {
+ osmo_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_AUTH,
+ 0, 0);
+ vsub->auth_fsm = auth_fsm_start(vsub, fi,
+ PR_ARQ_E_AUTH_RES,
+ PR_ARQ_E_AUTH_NO_INFO,
+ PR_ARQ_E_AUTH_FAILURE,
+ par->is_r99,
+ par->is_utran);
+ } else {
+ _proc_arq_vlr_node2(fi);
+ }
+}
+
+static void proc_arq_vlr_fn_init(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_instance *vlr = par->vlr;
+ struct vlr_subscr *vsub = NULL;
+
+ OSMO_ASSERT(event == PR_ARQ_E_START);
+
+ /* Obtain_Identity_VLR */
+ if (!par->by_tmsi) {
+ /* IMSI was included */
+ vsub = vlr_subscr_find_by_imsi(par->vlr, par->imsi, __func__);
+ } else {
+ /* TMSI was included */
+ vsub = vlr_subscr_find_by_tmsi(par->vlr, par->tmsi, __func__);
+ }
+ if (vsub) {
+ log_set_context(LOG_CTX_VLR_SUBSCR, vsub);
+ if (vsub->proc_arq_fsm && fi != vsub->proc_arq_fsm) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "Another proc_arq_fsm is already"
+ " associated with subscr %s,"
+ " terminating the other FSM.\n",
+ vlr_subscr_name(vsub));
+ proc_arq_fsm_done(vsub->proc_arq_fsm,
+ GSM48_REJECT_NETWORK_FAILURE);
+ }
+ vsub->proc_arq_fsm = fi;
+ if (assoc_par_with_subscr(fi, vsub) != 0)
+ proc_arq_fsm_done(fi, GSM48_REJECT_NETWORK_FAILURE);
+ else
+ proc_arq_vlr_fn_post_imsi(fi);
+ vlr_subscr_put(vsub, __func__);
+ return;
+ }
+ /* No VSUB could be resolved. What now? */
+
+ if (!par->by_tmsi) {
+ /* We couldn't find a subscriber even by IMSI,
+ * Set User Error: Unidentified Subscriber */
+ proc_arq_fsm_done(fi, GSM48_REJECT_IMSI_UNKNOWN_IN_VLR);
+ return;
+ } else {
+ /* TMSI was included, are we permitted to use it? */
+ if (vlr->cfg.parq_retrieve_imsi) {
+ /* Obtain_IMSI_VLR */
+ osmo_tdef_fsm_inst_state_chg(fi, PR_ARQ_S_WAIT_OBTAIN_IMSI, parq_fsm_state_tdef, vlr_tdefs, -1);
+ return;
+ } else {
+ /* Set User Error: Unidentified Subscriber */
+ proc_arq_fsm_done(fi, GSM48_REJECT_IMSI_UNKNOWN_IN_VLR);
+ return;
+ }
+ }
+}
+
+/* ID REQ(IMSI) has returned */
+static void proc_arq_vlr_fn_w_obt_imsi(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct proc_arq_priv *par = fi->priv;
+ struct vlr_instance *vlr = par->vlr;
+ struct vlr_subscr *vsub;
+
+ OSMO_ASSERT(event == PR_ARQ_E_ID_IMSI);
+
+ vsub = vlr_subscr_find_by_imsi(vlr, par->imsi, __func__);
+ if (!vsub) {
+ /* Set User Error: Unidentified Subscriber */
+ proc_arq_fsm_done(fi, GSM48_REJECT_IMSI_UNKNOWN_IN_VLR);
+ return;
+ }
+ if (assoc_par_with_subscr(fi, vsub))
+ proc_arq_fsm_done(fi, GSM48_REJECT_NETWORK_FAILURE);
+ else
+ proc_arq_vlr_fn_post_imsi(fi);
+ vlr_subscr_put(vsub, __func__);
+}
+
+/* Authenticate_VLR has completed */
+static void proc_arq_vlr_fn_w_auth(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct proc_arq_priv *par = fi->priv;
+ enum gsm48_reject_value *cause = data;
+
+ switch (event) {
+ case PR_ARQ_E_AUTH_RES:
+ /* Node 2 */
+ _proc_arq_vlr_node2(fi);
+ return;
+
+ case PR_ARQ_E_AUTH_FAILURE:
+ proc_arq_fsm_done(fi, cause ? *cause : GSM48_REJECT_NETWORK_FAILURE);
+ return;
+
+ case PR_ARQ_E_AUTH_NO_INFO:
+ /* HLR returned no auth info for the subscriber. Continue only if authentication is optional. */
+ if (par->authentication_required) {
+ proc_arq_fsm_done(fi, cause ? *cause : GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+ LOGPFSML(fi, LOGL_INFO,
+ "Attaching subscriber without auth (auth is optional, and no auth info received from HLR)\n");
+ /* Node 2 */
+ _proc_arq_vlr_node2(fi);
+ return;
+
+ default:
+ OSMO_ASSERT(false);
+ }
+}
+
+static void proc_arq_vlr_fn_w_ciph(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ enum vlr_ciph_result_cause result = VLR_CIPH_REJECT;
+
+ OSMO_ASSERT(event == PR_ARQ_E_CIPH_RES);
+
+ if (!data)
+ LOGPFSML(fi, LOGL_ERROR, "invalid ciphering result: NULL\n");
+ else
+ result = *(enum vlr_ciph_result_cause*)data;
+
+ switch (result) {
+ case VLR_CIPH_COMPL:
+ _proc_arq_vlr_node2_post_ciph(fi);
+ return;
+ case VLR_CIPH_REJECT:
+ LOGPFSM(fi, "ciphering rejected\n");
+ proc_arq_fsm_done(fi, GSM48_REJECT_ILLEGAL_MS);
+ return;
+ default:
+ LOGPFSML(fi, LOGL_ERROR, "invalid ciphering result: %d\n", result);
+ proc_arq_fsm_done(fi, GSM48_REJECT_ILLEGAL_MS);
+ return;
+ }
+}
+
+/* Update_Location_Child_VLR has completed */
+static void proc_arq_vlr_fn_w_upd_loc(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ OSMO_ASSERT(event == PR_ARQ_E_UPD_LOC_RES);
+
+ _proc_arq_vlr_node2_post_vlr(fi);
+}
+
+/* Subscriber_Present_VLR has completed */
+static void proc_arq_vlr_fn_w_pres(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ OSMO_ASSERT(event == PR_ARQ_E_PRES_RES);
+
+ _proc_arq_vlr_post_pres(fi);
+}
+
+static void proc_arq_vlr_fn_w_trace(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ OSMO_ASSERT(event == PR_ARQ_E_TRACE_RES);
+
+ _proc_arq_vlr_post_trace(fi);
+}
+
+/* we have received the ID RESPONSE (IMEI) */
+static void proc_arq_vlr_fn_w_imei(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ OSMO_ASSERT(event == PR_ARQ_E_IMEI_RES);
+
+ _proc_arq_vlr_post_imei(fi);
+}
+
+/* MSC tells us that MS has acknowleded TMSI re-allocation */
+static void proc_arq_vlr_fn_w_tmsi(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ OSMO_ASSERT(event == PR_ARQ_E_TMSI_ACK);
+
+ /* FIXME: check confirmation? unfreeze? */
+ proc_arq_fsm_done(fi, 0);
+}
+
+static const struct osmo_fsm_state proc_arq_vlr_states[] = {
+ [PR_ARQ_S_INIT] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_INIT),
+ .in_event_mask = S(PR_ARQ_E_START),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_OBTAIN_IMSI) |
+ S(PR_ARQ_S_WAIT_AUTH) |
+ S(PR_ARQ_S_WAIT_CIPH) |
+ S(PR_ARQ_S_WAIT_UPD_LOC_CHILD) |
+ S(PR_ARQ_S_WAIT_SUB_PRES) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_init,
+ },
+ [PR_ARQ_S_WAIT_OBTAIN_IMSI] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_OBTAIN_IMSI),
+ .in_event_mask = S(PR_ARQ_E_ID_IMSI),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_AUTH) |
+ S(PR_ARQ_S_WAIT_CIPH) |
+ S(PR_ARQ_S_WAIT_UPD_LOC_CHILD) |
+ S(PR_ARQ_S_WAIT_SUB_PRES) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_obt_imsi,
+ },
+ [PR_ARQ_S_WAIT_AUTH] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_AUTH),
+ .in_event_mask = S(PR_ARQ_E_AUTH_RES) |
+ S(PR_ARQ_E_AUTH_NO_INFO) |
+ S(PR_ARQ_E_AUTH_FAILURE),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_CIPH) |
+ S(PR_ARQ_S_WAIT_UPD_LOC_CHILD) |
+ S(PR_ARQ_S_WAIT_SUB_PRES) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_auth,
+ },
+ [PR_ARQ_S_WAIT_CIPH] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_CIPH),
+ .in_event_mask = S(PR_ARQ_E_CIPH_RES),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_UPD_LOC_CHILD) |
+ S(PR_ARQ_S_WAIT_SUB_PRES) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_ciph,
+ },
+ [PR_ARQ_S_WAIT_UPD_LOC_CHILD] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_UPD_LOC_CHILD),
+ .in_event_mask = S(PR_ARQ_E_UPD_LOC_RES),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_SUB_PRES) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_upd_loc,
+ },
+ [PR_ARQ_S_WAIT_SUB_PRES] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_SUB_PRES),
+ .in_event_mask = S(PR_ARQ_E_PRES_RES),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_TRACE_SUB) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_pres,
+ },
+ [PR_ARQ_S_WAIT_TRACE_SUB] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_TRACE_SUB),
+ .in_event_mask = S(PR_ARQ_E_TRACE_RES),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_CHECK_IMEI) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_trace,
+ },
+ [PR_ARQ_S_WAIT_CHECK_IMEI] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_CHECK_IMEI),
+ .in_event_mask = S(PR_ARQ_E_IMEI_RES),
+ .out_state_mask = S(PR_ARQ_S_DONE) |
+ S(PR_ARQ_S_WAIT_TMSI_ACK),
+ .action = proc_arq_vlr_fn_w_imei,
+ },
+ [PR_ARQ_S_WAIT_TMSI_ACK] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_WAIT_TMSI_ACK),
+ .in_event_mask = S(PR_ARQ_E_TMSI_ACK),
+ .out_state_mask = S(PR_ARQ_S_DONE),
+ .action = proc_arq_vlr_fn_w_tmsi,
+ },
+ [PR_ARQ_S_DONE] = {
+ .name = OSMO_STRINGIFY(PR_ARQ_S_DONE),
+ .onenter = proc_arq_vlr_dispatch_result,
+ },
+};
+
+static struct osmo_fsm proc_arq_vlr_fsm = {
+ .name = "Process_Access_Request_VLR",
+ .states = proc_arq_vlr_states,
+ .num_states = ARRAY_SIZE(proc_arq_vlr_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = proc_arq_vlr_event_names,
+ .cleanup = proc_arq_vlr_cleanup,
+};
+
+void
+vlr_proc_acc_req(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_parq_type type, enum osmo_cm_service_type cm_service_type,
+ const struct osmo_mobile_identity *mi,
+ const struct osmo_location_area_id *lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran)
+{
+ struct osmo_fsm_inst *fi;
+ struct proc_arq_priv *par;
+
+ if (is_ciphering_required)
+ OSMO_ASSERT(is_ciphering_to_be_attempted);
+
+ fi = osmo_fsm_inst_alloc_child(&proc_arq_vlr_fsm, parent,
+ parent_event_failure);
+ if (!fi)
+ return;
+
+ par = talloc_zero(fi, struct proc_arq_priv);
+ fi->priv = par;
+ par->vlr = vlr;
+ par->msc_conn_ref = msc_conn_ref;
+ par->type = type;
+ par->cm_service_type = cm_service_type;
+ par->lai = *lai;
+ par->parent_event_success = parent_event_success;
+ par->parent_event_failure = parent_event_failure;
+ par->parent_event_data = parent_event_data;
+ par->authentication_required = authentication_required;
+ par->is_ciphering_to_be_attempted = is_ciphering_to_be_attempted;
+ par->is_ciphering_required = is_ciphering_required;
+ par->key_seq = key_seq;
+ par->is_r99 = is_r99;
+ par->is_utran = is_utran;
+
+ LOGPFSM(fi, "rev=%s net=%s%s%s\n",
+ is_r99 ? "R99" : "GSM",
+ is_utran ? "UTRAN" : "GERAN",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ " Auth" : " (no Auth)",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ (is_ciphering_to_be_attempted ? "+Ciph" : " (no Ciph)")
+ : "");
+
+ if (is_utran && !authentication_required)
+ LOGPFSML(fi, LOGL_ERROR,
+ "Authentication off on UTRAN network. Good luck.\n");
+
+ switch (mi->type) {
+ case GSM_MI_TYPE_IMSI:
+ OSMO_STRLCPY_ARRAY(par->imsi, mi->imsi);
+ par->by_tmsi = false;
+ break;
+ case GSM_MI_TYPE_TMSI:
+ par->by_tmsi = true;
+ par->tmsi = mi->tmsi;
+ break;
+ case GSM_MI_TYPE_IMEI:
+ /* TODO: IMEI (emergency call) */
+ default:
+ proc_arq_fsm_done(fi, GSM48_REJECT_INVALID_MANDANTORY_INF);
+ return;
+ }
+
+ osmo_fsm_inst_dispatch(fi, PR_ARQ_E_START, NULL);
+}
+
+/* Gracefully terminate an FSM created by vlr_proc_acc_req() in case of
+ * external timeout (i.e. from MSC). */
+void vlr_parq_cancel(struct osmo_fsm_inst *fi,
+ enum osmo_fsm_term_cause fsm_cause,
+ enum gsm48_reject_value gsm48_cause)
+{
+ if (!fi || fi->state == PR_ARQ_S_DONE)
+ return;
+ LOGPFSM(fi, "Cancel: %s\n", osmo_fsm_term_cause_name(fsm_cause));
+ proc_arq_fsm_done(fi, gsm48_cause);
+}
+
+
+#if 0
+/***********************************************************************
+ * Update_Location_Child_VLR, TS 29.002 Chapter 25.4.4
+ ***********************************************************************/
+
+enum upd_loc_child_vlr_state {
+ ULC_S_IDLE,
+ ULC_S_WAIT_HLR_RESP,
+ ULC_S_DONE,
+};
+
+enum upd_loc_child_vlr_event {
+ ULC_E_START,
+};
+
+static const struct value_string upd_loc_child_vlr_event_names[] = {
+ { ULC_E_START, "START" },
+ { 0, NULL }
+};
+
+static void upd_loc_child_f_idle(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ OSMO_ASSERT(event == ULC_E_START);
+
+ /* send update location */
+}
+
+static void upd_loc_child_f_w_hlr(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+}
+
+static const struct osmo_fsm_state upd_loc_child_vlr_states[] = {
+ [ULC_S_IDLE] = {
+ .in_event_mask = ,
+ .out_state_mask = S(ULC_S_WAIT_HLR_RESP) |
+ S(ULC_S_DONE),
+ .name = "IDLE",
+ .action = upd_loc_child_f_idle,
+ },
+ [ULC_S_WAIT_HLR_RESP] = {
+ .in_event_mask = ,
+ .out_state_mask = S(ULC_S_DONE),
+ .name = "WAIT-HLR-RESP",
+ .action = upd_loc_child_f_w_hlr,
+ },
+ [ULC_S_DONE] = {
+ .name = "DONE",
+ },
+};
+
+static struct osmo_fsm upd_loc_child_vlr_fsm = {
+ .name = "Update_Location_Child_VLR",
+ .states = upd_loc_child_vlr_states,
+ .num_states = ARRAY_SIZE(upd_loc_child_vlr_states),
+ .log_subsys = DVLR,
+ .event_names = upd_loc_child_vlr_event_names,
+};
+#endif
+
+void vlr_parq_fsm_init(bool is_ps)
+{
+ if (is_ps)
+ parq_fsm_state_tdef = sgsn_parq_tdef_states;
+ else
+ parq_fsm_state_tdef = msc_parq_tdef_states;
+
+ //OSMO_ASSERT(osmo_fsm_register(&upd_loc_child_vlr_fsm) == 0);
+ OSMO_ASSERT(osmo_fsm_register(&proc_arq_vlr_fsm) == 0);
+}
+
+void vlr_parq_fsm_set_log_subsys(int log_subsys)
+{
+ proc_arq_vlr_fsm.log_subsys = log_subsys;
+}
diff --git a/src/libvlr/vlr_access_req_fsm.h b/src/libvlr/vlr_access_req_fsm.h
new file mode 100644
index 0000000..42b2c7e
--- /dev/null
+++ b/src/libvlr/vlr_access_req_fsm.h
@@ -0,0 +1,20 @@
+#pragma once
+
+enum proc_arq_vlr_state {
+ PR_ARQ_S_INIT,
+ /* Waiting for Obtain_Identity_VLR (IMSI) result */
+ PR_ARQ_S_WAIT_OBTAIN_IMSI,
+ /* Waiting for Authenticate_VLR result */
+ PR_ARQ_S_WAIT_AUTH,
+ PR_ARQ_S_WAIT_CIPH,
+ PR_ARQ_S_WAIT_UPD_LOC_CHILD,
+ PR_ARQ_S_WAIT_SUB_PRES,
+ PR_ARQ_S_WAIT_TRACE_SUB,
+ PR_ARQ_S_WAIT_CHECK_IMEI,
+ PR_ARQ_S_WAIT_TMSI_ACK,
+ PR_ARQ_S_WAIT_CECK_CONF,
+ PR_ARQ_S_DONE,
+};
+
+void vlr_parq_fsm_init(bool is_ps);
+void vlr_parq_fsm_set_log_subsys(int log_level);
diff --git a/src/libvlr/vlr_auth_fsm.c b/src/libvlr/vlr_auth_fsm.c
new file mode 100644
index 0000000..63fb04a
--- /dev/null
+++ b/src/libvlr/vlr_auth_fsm.c
@@ -0,0 +1,699 @@
+/* Osmocom Visitor Location Register (VLR) Authentication FSM */
+
+/* (C) 2016 by Harald Welte <laforge(a)gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/tdef.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/vlr/vlr.h>
+
+#include "vlr_core.h"
+#include "vlr_auth_fsm.h"
+
+#define S(x) (1 << (x))
+
+static const struct value_string fsm_auth_event_names[] = {
+ OSMO_VALUE_STRING(VLR_AUTH_E_START),
+ OSMO_VALUE_STRING(VLR_AUTH_E_HLR_SAI_ACK),
+ OSMO_VALUE_STRING(VLR_AUTH_E_HLR_SAI_NACK),
+ OSMO_VALUE_STRING(VLR_AUTH_E_HLR_SAI_ABORT),
+ OSMO_VALUE_STRING(VLR_AUTH_E_MS_AUTH_RESP),
+ OSMO_VALUE_STRING(VLR_AUTH_E_MS_AUTH_FAIL),
+ OSMO_VALUE_STRING(VLR_AUTH_E_MS_ID_IMSI),
+ { 0, NULL }
+};
+
+struct osmo_tdef_state_timeout msc_auth_tdef_states[32] = {
+ [VLR_SUB_AS_WAIT_RESP] = { .T = 3260 },
+ [VLR_SUB_AS_WAIT_RESP_RESYNC] = { .T = 3260 },
+ [VLR_SUB_AS_WAIT_ID_IMSI] = { .T = 3270 },
+};
+
+struct osmo_tdef_state_timeout sgsn_auth_tdef_states[32] = {
+ [VLR_SUB_AS_WAIT_RESP] = { .T = 3360 },
+ [VLR_SUB_AS_WAIT_RESP_RESYNC] = { .T = 3360 },
+ [VLR_SUB_AS_WAIT_ID_IMSI] = { .T = 3370 },
+};
+
+struct osmo_tdef_state_timeout *auth_fsm_state_tdef;
+
+/* private state of the auth_fsm_instance */
+struct auth_fsm_priv {
+ struct vlr_subscr *vsub;
+ bool by_imsi;
+ bool is_r99;
+ bool is_utran;
+ bool auth_requested;
+
+ int auth_tuple_max_reuse_count; /* see vlr->cfg instead */
+
+ uint32_t parent_event_success;
+ uint32_t parent_event_no_auth_info;
+ uint32_t parent_event_failure;
+};
+
+/***********************************************************************
+ * Utility functions
+ ***********************************************************************/
+
+/* Always use either vlr_subscr_get_auth_tuple() or vlr_subscr_has_auth_tuple()
+ * instead, to ensure proper use count.
+ * Return an auth tuple with the lowest use_count among the auth tuples. If
+ * max_reuse_count >= 0, return NULL if all available auth tuples have a use
+ * count > max_reuse_count. If max_reuse_count is negative, return a currently
+ * least used auth tuple without enforcing a maximum use count. If there are
+ * no auth tuples, return NULL.
+ */
+static struct vlr_auth_tuple *
+_vlr_subscr_next_auth_tuple(struct vlr_subscr *vsub, int max_reuse_count)
+{
+ unsigned int count;
+ unsigned int idx;
+ struct vlr_auth_tuple *at = NULL;
+ unsigned int key_seq = VLR_KEY_SEQ_INVAL;
+
+ if (!vsub)
+ return NULL;
+
+ if (vsub->last_tuple)
+ key_seq = vsub->last_tuple->key_seq;
+
+ if (key_seq == VLR_KEY_SEQ_INVAL)
+ /* Start with 0 after increment modulo array size */
+ idx = ARRAY_SIZE(vsub->auth_tuples) - 1;
+ else
+ idx = key_seq;
+
+ for (count = ARRAY_SIZE(vsub->auth_tuples); count > 0; count--) {
+ idx = (idx + 1) % ARRAY_SIZE(vsub->auth_tuples);
+
+ if (vsub->auth_tuples[idx].key_seq == VLR_KEY_SEQ_INVAL)
+ continue;
+
+ if (!at || vsub->auth_tuples[idx].use_count < at->use_count)
+ at = &vsub->auth_tuples[idx];
+ }
+
+ if (!at || (max_reuse_count >= 0 && at->use_count > max_reuse_count))
+ return NULL;
+
+ return at;
+}
+
+/* Return an auth tuple and increment its use count. */
+static struct vlr_auth_tuple *
+vlr_subscr_get_auth_tuple(struct vlr_subscr *vsub, int max_reuse_count)
+{
+ struct vlr_auth_tuple *at = _vlr_subscr_next_auth_tuple(vsub,
+ max_reuse_count);
+ if (!at)
+ return NULL;
+ at->use_count++;
+ return at;
+}
+
+/* Return whether an auth tuple with a matching use_count is available. */
+static bool vlr_subscr_has_auth_tuple(struct vlr_subscr *vsub,
+ int max_reuse_count)
+{
+ return _vlr_subscr_next_auth_tuple(vsub, max_reuse_count) != NULL;
+}
+
+static bool check_auth_resp(struct vlr_subscr *vsub, bool is_r99,
+ bool is_utran, const uint8_t *res,
+ uint8_t res_len)
+{
+ struct vlr_auth_tuple *at = vsub->last_tuple;
+ struct osmo_auth_vector *vec = &at->vec;
+ bool check_umts;
+ bool res_is_umts_aka;
+ OSMO_ASSERT(at);
+
+ LOGVSUBP(LOGL_DEBUG, vsub, "AUTH on %s received %s: %s (%u bytes)\n",
+ is_utran ? "UTRAN" : "GERAN",
+ is_utran ? "RES" : "SRES/RES",
+ osmo_hexdump_nospc(res, res_len), res_len);
+
+ /* RES must be present and at least 32bit */
+ if (!res || !res_len) {
+ LOGVSUBP(LOGL_NOTICE, vsub, "AUTH SRES/RES missing\n");
+ goto out_false;
+ }
+
+ /* We're deciding the UMTS AKA-ness of the response by the RES size. So let's make sure we can't
+ * mix them up by size. On UTRAN, we expect full length RES always, no way to mix up there. */
+ if (!is_utran && vec->res_len == sizeof(vec->sres))
+ LOGVSUBP(LOGL_ERROR, vsub, "Unforeseen situation: UMTS AKA's RES length"
+ " equals the size of SRES: %u -- this code wants to differentiate"
+ " the two by their size, which won't work properly now.\n", vec->res_len);
+
+ /* RES must be either vec->res_len (UMTS AKA) or sizeof(sres) (GSM AKA) */
+ if (res_len == vec->res_len)
+ res_is_umts_aka = true;
+ else if (res_len == sizeof(vec->sres))
+ res_is_umts_aka = false;
+ else {
+ if (is_utran)
+ LOGVSUBP(LOGL_NOTICE, vsub, "AUTH RES has invalid length: %u."
+ " Expected %u (UMTS AKA)\n",
+ res_len, vec->res_len);
+ else
+ LOGVSUBP(LOGL_NOTICE, vsub, "AUTH SRES/RES has invalid length: %u."
+ " Expected either %zu (GSM AKA) or %u (UMTS AKA)\n",
+ res_len, sizeof(vec->sres), vec->res_len);
+ goto out_false;
+ }
+
+ check_umts = (is_r99
+ && (vec->auth_types & OSMO_AUTH_TYPE_UMTS)
+ && res_is_umts_aka);
+
+ /* Even on an R99 capable MS with a UMTS AKA capable USIM,
+ * the MS may still choose to only perform GSM AKA, as
+ * long as the bearer is GERAN -- never on UTRAN: */
+ if (is_utran && !check_umts) {
+ LOGVSUBP(LOGL_ERROR, vsub,
+ "AUTH via UTRAN, cannot allow GSM AKA"
+ " (MS is %sR99 capable, vec has %sUMTS AKA tokens, res_len=%u is %s)\n",
+ is_r99 ? "" : "NOT ",
+ (vec->auth_types & OSMO_AUTH_TYPE_UMTS) ? "" : "NO ",
+ res_len, (res_len == vec->res_len)? "valid" : "INVALID on UTRAN");
+ goto out_false;
+ }
+
+ if (check_umts) {
+ if (res_len != vec->res_len
+ || memcmp(res, vec->res, res_len)) {
+ LOGVSUBP(LOGL_INFO, vsub, "UMTS AUTH failure:"
+ " mismatching res (expected res=%s)\n",
+ osmo_hexdump(vec->res, vec->res_len));
+ goto out_false;
+ }
+
+ LOGVSUBP(LOGL_INFO, vsub, "AUTH established UMTS security"
+ " context\n");
+ vsub->sec_ctx = VLR_SEC_CTX_UMTS;
+ return true;
+ } else {
+ if (res_len != sizeof(vec->sres)
+ || memcmp(res, vec->sres, sizeof(vec->sres))) {
+ LOGVSUBP(LOGL_INFO, vsub, "GSM AUTH failure:"
+ " mismatching sres (expected sres=%s)\n",
+ osmo_hexdump(vec->sres, sizeof(vec->sres)));
+ goto out_false;
+ }
+
+ LOGVSUBP(LOGL_INFO, vsub, "AUTH established GSM security"
+ " context\n");
+ vsub->sec_ctx = VLR_SEC_CTX_GSM;
+ return true;
+ }
+
+out_false:
+ vsub->sec_ctx = VLR_SEC_CTX_NONE;
+ return false;
+}
+
+static void auth_fsm_onenter_failed(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+
+ /* If authentication hasn't even started, e.g. the HLR sent no auth
+ * info, then we also don't need to tell the HLR about an auth failure.
+ */
+ if (afp->auth_requested) {
+ int rc = vlr_subscr_tx_auth_fail_rep(vsub);
+ if (rc < 0)
+ LOGVSUBP(LOGL_ERROR, vsub, "Failed to communicate AUTH failure to HLR\n");
+ }
+}
+
+enum auth_fsm_result {
+ /* Authentication verified the subscriber. */
+ AUTH_FSM_PASSED = 0,
+ /* HLR does not have authentication info for this subscriber. */
+ AUTH_FSM_NO_AUTH_INFO,
+ /* Authentication was attempted but failed. */
+ AUTH_FSM_FAILURE,
+};
+
+const char *auth_fsm_result_str[] = {
+ [AUTH_FSM_PASSED] = "PASSED",
+ [AUTH_FSM_NO_AUTH_INFO] = "NO_AUTH_INFO",
+ [AUTH_FSM_FAILURE] = "FAILURE",
+};
+
+/* Terminate the Auth FSM Instance and notify parent */
+static void auth_fsm_term(struct osmo_fsm_inst *fi, enum auth_fsm_result result, enum gsm48_reject_value cause)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+
+ LOGPFSM(fi, "Authentication terminating with result %s%s%s\n",
+ auth_fsm_result_str[result],
+ cause ? ", cause " : "",
+ cause ? gsm48_reject_value_name(cause) : "");
+
+ /* Do one final state transition (mostly for logging purpose)
+ * and set the parent_term_event according to result */
+ switch (result) {
+ case AUTH_FSM_PASSED:
+ osmo_fsm_inst_state_chg(fi, VLR_SUB_AS_AUTHENTICATED, 0, 0);
+ fi->proc.parent_term_event = afp->parent_event_success;
+ break;
+ case AUTH_FSM_NO_AUTH_INFO:
+ osmo_fsm_inst_state_chg(fi, VLR_SUB_AS_AUTH_FAILED, 0, 0);
+ fi->proc.parent_term_event = afp->parent_event_no_auth_info;
+ break;
+ case AUTH_FSM_FAILURE:
+ osmo_fsm_inst_state_chg(fi, VLR_SUB_AS_AUTH_FAILED, 0, 0);
+ fi->proc.parent_term_event = afp->parent_event_failure;
+ break;
+ }
+
+ /* return the result to the parent FSM */
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, &cause);
+}
+
+static void auth_fsm_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cause)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ vsub->auth_fsm = NULL;
+}
+
+/* back-end function transmitting authentication. Caller ensures we have valid
+ * tuple */
+static int _vlr_subscr_authenticate(struct osmo_fsm_inst *fi)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ struct vlr_auth_tuple *at;
+ bool use_umts_aka;
+
+ /* Caller ensures we have vectors available */
+ at = vlr_subscr_get_auth_tuple(vsub, afp->auth_tuple_max_reuse_count);
+ if (!at) {
+ LOGPFSML(fi, LOGL_ERROR, "A previous check ensured that an"
+ " auth tuple was available, but now there is in fact"
+ " none.\n");
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_NETWORK_FAILURE);
+ return -1;
+ }
+
+ use_umts_aka = vlr_use_umts_aka(&at->vec, afp->is_r99);
+ LOGPFSM(fi, "got auth tuple: use_count=%d key_seq=%d"
+ " -- will use %s AKA (is_r99=%s, at->vec.auth_types=0x%x)\n",
+ at->use_count, at->key_seq,
+ use_umts_aka ? "UMTS" : "GSM", afp->is_r99 ? "yes" : "no", at->vec.auth_types);
+
+ /* Transmit auth req to subscriber */
+ afp->auth_requested = true;
+ vsub->last_tuple = at;
+ vsub->vlr->ops.tx_auth_req(vsub->msc_conn_ref, at, use_umts_aka);
+ return 0;
+}
+
+/***********************************************************************
+ * FSM State Action functions
+ ***********************************************************************/
+
+/* Initial State of TS 23.018 AUT_VLR */
+static void auth_fsm_needs_auth(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+
+ OSMO_ASSERT(event == VLR_AUTH_E_START);
+
+ /* Start off with the default max_reuse_count, possibly change that if we
+ * need to re-use an old tuple. */
+ afp->auth_tuple_max_reuse_count = vsub->vlr->cfg.auth_tuple_max_reuse_count;
+
+ /* Check if we have vectors available */
+ if (!vlr_subscr_has_auth_tuple(vsub, afp->auth_tuple_max_reuse_count)) {
+ /* Obtain_Authentication_Sets_VLR */
+ int rc = vlr_subscr_req_sai(vsub, NULL, NULL);
+ if (rc < 0)
+ LOGPFSM(fi, "Failed to request Authentication Sets from VLR\n");
+ osmo_fsm_inst_state_chg(fi, VLR_SUB_AS_NEEDS_AUTH_WAIT_AI,
+ GSM_29002_TIMER_M, 0);
+ } else {
+ /* go straight ahead with sending auth request */
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_SUB_AS_WAIT_RESP, auth_fsm_state_tdef, vlr_tdefs, -1);
+ _vlr_subscr_authenticate(fi);
+ }
+}
+
+/* Waiting for Authentication Info from HLR */
+static void auth_fsm_wait_ai(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ struct osmo_gsup_message *gsup = data;
+
+ if (event == VLR_AUTH_E_HLR_SAI_NACK)
+ LOGPFSM(fi, "GSUP: rx Auth Info Error cause: %d: %s\n",
+ gsup->cause,
+ get_value_string(gsm48_gmm_cause_names, gsup->cause));
+
+ /* We are in what corresponds to the
+ * Wait_For_Authentication_Sets state of TS 23.018 OAS_VLR */
+ if ((event == VLR_AUTH_E_HLR_SAI_ACK && !gsup->num_auth_vectors)
+ || (event == VLR_AUTH_E_HLR_SAI_NACK &&
+ gsup->cause != GMM_CAUSE_IMSI_UNKNOWN)
+ || (event == VLR_AUTH_E_HLR_SAI_ABORT)) {
+ if (vsub->vlr->cfg.auth_reuse_old_sets_on_error
+ && vlr_subscr_has_auth_tuple(vsub, -1)) {
+ /* To re-use an old tuple, disable the max_reuse_count
+ * constraint. */
+ afp->auth_tuple_max_reuse_count = -1;
+ goto pass;
+ }
+ }
+
+ switch (event) {
+ case VLR_AUTH_E_HLR_SAI_ACK:
+ if (!gsup->num_auth_vectors) {
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+ vlr_subscr_update_tuples(vsub, gsup);
+ goto pass;
+ case VLR_AUTH_E_HLR_SAI_NACK:
+ /* HLR did not return Auth Info, hence cannot authenticate. (The caller may still decide to permit
+ * attaching without authentication) */
+ auth_fsm_term(fi, AUTH_FSM_NO_AUTH_INFO, vlr_gmm_cause_to_reject_cause_domain(gsup->cause, true));
+ break;
+ case VLR_AUTH_E_HLR_SAI_ABORT:
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, vlr_gmm_cause_to_reject_cause_domain(gsup->cause, true));
+ break;
+ }
+
+ return;
+pass:
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_SUB_AS_WAIT_RESP, auth_fsm_state_tdef, vlr_tdefs, -1);
+
+ _vlr_subscr_authenticate(fi);
+}
+
+/* Waiting for Authentication Response from MS */
+static void auth_fsm_wait_auth_resp(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ struct vlr_instance *vlr = vsub->vlr;
+ struct vlr_auth_resp_par *par = data;
+ int rc;
+
+ switch (event) {
+ case VLR_AUTH_E_MS_AUTH_RESP:
+ rc = check_auth_resp(vsub, par->is_r99, par->is_utran,
+ par->res, par->res_len);
+ if (rc == false) {
+ if (!afp->by_imsi) {
+ vlr->ops.tx_id_req(vsub->msc_conn_ref,
+ GSM_MI_TYPE_IMSI);
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_SUB_AS_WAIT_ID_IMSI, auth_fsm_state_tdef, vlr_tdefs, -1);
+ } else {
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_ILLEGAL_MS);
+ }
+ } else {
+ auth_fsm_term(fi, AUTH_FSM_PASSED, 0);
+ }
+ break;
+ case VLR_AUTH_E_MS_AUTH_FAIL:
+ if (par->auts) {
+ /* First failure, start re-sync attempt */
+ rc = vlr_subscr_req_sai(vsub, par->auts,
+ vsub->last_tuple->vec.rand);
+ osmo_fsm_inst_state_chg(fi,
+ VLR_SUB_AS_NEEDS_AUTH_WAIT_SAI_RESYNC,
+ GSM_29002_TIMER_M, 0);
+ } else
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_ILLEGAL_MS);
+ break;
+ }
+}
+
+/* Waiting for Authentication Info from HLR (resync case) */
+static void auth_fsm_wait_ai_resync(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ struct osmo_gsup_message *gsup = data;
+
+ /* We are in what corresponds to the
+ * Wait_For_Authentication_Sets state of TS 23.018 OAS_VLR */
+ if ((event == VLR_AUTH_E_HLR_SAI_ACK && !gsup->num_auth_vectors) ||
+ (event == VLR_AUTH_E_HLR_SAI_NACK &&
+ gsup->cause != GMM_CAUSE_IMSI_UNKNOWN) ||
+ (event == VLR_AUTH_E_HLR_SAI_ABORT)) {
+ /* result = procedure error */
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_NETWORK_FAILURE);
+ }
+ switch (event) {
+ case VLR_AUTH_E_HLR_SAI_ACK:
+ vlr_subscr_update_tuples(vsub, gsup);
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_SUB_AS_WAIT_RESP_RESYNC, auth_fsm_state_tdef, vlr_tdefs, -1);
+ _vlr_subscr_authenticate(fi);
+ break;
+ case VLR_AUTH_E_HLR_SAI_NACK:
+ auth_fsm_term(fi,
+ AUTH_FSM_FAILURE,
+ gsup->cause == GMM_CAUSE_IMSI_UNKNOWN ?
+ GSM48_REJECT_IMSI_UNKNOWN_IN_HLR
+ : GSM48_REJECT_NETWORK_FAILURE);
+ break;
+ }
+}
+
+/* Waiting for AUTH RESP from MS (re-sync case) */
+static void auth_fsm_wait_auth_resp_resync(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ struct vlr_auth_resp_par *par = data;
+ struct vlr_instance *vlr = vsub->vlr;
+ int rc;
+
+ switch (event) {
+ case VLR_AUTH_E_MS_AUTH_RESP:
+ rc = check_auth_resp(vsub, par->is_r99, par->is_utran,
+ par->res, par->res_len);
+ if (rc == false) {
+ if (!afp->by_imsi) {
+ vlr->ops.tx_id_req(vsub->msc_conn_ref,
+ GSM_MI_TYPE_IMSI);
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_SUB_AS_WAIT_ID_IMSI, auth_fsm_state_tdef, vlr_tdefs, -1);
+ } else {
+ /* Result = Aborted */
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_SYNCH_FAILURE);
+ }
+ } else {
+ /* Result = Pass */
+ auth_fsm_term(fi, AUTH_FSM_PASSED, 0);
+ }
+ break;
+ case VLR_AUTH_E_MS_AUTH_FAIL:
+ /* Second failure: Result = Fail */
+ auth_fsm_term(fi, AUTH_FSM_FAILURE, GSM48_REJECT_SYNCH_FAILURE);
+ break;
+ }
+}
+
+/* AUT_VLR waiting for Obtain_IMSI_VLR result */
+static void auth_fsm_wait_imsi(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct auth_fsm_priv *afp = fi->priv;
+ struct vlr_subscr *vsub = afp->vsub;
+ const char *mi_string = data;
+
+ switch (event) {
+ case VLR_AUTH_E_MS_ID_IMSI:
+ if (vsub->imsi[0]
+ && !vlr_subscr_matches_imsi(vsub, mi_string)) {
+ LOGVSUBP(LOGL_ERROR, vsub, "IMSI in ID RESP differs:"
+ " %s\n", mi_string);
+ } else {
+ strncpy(vsub->imsi, mi_string, sizeof(vsub->imsi));
+ vsub->imsi[sizeof(vsub->imsi)-1] = '\0';
+ }
+ /* retry with identity=IMSI */
+ afp->by_imsi = true;
+ osmo_fsm_inst_state_chg(fi, VLR_SUB_AS_NEEDS_AUTH, 0, 0);
+ osmo_fsm_inst_dispatch(fi, VLR_AUTH_E_START, NULL);
+ break;
+ }
+}
+
+static const struct osmo_fsm_state auth_fsm_states[] = {
+ [VLR_SUB_AS_NEEDS_AUTH] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_NEEDS_AUTH),
+ .in_event_mask = S(VLR_AUTH_E_START),
+ .out_state_mask = S(VLR_SUB_AS_NEEDS_AUTH_WAIT_AI) |
+ S(VLR_SUB_AS_WAIT_RESP),
+ .action = auth_fsm_needs_auth,
+ },
+ [VLR_SUB_AS_NEEDS_AUTH_WAIT_AI] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_NEEDS_AUTH_WAIT_AI),
+ .in_event_mask = S(VLR_AUTH_E_HLR_SAI_ACK) |
+ S(VLR_AUTH_E_HLR_SAI_NACK),
+ .out_state_mask = S(VLR_SUB_AS_AUTH_FAILED) |
+ S(VLR_SUB_AS_WAIT_RESP),
+ .action = auth_fsm_wait_ai,
+ },
+ [VLR_SUB_AS_WAIT_RESP] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_WAIT_RESP),
+ .in_event_mask = S(VLR_AUTH_E_MS_AUTH_RESP) |
+ S(VLR_AUTH_E_MS_AUTH_FAIL),
+ .out_state_mask = S(VLR_SUB_AS_WAIT_ID_IMSI) |
+ S(VLR_SUB_AS_AUTH_FAILED) |
+ S(VLR_SUB_AS_AUTHENTICATED) |
+ S(VLR_SUB_AS_NEEDS_AUTH_WAIT_SAI_RESYNC),
+ .action = auth_fsm_wait_auth_resp,
+ },
+ [VLR_SUB_AS_NEEDS_AUTH_WAIT_SAI_RESYNC] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_NEEDS_AUTH_WAIT_SAI_RESYNC),
+ .in_event_mask = S(VLR_AUTH_E_HLR_SAI_ACK) |
+ S(VLR_AUTH_E_HLR_SAI_NACK),
+ .out_state_mask = S(VLR_SUB_AS_AUTH_FAILED) |
+ S(VLR_SUB_AS_WAIT_RESP_RESYNC),
+ .action = auth_fsm_wait_ai_resync,
+ },
+ [VLR_SUB_AS_WAIT_RESP_RESYNC] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_WAIT_RESP_RESYNC),
+ .in_event_mask = S(VLR_AUTH_E_MS_AUTH_RESP) |
+ S(VLR_AUTH_E_MS_AUTH_FAIL),
+ .out_state_mask = S(VLR_SUB_AS_AUTH_FAILED) |
+ S(VLR_SUB_AS_AUTHENTICATED),
+ .action = auth_fsm_wait_auth_resp_resync,
+ },
+ [VLR_SUB_AS_WAIT_ID_IMSI] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_WAIT_ID_IMSI),
+ .in_event_mask = S(VLR_AUTH_E_MS_ID_IMSI),
+ .out_state_mask = S(VLR_SUB_AS_NEEDS_AUTH),
+ .action = auth_fsm_wait_imsi,
+ },
+ [VLR_SUB_AS_AUTHENTICATED] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_AUTHENTICATED),
+ .in_event_mask = 0,
+ .out_state_mask = 0,
+ },
+ [VLR_SUB_AS_AUTH_FAILED] = {
+ .name = OSMO_STRINGIFY(VLR_SUB_AS_AUTH_FAILED),
+ .in_event_mask = 0,
+ .out_state_mask = 0,
+ .onenter = auth_fsm_onenter_failed,
+ },
+};
+
+static struct osmo_fsm vlr_auth_fsm = {
+ .name = "VLR_Authenticate",
+ .states = auth_fsm_states,
+ .num_states = ARRAY_SIZE(auth_fsm_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = fsm_auth_event_names,
+ .cleanup = auth_fsm_cleanup,
+};
+
+void vlr_auth_fsm_init(bool is_ps)
+{
+ if (is_ps)
+ auth_fsm_state_tdef = sgsn_auth_tdef_states;
+ else
+ auth_fsm_state_tdef = msc_auth_tdef_states;
+
+ OSMO_ASSERT(osmo_fsm_register(&vlr_auth_fsm) == 0);
+}
+
+void vlr_auth_fsm_set_log_subsys(int log_level)
+{
+ vlr_auth_fsm.log_subsys = log_level;
+}
+
+/***********************************************************************
+ * User API (for SGSN/MSC code)
+ ***********************************************************************/
+
+/* MSC->VLR: Start Procedure Authenticate_VLR (TS 23.012 Ch. 4.1.2.2) */
+struct osmo_fsm_inst *auth_fsm_start(struct vlr_subscr *vsub,
+ struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_no_auth_info,
+ uint32_t parent_event_failure,
+ bool is_r99,
+ bool is_utran)
+{
+ struct osmo_fsm_inst *fi;
+ struct auth_fsm_priv *afp;
+
+ fi = osmo_fsm_inst_alloc_child(&vlr_auth_fsm, parent, parent_event_failure);
+ if (!fi) {
+ osmo_fsm_inst_dispatch(parent, parent_event_failure, 0);
+ return NULL;
+ }
+
+ afp = talloc_zero(fi, struct auth_fsm_priv);
+ if (!afp) {
+ osmo_fsm_inst_dispatch(parent, parent_event_failure, 0);
+ return NULL;
+ }
+
+ afp->vsub = vsub;
+ if (vsub->imsi[0])
+ afp->by_imsi = true;
+ afp->is_r99 = is_r99;
+ afp->is_utran = is_utran;
+ afp->parent_event_success = parent_event_success;
+ afp->parent_event_no_auth_info = parent_event_no_auth_info;
+ afp->parent_event_failure = parent_event_failure;
+ fi->priv = afp;
+ vsub->auth_fsm = fi;
+
+ osmo_fsm_inst_dispatch(fi, VLR_AUTH_E_START, NULL);
+
+ return fi;
+}
+
+bool auth_try_reuse_tuple(struct vlr_subscr *vsub, uint8_t key_seq)
+{
+ int max_reuse_count = vsub->vlr->cfg.auth_tuple_max_reuse_count;
+ struct vlr_auth_tuple *at = vsub->last_tuple;
+
+ if (!at)
+ return false;
+ if ((max_reuse_count >= 0) && (at->use_count > max_reuse_count))
+ return false;
+ if (at->key_seq != key_seq)
+ return false;
+ at->use_count++;
+ return true;
+}
+
diff --git a/src/libvlr/vlr_auth_fsm.h b/src/libvlr/vlr_auth_fsm.h
new file mode 100644
index 0000000..1cb25b6
--- /dev/null
+++ b/src/libvlr/vlr_auth_fsm.h
@@ -0,0 +1,42 @@
+#pragma once
+
+#include <osmocom/core/utils.h>
+
+struct vlr_subscr;
+
+/* Parameters to VLR_AUTH_E_MS_AUTH_RESP */
+struct vlr_auth_resp_par {
+ bool is_r99;
+ bool is_utran;
+ const uint8_t *res;
+ unsigned int res_len;
+ const uint8_t *auts;
+};
+
+enum vlr_fsm_auth_event {
+ VLR_AUTH_E_START,
+ /* TS 23.018 OAS_VLR1(2): SendAuthInfo ACK from HLR */
+ VLR_AUTH_E_HLR_SAI_ACK,
+ /* TS 23.018 OAS_VLR1(2): SendAuthInfo NACK from HLR */
+ VLR_AUTH_E_HLR_SAI_NACK,
+ /* FIXME: merge with NACK? */
+ VLR_AUTH_E_HLR_SAI_ABORT,
+ /* Authentication Response from MS */
+ VLR_AUTH_E_MS_AUTH_RESP,
+ /* Authentication Failure from MS */
+ VLR_AUTH_E_MS_AUTH_FAIL,
+ /* Identity Response (IMSI) from MS */
+ VLR_AUTH_E_MS_ID_IMSI,
+};
+
+struct osmo_fsm_inst *auth_fsm_start(struct vlr_subscr *vsub,
+ struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_no_auth_info,
+ uint32_t parent_event_failure,
+ bool is_r99,
+ bool is_utran);
+
+void vlr_auth_fsm_init(bool is_ps);
+void vlr_auth_fsm_set_log_subsys(int log_level);
+bool auth_try_reuse_tuple(struct vlr_subscr *vsub, uint8_t key_seq);
diff --git a/src/libvlr/vlr_core.h b/src/libvlr/vlr_core.h
new file mode 100644
index 0000000..59c2cd1
--- /dev/null
+++ b/src/libvlr/vlr_core.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <osmocom/vlr/vlr.h>
+
+struct osmo_gsup_message;
+
+int vlr_subscr_req_lu(struct vlr_subscr *vsub) __attribute__((warn_unused_result));
+int vlr_subscr_req_sai(struct vlr_subscr *vsub, const uint8_t *auts,
+ const uint8_t *auts_rand) __attribute__((warn_unused_result));
+int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub);
+void vlr_subscr_update_tuples(struct vlr_subscr *vsub,
+ const struct osmo_gsup_message *gsup);
+
+/* Logging */
+extern int g_vlr_log_cat[_OSMO_VLR_LOGC_MAX];
+
+#define LOGVLR(lvl, fmt, args...) LOGP(g_vlr_log_cat[OSMO_VLR_LOGC_VLR], lvl, fmt, ## args)
+#define LOGSGS(lvl, fmt, args...) LOGP(g_vlr_log_cat[OSMO_VLR_LOGC_SGS], lvl, fmt, ## args)
+
+#define LOGGSUPP(level, gsup, fmt, args...) \
+ LOGVLR(level, "GSUP(%s) " fmt, (gsup)->imsi, ## args)
+
+#define LOGVSUBP(level, vsub, fmt, args...) \
+ LOGVLR(level, "SUBSCR(%s) " fmt, vlr_subscr_name(vsub), ## args)
+
diff --git a/src/libvlr/vlr_logging.c b/src/libvlr/vlr_logging.c
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/src/libvlr/vlr_logging.c
diff --git a/src/libvlr/vlr_lu_fsm.c b/src/libvlr/vlr_lu_fsm.c
new file mode 100644
index 0000000..4bbbbbe
--- /dev/null
+++ b/src/libvlr/vlr_lu_fsm.c
@@ -0,0 +1,1850 @@
+/* Osmocom Visitor Location Register (VLR): Location Update FSMs */
+
+/* (C) 2016 by Harald Welte <laforge(a)gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/tdef.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/vlr/vlr.h>
+
+#include "vlr_core.h"
+#include "vlr_auth_fsm.h"
+#include "vlr_lu_fsm.h"
+#include "vlr_sgs_fsm.h"
+
+#define S(x) (1 << (x))
+
+#define LU_TIMEOUT_LONG 30
+
+enum vlr_fsm_result {
+ VLR_FSM_RESULT_NONE,
+ VLR_FSM_RESULT_SUCCESS,
+ VLR_FSM_RESULT_FAILURE,
+};
+
+
+/***********************************************************************
+ * Update_HLR_VLR, TS 23.012 Chapter 4.1.2.4
+ ***********************************************************************/
+
+enum upd_hlr_vlr_state {
+ UPD_HLR_VLR_S_INIT,
+ UPD_HLR_VLR_S_WAIT_FOR_DATA,
+ UPD_HLR_VLR_S_DONE,
+};
+
+enum upd_hlr_vlr_evt {
+ UPD_HLR_VLR_E_START,
+ UPD_HLR_VLR_E_INS_SUB_DATA,
+ UPD_HLR_VLR_E_ACT_TRACE_MODE,
+ UPD_HLR_VLR_E_FW_CHECK_SS_IND,
+ UPD_HLR_VLR_E_UPD_LOC_ACK,
+ UPD_HLR_VLR_E_UPD_LOC_NACK,
+};
+
+static const struct value_string upd_hlr_vlr_event_names[] = {
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_START),
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_INS_SUB_DATA),
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_ACT_TRACE_MODE),
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_FW_CHECK_SS_IND),
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_UPD_LOC_ACK),
+ OSMO_VALUE_STRING(UPD_HLR_VLR_E_UPD_LOC_NACK),
+ { 0, NULL }
+};
+
+static inline struct vlr_subscr *upd_hlr_vlr_fi_priv(struct osmo_fsm_inst *fi);
+
+static void upd_hlr_vlr_fsm_init(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct vlr_subscr *vsub = upd_hlr_vlr_fi_priv(fi);
+ int rc;
+
+ OSMO_ASSERT(event == UPD_HLR_VLR_E_START);
+
+ /* Send UpdateLocation to HLR */
+ rc = vlr_subscr_req_lu(vsub);
+ if (rc < 0)
+ LOGPFSML(fi, LOGL_ERROR, "Failed to send UpdateLocation to HLR\n");
+ osmo_fsm_inst_state_chg(fi, UPD_HLR_VLR_S_WAIT_FOR_DATA,
+ LU_TIMEOUT_LONG, 0);
+}
+
+static void upd_hlr_vlr_fsm_wait_data(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct vlr_subscr *vsub = upd_hlr_vlr_fi_priv(fi);
+
+ switch (event) {
+ case UPD_HLR_VLR_E_INS_SUB_DATA:
+ /* FIXME: Insert_Subscr_Data_VLR */
+ break;
+ case UPD_HLR_VLR_E_ACT_TRACE_MODE:
+ /* TODO: Activate_Tracing_VLR */
+ break;
+ case UPD_HLR_VLR_E_FW_CHECK_SS_IND:
+ /* TODO: Forward Check SS Ind to MSC */
+ break;
+ case UPD_HLR_VLR_E_UPD_LOC_ACK:
+ /* Inside Update_HLR_VLR after UpdateLocationAck */
+ vsub->sub_dataconf_by_hlr_ind = true;
+ vsub->loc_conf_in_hlr_ind = true;
+ osmo_fsm_inst_state_chg(fi, UPD_HLR_VLR_S_DONE, 0, 0);
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+ break;
+ case UPD_HLR_VLR_E_UPD_LOC_NACK:
+ /* Inside Update_HLR_VLR after UpdateLocationNack */
+ /* TODO: Check_User_Error_In_Serving_Network_Entity */
+ vsub->sub_dataconf_by_hlr_ind = false;
+ vsub->loc_conf_in_hlr_ind = false;
+ osmo_fsm_inst_state_chg(fi, UPD_HLR_VLR_S_DONE, 0, 0);
+ /* Data is a pointer to a gsm48_gmm_cause which we
+ * simply pass through */
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, data);
+ break;
+ }
+}
+
+static const struct osmo_fsm_state upd_hlr_vlr_states[] = {
+ [UPD_HLR_VLR_S_INIT] = {
+ .in_event_mask = S(UPD_HLR_VLR_E_START),
+ .out_state_mask = S(UPD_HLR_VLR_S_WAIT_FOR_DATA),
+ .name = OSMO_STRINGIFY(UPD_HLR_VLR_S_INIT),
+ .action = upd_hlr_vlr_fsm_init,
+ },
+ [UPD_HLR_VLR_S_WAIT_FOR_DATA] = {
+ .in_event_mask = S(UPD_HLR_VLR_E_INS_SUB_DATA) |
+ S(UPD_HLR_VLR_E_ACT_TRACE_MODE) |
+ S(UPD_HLR_VLR_E_FW_CHECK_SS_IND) |
+ S(UPD_HLR_VLR_E_UPD_LOC_ACK) |
+ S(UPD_HLR_VLR_E_UPD_LOC_NACK),
+ .out_state_mask = S(UPD_HLR_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(UPD_HLR_VLR_S_WAIT_FOR_DATA),
+ .action = upd_hlr_vlr_fsm_wait_data,
+ },
+ [UPD_HLR_VLR_S_DONE] = {
+ .name = OSMO_STRINGIFY(UPD_HLR_VLR_S_DONE),
+ },
+};
+
+static struct osmo_fsm upd_hlr_vlr_fsm = {
+ .name = "upd_hlr_vlr_fsm",
+ .states = upd_hlr_vlr_states,
+ .num_states = ARRAY_SIZE(upd_hlr_vlr_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = upd_hlr_vlr_event_names,
+};
+
+static inline struct vlr_subscr *upd_hlr_vlr_fi_priv(struct osmo_fsm_inst *fi)
+{
+ OSMO_ASSERT(fi->fsm == &upd_hlr_vlr_fsm);
+ return (struct vlr_subscr*)fi->priv;
+}
+
+struct osmo_fsm_inst *
+upd_hlr_vlr_proc_start(struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ uint32_t parent_event)
+{
+ struct osmo_fsm_inst *fi;
+
+ fi = osmo_fsm_inst_alloc_child(&upd_hlr_vlr_fsm, parent,
+ parent_event);
+ if (!fi)
+ return NULL;
+
+ fi->priv = vsub;
+ osmo_fsm_inst_dispatch(fi, UPD_HLR_VLR_E_START, NULL);
+
+ return fi;
+}
+
+
+/***********************************************************************
+ * Subscriber_Present_VLR, TS 29.002 Chapter 25.10.1
+ ***********************************************************************/
+
+enum sub_pres_vlr_state {
+ SUB_PRES_VLR_S_INIT,
+ SUB_PRES_VLR_S_WAIT_FOR_HLR,
+ SUB_PRES_VLR_S_DONE,
+};
+
+enum sub_pres_vlr_event {
+ SUB_PRES_VLR_E_START,
+ SUB_PRES_VLR_E_READY_SM_CNF,
+ SUB_PRES_VLR_E_READY_SM_ERR,
+};
+
+static const struct value_string sub_pres_vlr_event_names[] = {
+ OSMO_VALUE_STRING(SUB_PRES_VLR_E_START),
+ OSMO_VALUE_STRING(SUB_PRES_VLR_E_READY_SM_CNF),
+ OSMO_VALUE_STRING(SUB_PRES_VLR_E_READY_SM_ERR),
+ { 0, NULL }
+};
+
+static inline struct vlr_subscr *sub_pres_vlr_fi_priv(struct osmo_fsm_inst *fi);
+
+static void sub_pres_vlr_fsm_init(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct vlr_subscr *vsub = sub_pres_vlr_fi_priv(fi);
+ OSMO_ASSERT(event == SUB_PRES_VLR_E_START);
+
+ if (!vsub->ms_not_reachable_flag) {
+ osmo_fsm_inst_state_chg(fi, SUB_PRES_VLR_S_DONE, 0, 0);
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+ return;
+ }
+ /* FIXME: Send READY_FOR_SM via GSUP */
+ osmo_fsm_inst_state_chg(fi, SUB_PRES_VLR_S_WAIT_FOR_HLR,
+ LU_TIMEOUT_LONG, 0);
+}
+
+static void sub_pres_vlr_fsm_wait_hlr(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct vlr_subscr *vsub = sub_pres_vlr_fi_priv(fi);
+
+ switch (event) {
+ case SUB_PRES_VLR_E_READY_SM_CNF:
+ vsub->ms_not_reachable_flag = false;
+ break;
+ case SUB_PRES_VLR_E_READY_SM_ERR:
+ break;
+ }
+ osmo_fsm_inst_state_chg(fi, SUB_PRES_VLR_S_DONE, 0, 0);
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+}
+
+static const struct osmo_fsm_state sub_pres_vlr_states[] = {
+ [SUB_PRES_VLR_S_INIT] = {
+ .in_event_mask = S(SUB_PRES_VLR_E_START),
+ .out_state_mask = S(SUB_PRES_VLR_S_WAIT_FOR_HLR) |
+ S(SUB_PRES_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(SUB_PRES_VLR_S_INIT),
+ .action = sub_pres_vlr_fsm_init,
+ },
+ [SUB_PRES_VLR_S_WAIT_FOR_HLR] = {
+ .in_event_mask = S(SUB_PRES_VLR_E_READY_SM_CNF) |
+ S(SUB_PRES_VLR_E_READY_SM_ERR),
+ .out_state_mask = S(SUB_PRES_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(SUB_PRES_VLR_S_WAIT_FOR_HLR),
+ .action = sub_pres_vlr_fsm_wait_hlr,
+ },
+ [SUB_PRES_VLR_S_DONE] = {
+ .name = OSMO_STRINGIFY(SUB_PRES_VLR_S_DONE),
+ },
+};
+
+static struct osmo_fsm sub_pres_vlr_fsm = {
+ .name = "sub_pres_vlr_fsm",
+ .states = sub_pres_vlr_states,
+ .num_states = ARRAY_SIZE(sub_pres_vlr_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = sub_pres_vlr_event_names,
+};
+
+static inline struct vlr_subscr *sub_pres_vlr_fi_priv(struct osmo_fsm_inst *fi)
+{
+ OSMO_ASSERT(fi->fsm == &sub_pres_vlr_fsm);
+ return (struct vlr_subscr*)fi->priv;
+}
+
+/* THIS IS CURRENTLY DEAD CODE, SINCE WE NEVER SET vsub->ms_not_reachable_flag = true.
+ *
+ * Note that the start event is dispatched right away, so in case the FSM immediately concludes from that
+ * event, the created FSM struct may no longer be valid as it already deallocated again, and it may
+ * furthermore already have invoked the parent FSM instance's deallocation as well. Hence, instead of
+ * returning, store the created FSM instance address in *fi_p before dispatching the event. It is thus
+ * possible to store the instance's pointer in a parent FSM instance without running danger of using
+ * already freed memory. */
+void sub_pres_vlr_fsm_start(struct osmo_fsm_inst **fi_p,
+ struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ uint32_t term_event)
+{
+ struct osmo_fsm_inst *fi;
+
+ OSMO_ASSERT(fi_p);
+
+ fi = osmo_fsm_inst_alloc_child(&sub_pres_vlr_fsm, parent,
+ term_event);
+ *fi_p = fi;
+ if (!fi)
+ return;
+
+ fi->priv = vsub;
+ osmo_fsm_inst_dispatch(fi, SUB_PRES_VLR_E_START, NULL);
+}
+
+/***********************************************************************
+ * Location_Update_Completion_VLR, TS 23.012 Chapter 4.1.2.3
+ ***********************************************************************/
+
+enum lu_compl_vlr_state {
+ LU_COMPL_VLR_S_INIT,
+ LU_COMPL_VLR_S_WAIT_SUB_PRES,
+ LU_COMPL_VLR_S_WAIT_IMEI,
+ LU_COMPL_VLR_S_WAIT_IMEI_TMSI,
+ LU_COMPL_VLR_S_WAIT_TMSI_CNF,
+ LU_COMPL_VLR_S_DONE,
+};
+
+enum lu_compl_vlr_event {
+ LU_COMPL_VLR_E_START,
+ LU_COMPL_VLR_E_SUB_PRES_COMPL,
+ LU_COMPL_VLR_E_IMEI_CHECK_ACK,
+ LU_COMPL_VLR_E_IMEI_CHECK_NACK,
+ LU_COMPL_VLR_E_NEW_TMSI_ACK,
+};
+
+static const struct value_string lu_compl_vlr_event_names[] = {
+ OSMO_VALUE_STRING(LU_COMPL_VLR_E_START),
+ OSMO_VALUE_STRING(LU_COMPL_VLR_E_SUB_PRES_COMPL),
+ OSMO_VALUE_STRING(LU_COMPL_VLR_E_IMEI_CHECK_ACK),
+ OSMO_VALUE_STRING(LU_COMPL_VLR_E_IMEI_CHECK_NACK),
+ OSMO_VALUE_STRING(LU_COMPL_VLR_E_NEW_TMSI_ACK),
+ { 0, NULL }
+};
+
+struct osmo_tdef_state_timeout msc_lu_compl_tdef_states[32] = {
+ [LU_COMPL_VLR_S_WAIT_IMEI] = { .T = 3270 },
+ [LU_COMPL_VLR_S_WAIT_IMEI_TMSI] = { .T = 3270 },
+ [LU_COMPL_VLR_S_WAIT_TMSI_CNF] = { .T = 3250 },
+};
+
+struct osmo_tdef_state_timeout sgsn_lu_compl_tdef_states[32] = {
+ [LU_COMPL_VLR_S_WAIT_IMEI] = { .T = 3370 },
+ [LU_COMPL_VLR_S_WAIT_IMEI_TMSI] = { .T = 3370 },
+ [LU_COMPL_VLR_S_WAIT_TMSI_CNF] = { .T = 3350 },
+};
+
+struct osmo_tdef_state_timeout *lu_compl_fsm_state_tdef;
+
+struct lu_compl_vlr_priv {
+ struct vlr_subscr *vsub;
+ void *msc_conn_ref;
+ struct osmo_fsm_inst *sub_pres_vlr_fsm;
+ uint32_t parent_event_success;
+ uint32_t parent_event_failure;
+ void *parent_event_data;
+ enum vlr_fsm_result result;
+ uint8_t cause;
+ bool assign_tmsi;
+ enum vlr_lu_type lu_type;
+ int N; /*< counter of timeouts */
+};
+
+static inline struct lu_compl_vlr_priv *lu_compl_vlr_fi_priv(struct osmo_fsm_inst *fi);
+
+static void _vlr_lu_compl_fsm_done(struct osmo_fsm_inst *fi,
+ enum vlr_fsm_result result,
+ uint8_t cause)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ lcvp->result = result;
+ lcvp->cause = cause;
+ osmo_fsm_inst_state_chg(fi, LU_COMPL_VLR_S_DONE, 0, 0);
+}
+
+static void vlr_lu_compl_fsm_success(struct osmo_fsm_inst *fi)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+ if (!vsub->lu_complete) {
+ vsub->lu_complete = true;
+ /* Balanced by vlr_subscr_expire() */
+ vlr_subscr_get(vsub, VSUB_USE_ATTACHED);
+ }
+ _vlr_lu_compl_fsm_done(fi, VLR_FSM_RESULT_SUCCESS, 0);
+ vlr_sgs_fsm_update_id(vsub);
+}
+
+static void vlr_lu_compl_fsm_dispatch_result(struct osmo_fsm_inst *fi,
+ uint32_t prev_state)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ if (!fi->proc.parent) {
+ LOGPFSML(fi, LOGL_ERROR, "No parent FSM\n");
+ return;
+ }
+ osmo_fsm_inst_dispatch(fi->proc.parent,
+ (lcvp->result == VLR_FSM_RESULT_SUCCESS)
+ ? lcvp->parent_event_success
+ : lcvp->parent_event_failure,
+ &lcvp->cause);
+}
+
+static void lu_compl_vlr_init(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+ struct vlr_instance *vlr;
+ OSMO_ASSERT(vsub);
+ vlr = vsub->vlr;
+ OSMO_ASSERT(vlr);
+
+ OSMO_ASSERT(event == LU_COMPL_VLR_E_START);
+ lcvp->N = 0;
+
+ /* TODO: National Roaming restrictions? */
+ /* TODO: Roaming restriction due to unsupported feature in subscriber
+ * data? */
+ /* TODO: Regional subscription restriction? */
+ /* TODO: Administrative restriction of subscribres' access feature? */
+ /* TODO: AccessRestrictuionData parameter available? */
+ /* TODO: AccessRestrictionData permits RAT? */
+ /* Node 1 */
+ /* TODO: Autonomous CSG supported in VPLMN and allowed by HPLMN? */
+ /* TODO: Hybrid Cel / CSG Cell */
+ /* Node 2 */
+ vsub->la_allowed = true;
+ vsub->imsi_detached_flag = false;
+ /* Start Subscriber_Present_VLR Procedure */
+ osmo_fsm_inst_state_chg(fi, LU_COMPL_VLR_S_WAIT_SUB_PRES,
+ LU_TIMEOUT_LONG, 0);
+
+ /* If ms_not_reachable_flag == false, the sub_pres_vlr_fsm will anyway terminate straight away and dispatch
+ * LU_COMPL_VLR_E_SUB_PRES_COMPL to this fi, so we might as well skip that dance here and save some logging. */
+ if (vsub->ms_not_reachable_flag)
+ sub_pres_vlr_fsm_start(&lcvp->sub_pres_vlr_fsm, fi, vsub, LU_COMPL_VLR_E_SUB_PRES_COMPL);
+ else
+ osmo_fsm_inst_dispatch(fi, LU_COMPL_VLR_E_SUB_PRES_COMPL, NULL);
+}
+
+static void lu_compl_vlr_new_tmsi(struct osmo_fsm_inst *fi)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+ struct vlr_instance *vlr = vsub->vlr;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ if (vlr_subscr_alloc_tmsi(vsub)) {
+ _vlr_lu_compl_fsm_done(fi, VLR_FSM_RESULT_FAILURE, GSM48_REJECT_SRV_OPT_TMP_OUT_OF_ORDER);
+ return;
+ }
+
+ osmo_tdef_fsm_inst_state_chg(fi, LU_COMPL_VLR_S_WAIT_TMSI_CNF, lu_compl_fsm_state_tdef, vlr_tdefs, -1);
+
+ vlr->ops.tx_lu_acc(lcvp->msc_conn_ref, vsub->tmsi_new, lcvp->lu_type);
+}
+
+/* After completion of Subscriber_Present_VLR */
+static void lu_compl_vlr_wait_subscr_pres(struct osmo_fsm_inst *fi,
+ uint32_t event,
+ void *data)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+ struct vlr_instance *vlr = vsub->vlr;
+
+ OSMO_ASSERT(event == LU_COMPL_VLR_E_SUB_PRES_COMPL);
+
+ lcvp->sub_pres_vlr_fsm = NULL;
+
+ /* TODO: Trace_Subscriber_Activity_VLR */
+
+ /* If imeisv_early is enabled: IMEI already retrieved and checked (vlr_loc_upd_node1_pre), don't do it again. */
+ if (vlr->cfg.check_imei_rqd && !vlr->cfg.retrieve_imeisv_early) {
+ /* Check IMEI VLR */
+ osmo_tdef_fsm_inst_state_chg(fi,
+ lcvp->assign_tmsi ?
+ LU_COMPL_VLR_S_WAIT_IMEI_TMSI
+ : LU_COMPL_VLR_S_WAIT_IMEI,
+ lu_compl_fsm_state_tdef, vlr_tdefs, -1);
+ vlr->ops.tx_id_req(lcvp->msc_conn_ref, GSM_MI_TYPE_IMEI);
+ return;
+ }
+
+ /* Do we need to allocate a TMSI? */
+ if (lcvp->assign_tmsi) {
+ lu_compl_vlr_new_tmsi(fi);
+ return;
+ }
+ /* else, any previously used TMSI is now invalid. */
+ vsub->tmsi = GSM_RESERVED_TMSI;
+
+ /* Location Updating Accept */
+ vlr->ops.tx_lu_acc(lcvp->msc_conn_ref, GSM_RESERVED_TMSI, lcvp->lu_type);
+ vlr_lu_compl_fsm_success(fi);
+}
+
+/* Waiting for completion of CHECK_IMEI_VLR */
+static void lu_compl_vlr_wait_imei(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+ struct vlr_instance *vlr = vsub->vlr;
+
+ switch (event) {
+ case LU_COMPL_VLR_E_IMEI_CHECK_ACK:
+ if (!vsub->imei[0]) {
+ /* Abort: Do nothing */
+ _vlr_lu_compl_fsm_done(fi, VLR_FSM_RESULT_FAILURE, GSM48_REJECT_PROTOCOL_ERROR);
+ return;
+ }
+ /* Pass */
+ break;
+
+ case LU_COMPL_VLR_E_IMEI_CHECK_NACK:
+ _vlr_lu_compl_fsm_done(fi, VLR_FSM_RESULT_FAILURE, GSM48_REJECT_ILLEGAL_ME);
+ /* FIXME: IMEI Check Fail to VLR Application (Detach IMSI VLR) */
+ return;
+ }
+
+ /* IMEI is available. Allocate TMSI if needed. */
+ if (lcvp->assign_tmsi) {
+ if (fi->state != LU_COMPL_VLR_S_WAIT_IMEI_TMSI)
+ LOGPFSML(fi, LOGL_ERROR,
+ "TMSI required, expected to be in state"
+ " LU_COMPL_VLR_S_WAIT_IMEI_TMSI,"
+ " am in %s instead\n",
+ osmo_fsm_state_name(fi->fsm, fi->state));
+ /* Logged an error, continue anyway. */
+
+ lu_compl_vlr_new_tmsi(fi);
+
+ /* Wait for TMSI ack */
+ return;
+ }
+ /* else, any previously used TMSI is now invalid. */
+ vsub->tmsi = GSM_RESERVED_TMSI;
+
+ /* No TMSI needed, accept now. */
+ vlr->ops.tx_lu_acc(lcvp->msc_conn_ref, GSM_RESERVED_TMSI, lcvp->lu_type);
+ vlr_lu_compl_fsm_success(fi);
+}
+
+static inline struct lu_compl_vlr_priv *lu_compl_vlr_fi_priv(struct osmo_fsm_inst *fi);
+
+/* Waiting for TMSI confirmation */
+static void lu_compl_vlr_wait_tmsi(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_subscr *vsub = lcvp->vsub;
+
+ OSMO_ASSERT(event == LU_COMPL_VLR_E_NEW_TMSI_ACK);
+
+ if (!vsub || vsub->tmsi_new == GSM_RESERVED_TMSI) {
+ LOGPFSML(fi, LOGL_ERROR, "TMSI Realloc Compl implies that"
+ " the subscriber has a new TMSI allocated, but"
+ " the new TMSI is unset.\n");
+ _vlr_lu_compl_fsm_done(fi, VLR_FSM_RESULT_FAILURE, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ vsub->tmsi = vsub->tmsi_new;
+ vsub->tmsi_new = GSM_RESERVED_TMSI;
+ vsub->vlr->ops.subscr_update(vsub);
+
+ vlr_lu_compl_fsm_success(fi);
+}
+
+static void vlr_lu_compl_fsm_reset_n(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ lcvp->N = 0;
+}
+
+static int lu_compl_vlr_timeout(struct osmo_fsm_inst *fi)
+{
+ struct lu_compl_vlr_priv *lcvp = lu_compl_vlr_fi_priv(fi);
+ struct vlr_instance *vlr = lcvp->vsub->vlr;
+ struct vlr_subscr *vsub = lcvp->vsub;
+
+ /* on cs: terminate the FSM */
+ if (vlr_is_cs(lcvp->vsub->vlr))
+ return 1;
+
+ /* PS: we have to resend the complete message 5x times, before failing */
+ if (++lcvp->N >= 5)
+ return 1;
+
+ LOGPFSML(fi, LOGL_ERROR, "LU Compl timeout T%d / N%d\n", fi->T, lcvp->N);
+
+ switch (fi->state) {
+ case LU_COMPL_VLR_S_WAIT_IMEI:
+ case LU_COMPL_VLR_S_WAIT_IMEI_TMSI:
+ vlr->ops.tx_id_req(lcvp->msc_conn_ref, GSM_MI_TYPE_IMEI);
+ break;
+ case LU_COMPL_VLR_S_WAIT_TMSI_CNF:
+ vlr->ops.tx_lu_acc(lcvp->msc_conn_ref, vsub->tmsi_new, lcvp->lu_type);
+ break;
+ }
+
+ osmo_timer_schedule(&fi->timer, vlr_timer_secs(vlr, fi->T, fi->T), 0);
+
+ return 0;
+}
+
+static const struct osmo_fsm_state lu_compl_vlr_states[] = {
+ [LU_COMPL_VLR_S_INIT] = {
+ .in_event_mask = S(LU_COMPL_VLR_E_START),
+ .out_state_mask = S(LU_COMPL_VLR_S_DONE) |
+ S(LU_COMPL_VLR_S_WAIT_SUB_PRES),
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_INIT),
+ .action = lu_compl_vlr_init,
+ },
+ [LU_COMPL_VLR_S_WAIT_SUB_PRES] = {
+ .in_event_mask = S(LU_COMPL_VLR_E_SUB_PRES_COMPL),
+ .out_state_mask = S(LU_COMPL_VLR_S_WAIT_IMEI) |
+ S(LU_COMPL_VLR_S_WAIT_IMEI_TMSI) |
+ S(LU_COMPL_VLR_S_WAIT_TMSI_CNF) |
+ S(LU_COMPL_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_WAIT_SUB_PRES),
+ .action = lu_compl_vlr_wait_subscr_pres,
+ },
+ [LU_COMPL_VLR_S_WAIT_IMEI] = {
+ .in_event_mask = S(LU_COMPL_VLR_E_IMEI_CHECK_ACK) |
+ S(LU_COMPL_VLR_E_IMEI_CHECK_NACK),
+ .out_state_mask = S(LU_COMPL_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_WAIT_IMEI),
+ .onenter = vlr_lu_compl_fsm_reset_n,
+ .action = lu_compl_vlr_wait_imei,
+ },
+ [LU_COMPL_VLR_S_WAIT_IMEI_TMSI] = {
+ .in_event_mask = S(LU_COMPL_VLR_E_IMEI_CHECK_ACK) |
+ S(LU_COMPL_VLR_E_IMEI_CHECK_NACK),
+ .out_state_mask = S(LU_COMPL_VLR_S_DONE) |
+ S(LU_COMPL_VLR_S_WAIT_TMSI_CNF),
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_WAIT_IMEI_TMSI),
+ .onenter = vlr_lu_compl_fsm_reset_n,
+ .action = lu_compl_vlr_wait_imei,
+ },
+ [LU_COMPL_VLR_S_WAIT_TMSI_CNF] = {
+ .in_event_mask = S(LU_COMPL_VLR_E_NEW_TMSI_ACK),
+ .out_state_mask = S(LU_COMPL_VLR_S_DONE),
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_WAIT_TMSI_CNF),
+ .onenter = vlr_lu_compl_fsm_reset_n,
+ .action = lu_compl_vlr_wait_tmsi,
+ },
+ [LU_COMPL_VLR_S_DONE] = {
+ .name = OSMO_STRINGIFY(LU_COMPL_VLR_S_DONE),
+ .onenter = vlr_lu_compl_fsm_dispatch_result,
+ },
+};
+
+static struct osmo_fsm lu_compl_vlr_fsm = {
+ .name = "lu_compl_vlr_fsm",
+ .states = lu_compl_vlr_states,
+ .num_states = ARRAY_SIZE(lu_compl_vlr_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = lu_compl_vlr_event_names,
+ .timer_cb = lu_compl_vlr_timeout,
+};
+
+static inline struct lu_compl_vlr_priv *lu_compl_vlr_fi_priv(struct osmo_fsm_inst *fi)
+{
+ OSMO_ASSERT(fi->fsm == &lu_compl_vlr_fsm);
+ return (struct lu_compl_vlr_priv*)fi->priv;
+}
+
+struct osmo_fsm_inst *
+lu_compl_vlr_proc_alloc(struct osmo_fsm_inst *parent,
+ struct vlr_subscr *vsub,
+ void *msc_conn_ref,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ bool assign_tmsi,
+ enum vlr_lu_type lu_type)
+{
+ struct osmo_fsm_inst *fi;
+ struct lu_compl_vlr_priv *lcvp;
+
+ fi = osmo_fsm_inst_alloc_child(&lu_compl_vlr_fsm, parent,
+ parent_event_failure);
+ if (!fi)
+ return NULL;
+
+ lcvp = talloc_zero(fi, struct lu_compl_vlr_priv);
+ lcvp->vsub = vsub;
+ lcvp->msc_conn_ref = msc_conn_ref;
+ lcvp->parent_event_success = parent_event_success;
+ lcvp->parent_event_failure = parent_event_failure;
+ lcvp->assign_tmsi = assign_tmsi;
+ lcvp->lu_type = lu_type;
+ fi->priv = lcvp;
+
+ return fi;
+}
+
+
+/***********************************************************************
+ * Update_Location_Area_VLR, TS 23.012 Chapter 4.1.2.1
+ ***********************************************************************/
+
+static const struct value_string fsm_lu_event_names[] = {
+ OSMO_VALUE_STRING(VLR_ULA_E_UPDATE_LA),
+ OSMO_VALUE_STRING(VLR_ULA_E_SEND_ID_ACK),
+ OSMO_VALUE_STRING(VLR_ULA_E_SEND_ID_NACK),
+ OSMO_VALUE_STRING(VLR_ULA_E_AUTH_SUCCESS),
+ OSMO_VALUE_STRING(VLR_ULA_E_AUTH_NO_INFO),
+ OSMO_VALUE_STRING(VLR_ULA_E_AUTH_FAILURE),
+ OSMO_VALUE_STRING(VLR_ULA_E_CIPH_RES),
+ OSMO_VALUE_STRING(VLR_ULA_E_ID_IMSI),
+ OSMO_VALUE_STRING(VLR_ULA_E_ID_IMEI),
+ OSMO_VALUE_STRING(VLR_ULA_E_ID_IMEISV),
+ OSMO_VALUE_STRING(VLR_ULA_E_HLR_IMEI_ACK),
+ OSMO_VALUE_STRING(VLR_ULA_E_HLR_IMEI_NACK),
+ OSMO_VALUE_STRING(VLR_ULA_E_HLR_LU_RES),
+ OSMO_VALUE_STRING(VLR_ULA_E_UPD_HLR_COMPL),
+ OSMO_VALUE_STRING(VLR_ULA_E_LU_COMPL_SUCCESS),
+ OSMO_VALUE_STRING(VLR_ULA_E_LU_COMPL_FAILURE),
+ OSMO_VALUE_STRING(VLR_ULA_E_NEW_TMSI_ACK),
+ { 0, NULL }
+};
+
+struct osmo_tdef_state_timeout msc_lu_tdef_states[32] = {
+ [VLR_ULA_S_WAIT_IMEISV] = { .T = 3270 },
+ [VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY] = { .T = 3270 },
+ [VLR_ULA_S_WAIT_IMSI] = { .T = 3270 },
+};
+
+struct osmo_tdef_state_timeout sgsn_lu_tdef_states[32] = {
+ [VLR_ULA_S_WAIT_IMEISV] = { .T = 3370 },
+ [VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY] = { .T = 3370 },
+ [VLR_ULA_S_WAIT_IMSI] = { .T = 3370 },
+};
+
+struct osmo_tdef_state_timeout *lu_fsm_state_tdef;
+
+struct lu_fsm_priv {
+ struct vlr_instance *vlr;
+ struct vlr_subscr *vsub;
+ void *msc_conn_ref;
+ struct osmo_fsm_inst *upd_hlr_vlr_fsm;
+ struct osmo_fsm_inst *lu_compl_vlr_fsm;
+ uint32_t parent_event_success;
+ uint32_t parent_event_failure;
+ void *parent_event_data;
+ enum vlr_fsm_result result;
+ uint8_t rej_cause;
+
+ enum vlr_lu_type lu_type;
+ bool lu_by_tmsi;
+ char imsi[16];
+ uint32_t tmsi;
+ struct osmo_location_area_id old_lai;
+ struct osmo_location_area_id new_lai;
+ struct osmo_routing_area_id old_rai;
+ struct osmo_routing_area_id new_rai;
+ bool authentication_required;
+ /* is_ciphering_to_be_attempted: true when any A5/n > 0 are enabled. Ciphering is allowed, always attempt to get Auth Info from
+ * the HLR. */
+ bool is_ciphering_to_be_attempted;
+ /* is_ciphering_required: true when A5/0 is disabled. If we cannot get Auth Info from the HLR, reject the
+ * subscriber. */
+ bool is_ciphering_required;
+ uint8_t key_seq;
+ bool is_r99;
+ bool is_utran;
+ bool assign_tmsi;
+
+ /*! count times timer T timed out */
+ int N;
+};
+
+
+/* Determine if given location area is served by this VLR */
+static bool lai_in_this_vlr(struct vlr_instance *vlr,
+ const struct osmo_location_area_id *lai)
+{
+ /* TODO: VLR needs to keep a locally configured list of LAIs */
+ return true;
+}
+
+/* Return true when authentication should be attempted. */
+static bool try_auth(struct lu_fsm_priv *lfp)
+{
+ /* The cases where the authentication procedure should be used
+ * are defined in 3GPP TS 33.102 */
+ /* For now we use a default value passed in to vlr_lu_fsm(). */
+ return lfp->authentication_required ||
+ (lfp->is_ciphering_to_be_attempted && !auth_try_reuse_tuple(lfp->vsub, lfp->key_seq));
+}
+
+/* Return true when CipherModeCmd / SecurityModeCmd should be attempted. */
+static bool is_cmc_smc_to_be_attempted(struct lu_fsm_priv *lfp)
+{
+ /* UTRAN: always send SecModeCmd, even if ciphering is not required.
+ * GERAN: avoid sending CiphModeCmd if ciphering is not required. */
+ return lfp->is_utran || lfp->is_ciphering_to_be_attempted;
+}
+
+/* Determine if a HLR Update is required */
+static bool hlr_update_needed(struct vlr_subscr *vsub)
+{
+ /* TODO: properly decide this, rather than always assuming we
+ * need to update the HLR. */
+ return true;
+}
+
+static inline struct lu_fsm_priv *lu_fsm_fi_priv(struct osmo_fsm_inst *fi);
+
+static void lu_fsm_dispatch_result(struct osmo_fsm_inst *fi,
+ uint32_t prev_state)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ if (!fi->proc.parent) {
+ LOGPFSML(fi, LOGL_ERROR, "No parent FSM\n");
+ return;
+ }
+ if (lfp->result == VLR_FSM_RESULT_SUCCESS)
+ fi->proc.parent_term_event = lfp->parent_event_success;
+ else
+ fi->proc.parent_term_event = lfp->parent_event_failure;
+
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, lfp->parent_event_data);
+}
+
+static void _lu_fsm_done(struct osmo_fsm_inst *fi,
+ enum vlr_fsm_result result)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ lfp->result = result;
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_DONE, 0, 0);
+}
+
+static void lu_fsm_success(struct osmo_fsm_inst *fi)
+{
+ _lu_fsm_done(fi, VLR_FSM_RESULT_SUCCESS);
+}
+
+static void lu_fsm_failure(struct osmo_fsm_inst *fi, enum gsm48_reject_value rej_cause)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ lfp->vlr->ops.tx_lu_rej(lfp->msc_conn_ref, rej_cause ? : GSM48_REJECT_NETWORK_FAILURE, lfp->lu_type);
+ _lu_fsm_done(fi, VLR_FSM_RESULT_FAILURE);
+}
+
+static void vlr_loc_upd_start_lu_compl_fsm(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ lfp->lu_compl_vlr_fsm =
+ lu_compl_vlr_proc_alloc(fi, lfp->vsub, lfp->msc_conn_ref,
+ VLR_ULA_E_LU_COMPL_SUCCESS,
+ VLR_ULA_E_LU_COMPL_FAILURE,
+ lfp->assign_tmsi,
+ lfp->lu_type);
+
+ osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm, LU_COMPL_VLR_E_START, NULL);
+}
+
+static void lu_fsm_discard_lu_compl_fsm(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ if (!lfp->lu_compl_vlr_fsm)
+ return;
+ osmo_fsm_inst_term(lfp->lu_compl_vlr_fsm, OSMO_FSM_TERM_PARENT, NULL);
+}
+
+/* 4.1.2.1 Node 4 */
+static void vlr_loc_upd_node_4(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+ bool hlr_unknown = false;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ if (hlr_unknown) {
+ /* FIXME: Delete subscriber record */
+ /* LU REJ: Roaming not allowed */
+ lu_fsm_failure(fi, GSM48_REJECT_ROAMING_NOT_ALLOWED);
+ return;
+ }
+
+ if (lfp->lu_type == VLR_LU_TYPE_IMSI_ATTACH) {
+ /* Update_HLR_VLR */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_HLR_UPD,
+ LU_TIMEOUT_LONG, 0);
+ lfp->upd_hlr_vlr_fsm =
+ upd_hlr_vlr_proc_start(fi, vsub, VLR_ULA_E_UPD_HLR_COMPL);
+ } else {
+ /* PERIODIC and REGULAR, as long we don't support multiple MSC with different Location Areas */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_LU_COMPL,
+ LU_TIMEOUT_LONG, 0);
+ vlr_loc_upd_start_lu_compl_fsm(fi);
+ }
+}
+
+/* 4.1.2.1 Node B */
+static void vlr_loc_upd_node_b(struct osmo_fsm_inst *fi)
+{
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ /* OsmoHLR does not support PgA, neither stores the IMEISV, so we have no need to update the HLR
+ * with either. TODO: depend on actual HLR configuration. See 3GPP TS 23.012 Release 14, process
+ * Update_Location_Area_VLR (ULA_VLR2). */
+ if (0) { /* IMEISV or PgA to send */
+ vlr_loc_upd_node_4(fi);
+ } else {
+ /* Location_Update_Completion */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_LU_COMPL,
+ LU_TIMEOUT_LONG, 0);
+ vlr_loc_upd_start_lu_compl_fsm(fi);
+ }
+}
+
+/* Non-standard: after Ciphering Mode Complete (or no ciph required) */
+static void vlr_loc_upd_post_ciph(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+ int rc;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ OSMO_ASSERT(vsub);
+
+ rc = lfp->vlr->ops.tx_common_id(lfp->msc_conn_ref);
+ if (rc)
+ LOGPFSML(fi, LOGL_ERROR, "Error while sending Common ID (%d)\n", rc);
+
+ vsub->conf_by_radio_contact_ind = true;
+ /* Update LAI */
+ vsub->cgi.lai = lfp->new_lai;
+ vsub->dormant_ind = false;
+ vsub->cancel_loc_rx = false;
+ if (hlr_update_needed(vsub)) {
+ vlr_loc_upd_node_4(fi);
+ } else {
+ /* TODO: ADD Support */
+ /* TODO: Node A: PgA Support */
+ vlr_loc_upd_node_b(fi);
+ }
+}
+
+/* 4.1.2.1 after Authentication successful (or no auth rqd) */
+static void vlr_loc_upd_post_auth(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+ bool umts_aka;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ OSMO_ASSERT(vsub);
+
+ /* Continue with ciphering, if enabled.
+ * If auth/ciph is optional and the HLR returned no auth info, continue without ciphering. */
+ if (!is_cmc_smc_to_be_attempted(lfp)
+ || (vsub->sec_ctx == VLR_SEC_CTX_NONE && !lfp->is_ciphering_required)) {
+ vlr_loc_upd_post_ciph(fi);
+ return;
+ }
+
+ if (!vsub->last_tuple) {
+ LOGPFSML(fi, LOGL_ERROR, "No auth tuple available\n");
+ lu_fsm_failure(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ switch (vsub->sec_ctx) {
+ case VLR_SEC_CTX_GSM:
+ umts_aka = false;
+ break;
+ case VLR_SEC_CTX_UMTS:
+ umts_aka = true;
+ break;
+ default:
+ LOGPFSML(fi, LOGL_ERROR, "Cannot start ciphering, security context is not established\n");
+ lu_fsm_failure(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ if (vlr_set_ciph_mode(vsub->vlr, fi, lfp->msc_conn_ref,
+ umts_aka,
+ vsub->vlr->cfg.retrieve_imeisv_ciphered)) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "Failed to send Ciphering Mode Command\n");
+ lu_fsm_failure(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_CIPH, LU_TIMEOUT_LONG, 0);
+}
+
+static void vlr_loc_upd_node1(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ OSMO_ASSERT(vsub);
+
+ if (try_auth(lfp)) {
+ /* Authenticate_VLR */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_AUTH,
+ LU_TIMEOUT_LONG, 0);
+ vsub->auth_fsm = auth_fsm_start(lfp->vsub,
+ fi,
+ VLR_ULA_E_AUTH_SUCCESS,
+ VLR_ULA_E_AUTH_NO_INFO,
+ VLR_ULA_E_AUTH_FAILURE,
+ lfp->is_r99,
+ lfp->is_utran);
+ } else {
+ /* no need for authentication */
+ vlr_loc_upd_post_auth(fi);
+ }
+}
+
+static void vlr_loc_upd_node1_pre(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ if (vlr->cfg.check_imei_rqd && vlr->cfg.retrieve_imeisv_early) {
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY, lu_fsm_state_tdef, vlr_tdefs, -1);
+ vlr_subscr_tx_req_check_imei(lfp->vsub);
+ } else {
+ vlr_loc_upd_node1(fi);
+ }
+}
+
+/* End of Check_IMEI Procedure. Executed early (before the location update), so we can send the IMEI to the HLR even if
+ * the MS would be rejected in LU. See the "Configuring the Subscribers Create on Demand Feature" section of the OsmoHLR
+ * user manual for a detailed explanation of the use case. */
+static void lu_fsm_wait_hlr_check_imei_early(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ switch (event) {
+ case VLR_ULA_E_HLR_IMEI_ACK:
+ vlr_loc_upd_node1(fi);
+ break;
+ case VLR_ULA_E_HLR_IMEI_NACK:
+ lu_fsm_failure(fi, GSM48_REJECT_ILLEGAL_ME);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+static void vlr_loc_upd_want_imsi(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ LOGPFSM(fi, "%s()\n", __func__);
+
+ OSMO_ASSERT(lfp->vsub);
+
+ /* Obtain_IMSI_VLR */
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_IMSI, lu_fsm_state_tdef, vlr_tdefs, -1);
+ vlr->ops.tx_id_req(lfp->msc_conn_ref, GSM_MI_TYPE_IMSI);
+ /* will continue at vlr_loc_upd_node1_pre() once IMSI arrives */
+}
+
+static int assoc_lfp_with_sub(struct osmo_fsm_inst *fi, struct vlr_subscr *vsub)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ if (vsub->lu_fsm) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "A Location Updating process is already pending for"
+ " this subscriber. Aborting.\n");
+ /* Also get rid of the other pending LU attempt? */
+ /*lu_fsm_failure(vsub->lu_fsm, GSM48_REJECT_CONGESTION);*/
+ lu_fsm_failure(fi, GSM48_REJECT_CONGESTION);
+ return -EINVAL;
+ }
+ vsub->lu_fsm = fi;
+ vsub->msc_conn_ref = lfp->msc_conn_ref;
+ /* FIXME: send new LAC to HLR? */
+ vsub->cgi.lai.lac = lfp->new_lai.lac;
+ lfp->vsub = vsub;
+ /* Tell MSC to associate this subscriber with the given
+ * connection */
+ if (vlr->ops.subscr_assoc(lfp->msc_conn_ref, lfp->vsub))
+ lu_fsm_failure(fi, GSM48_REJECT_NETWORK_FAILURE);
+ return 0;
+}
+
+static int _lu_fsm_associate_vsub(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+ struct vlr_subscr *vsub = NULL;
+
+ if (!lfp->imsi[0]) {
+ /* TMSI was used */
+ lfp->lu_by_tmsi = true;
+ /* TMSI clash: if a different subscriber already has this TMSI,
+ * we will find that other subscriber in the VLR. So the IMSIs
+ * would mismatch, but we don't know about it. Theoretically,
+ * an authentication process would thwart any attempt to use
+ * someone else's TMSI.
+ * TODO: Otherwise we can ask for the IMSI and verify that it
+ * matches the IMSI on record. */
+ vsub = vlr_subscr_find_or_create_by_tmsi(vlr, lfp->tmsi, __func__, NULL);
+
+ if (!vsub) {
+ LOGPFSML(fi, LOGL_ERROR, "VLR subscriber allocation failed\n");
+ lu_fsm_failure(fi, GSM48_REJECT_SRV_OPT_TMP_OUT_OF_ORDER);
+ return -1;
+ }
+
+ vsub->sub_dataconf_by_hlr_ind = false;
+ if (assoc_lfp_with_sub(fi, vsub)) {
+ vlr_subscr_put(vsub, __func__);
+ return -1; /* error, fsm failure invoked in assoc_lfp_with_sub() */
+ }
+ vlr_subscr_put(vsub, __func__);
+ } else {
+ /* IMSI was used */
+ vsub = vlr_subscr_find_or_create_by_imsi(vlr, lfp->imsi, __func__, NULL);
+
+ if (!vsub) {
+ LOGPFSML(fi, LOGL_ERROR, "VLR subscriber allocation failed\n");
+ lu_fsm_failure(fi, GSM48_REJECT_SRV_OPT_TMP_OUT_OF_ORDER);
+ vlr_subscr_put(vsub, __func__);
+ return -1;
+ }
+
+ vsub->sub_dataconf_by_hlr_ind = false;
+ if (assoc_lfp_with_sub(fi, vsub)) {
+ vlr_subscr_put(vsub, __func__);
+ return -1; /* error, fsm failure invoked in assoc_lfp_with_sub() */
+ }
+ vlr_subscr_put(vsub, __func__);
+ }
+ return 0;
+}
+
+/* 4.1.2.1: Subscriber (via MSC/SGSN) requests location update */
+static void _start_lu_main(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ /* TODO: PUESBINE related handling */
+
+ /* Is previous LAI in this VLR? */
+ if (!lai_in_this_vlr(vlr, &lfp->old_lai)) {
+#if 0
+ /* FIXME: check previous VLR, (3) */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_PVLR,
+ LU_TIMEOUT_LONG, 0);
+ return;
+#endif
+ LOGPFSML(fi, LOGL_NOTICE, "LAI change from %s,"
+ " but checking previous VLR not implemented\n",
+ osmo_lai_name(&lfp->old_lai));
+ }
+
+ /* If this is a TMSI based LU, we may not have the IMSI. Make sure that
+ * we know the IMSI, either on record, or request it. */
+ if (!lfp->vsub->imsi[0])
+ vlr_loc_upd_want_imsi(fi);
+ else
+ vlr_loc_upd_node1_pre(fi);
+}
+
+static void lu_fsm_idle(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ OSMO_ASSERT(event == VLR_ULA_E_UPDATE_LA);
+
+ if (_lu_fsm_associate_vsub(fi))
+ return; /* error. FSM already terminated. */
+
+ OSMO_ASSERT(lfp->vsub);
+
+ /* At this point we know for which subscriber the location update is,
+ * we now must inform SGs-UE FSM that we received a location update
+ * via A, IU or Gs interface. */
+ osmo_fsm_inst_dispatch(lfp->vsub->sgs_fsm, SGS_UE_E_RX_LU_FROM_A_IU_GS, NULL);
+
+ /* See 3GPP TS 23.012, procedure Retrieve_IMEISV_If_Required */
+ if ((!vlr->cfg.retrieve_imeisv_early)
+ || (lfp->lu_type == VLR_LU_TYPE_PERIODIC && lfp->vsub->imeisv[0])) {
+ /* R_IMEISV_IR1 passed */
+ _start_lu_main(fi);
+ } else {
+ vlr->ops.tx_id_req(lfp->msc_conn_ref, GSM_MI_TYPE_IMEISV);
+ osmo_tdef_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_IMEISV, lu_fsm_state_tdef, vlr_tdefs, -1);
+ }
+}
+
+static void lu_fsm_wait_imeisv(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ switch (event) {
+ case VLR_ULA_E_ID_IMEISV:
+ /* IMEISV was copied in vlr_subscr_rx_id_resp(), and that's
+ * where we received this event from. */
+ _start_lu_main(fi);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Wait for response from Send_Identification to PVLR */
+static void lu_fsm_wait_pvlr(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ switch (event) {
+ case VLR_ULA_E_SEND_ID_ACK:
+ vlr_loc_upd_node1_pre(fi);
+ break;
+ case VLR_ULA_E_SEND_ID_NACK:
+ vlr_loc_upd_want_imsi(fi);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Wait for result of Authenticate_VLR procedure */
+static void lu_fsm_wait_auth(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ enum gsm48_reject_value *res = data;
+
+ lfp->upd_hlr_vlr_fsm = NULL;
+
+ switch (event) {
+ case VLR_ULA_E_AUTH_SUCCESS:
+ /* Result == Pass */
+ vlr_loc_upd_post_auth(fi);
+ return;
+
+ case VLR_ULA_E_AUTH_FAILURE:
+ lu_fsm_failure(fi, res ? *res : GSM48_REJECT_NETWORK_FAILURE);
+ return;
+
+ case VLR_ULA_E_AUTH_NO_INFO:
+ /* HLR returned no auth info for the subscriber. Continue only if authentication is optional. */
+ if (lfp->authentication_required || lfp->is_ciphering_required) {
+ lu_fsm_failure(fi, res ? *res : GSM48_REJECT_NETWORK_FAILURE);
+ return;
+ }
+ LOGPFSML(fi, LOGL_INFO,
+ "Attaching subscriber without auth (auth is optional, and no auth info received from HLR)\n");
+ vlr_loc_upd_post_auth(fi);
+ return;
+
+ default:
+ OSMO_ASSERT(false);
+ }
+}
+
+static void lu_fsm_wait_ciph(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ enum vlr_ciph_result_cause result = VLR_CIPH_REJECT;
+
+ OSMO_ASSERT(event == VLR_ULA_E_CIPH_RES);
+
+ if (!data)
+ LOGPFSML(fi, LOGL_ERROR, "invalid ciphering result: NULL\n");
+ else
+ result = *(enum vlr_ciph_result_cause*)data;
+
+ switch (result) {
+ case VLR_CIPH_COMPL:
+ vlr_loc_upd_post_ciph(fi);
+ return;
+ case VLR_CIPH_REJECT:
+ LOGPFSM(fi, "ciphering rejected\n");
+ lu_fsm_failure(fi, GSM48_REJECT_INVALID_MANDANTORY_INF);
+ return;
+ default:
+ LOGPFSML(fi, LOGL_ERROR, "invalid ciphering result: %d\n", result);
+ lu_fsm_failure(fi, GSM48_REJECT_INVALID_MANDANTORY_INF);
+ return;
+ }
+}
+
+static void lu_fsm_wait_imsi(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+ char *mi_string = data;
+
+ switch (event) {
+ case VLR_ULA_E_ID_IMSI:
+ vlr_subscr_set_imsi(vsub, mi_string);
+ vlr_loc_upd_node1_pre(fi);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* At the end of Update_HLR_VLR */
+static void lu_fsm_wait_hlr_ul_res(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+
+ switch (event) {
+ case VLR_ULA_E_HLR_LU_RES:
+ /* pass-through this event to Update_HLR_VLR */
+ if (data == NULL)
+ osmo_fsm_inst_dispatch(lfp->upd_hlr_vlr_fsm, UPD_HLR_VLR_E_UPD_LOC_ACK, NULL);
+ else
+ osmo_fsm_inst_dispatch(lfp->upd_hlr_vlr_fsm, UPD_HLR_VLR_E_UPD_LOC_NACK, data);
+ break;
+ case VLR_ULA_E_UPD_HLR_COMPL:
+ if (data == NULL) {
+ /* successful case */
+ osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_LU_COMPL,
+ LU_TIMEOUT_LONG, 0);
+ vlr_loc_upd_start_lu_compl_fsm(fi);
+ /* continue in MSC ?!? */
+ } else {
+ /* unsuccessful case */
+ enum gsm48_reject_value cause =
+ *(enum gsm48_reject_value *)data;
+ /* Ignoring standalone mode for now. */
+ if (0 /* procedure_error && vlr->cfg.standalone_mode */) {
+ osmo_fsm_inst_state_chg(fi,
+ VLR_ULA_S_WAIT_LU_COMPL_STANDALONE,
+ LU_TIMEOUT_LONG, 0);
+ vlr_loc_upd_start_lu_compl_fsm(fi);
+ } else {
+ lu_fsm_failure(fi, cause);
+ }
+ }
+ break;
+ case VLR_ULA_E_ID_IMEI:
+ case VLR_ULA_E_ID_IMEISV:
+ /* Got the IMEI from ME, nothing to do right now though. */
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Wait for end of Location_Update_Completion_VLR */
+static void lu_fsm_wait_lu_compl(struct osmo_fsm_inst *fi, uint32_t event,
+ void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ uint8_t cause;
+
+ switch (event) {
+ case VLR_ULA_E_NEW_TMSI_ACK:
+ osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
+ LU_COMPL_VLR_E_NEW_TMSI_ACK, NULL);
+ break;
+ case VLR_ULA_E_ID_IMEI:
+ case VLR_ULA_E_ID_IMEISV:
+ /* Got the IMEI from ME, now send it to HLR */
+ vlr_subscr_tx_req_check_imei(lfp->vsub);
+ break;
+ case VLR_ULA_E_HLR_IMEI_ACK:
+ osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
+ LU_COMPL_VLR_E_IMEI_CHECK_ACK, NULL);
+ break;
+ case VLR_ULA_E_HLR_IMEI_NACK:
+ osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
+ LU_COMPL_VLR_E_IMEI_CHECK_NACK, NULL);
+ break;
+ case VLR_ULA_E_LU_COMPL_SUCCESS:
+ lu_fsm_discard_lu_compl_fsm(fi);
+
+ /* Update Register */
+ /* TODO: Set_Notification_Type 23.078 */
+ /* TODO: Notify_gsmSCF 23.078 */
+ /* TODO: Authenticated Radio Contact Established -> ARC */
+
+ if (lfp->lu_type == VLR_LU_TYPE_IMSI_ATTACH)
+ lfp->vlr->ops.tx_mm_info(lfp->msc_conn_ref);
+
+ lu_fsm_success(fi);
+ break;
+ case VLR_ULA_E_LU_COMPL_FAILURE:
+ cause = GSM48_REJECT_NETWORK_FAILURE;
+ if (data)
+ cause = *(uint8_t*)data;
+ lu_fsm_discard_lu_compl_fsm(fi);
+ lu_fsm_failure(fi, cause);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Wait for end of Location_Update_Completion_VLR (standalone case) */
+static void lu_fsm_wait_lu_compl_standalone(struct osmo_fsm_inst *fi,
+ uint32_t event, void *data)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+ uint8_t cause;
+
+ switch (event) {
+ case VLR_ULA_E_NEW_TMSI_ACK:
+ osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
+ LU_COMPL_VLR_E_NEW_TMSI_ACK, NULL);
+ break;
+ case VLR_ULA_E_LU_COMPL_SUCCESS:
+ lu_fsm_discard_lu_compl_fsm(fi);
+ vsub->sub_dataconf_by_hlr_ind = false;
+ lu_fsm_success(fi);
+ break;
+ case VLR_ULA_E_LU_COMPL_FAILURE:
+ vsub->sub_dataconf_by_hlr_ind = false;
+ cause = GSM48_REJECT_NETWORK_FAILURE;
+ if (data)
+ cause = *(uint8_t*)data;
+ lu_fsm_discard_lu_compl_fsm(fi);
+ lu_fsm_failure(fi, cause);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+static void lu_fsm_reset_n(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ lfp->N = 0;
+}
+
+static const struct osmo_fsm_state vlr_lu_fsm_states[] = {
+ [VLR_ULA_S_IDLE] = {
+ .in_event_mask = S(VLR_ULA_E_UPDATE_LA),
+ .out_state_mask = S(VLR_ULA_S_WAIT_IMEISV) |
+ S(VLR_ULA_S_WAIT_PVLR) |
+ S(VLR_ULA_S_WAIT_IMSI) |
+ S(VLR_ULA_S_WAIT_AUTH) |
+ S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_IDLE),
+ .action = lu_fsm_idle,
+ },
+ [VLR_ULA_S_WAIT_IMEISV] = {
+ .in_event_mask = S(VLR_ULA_E_ID_IMEISV),
+ .out_state_mask = S(VLR_ULA_S_WAIT_PVLR) |
+ S(VLR_ULA_S_WAIT_IMSI) |
+ S(VLR_ULA_S_WAIT_AUTH) |
+ S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_IMEISV),
+ .action = lu_fsm_wait_imeisv,
+ },
+ [VLR_ULA_S_WAIT_PVLR] = {
+ .in_event_mask = S(VLR_ULA_E_SEND_ID_ACK) |
+ S(VLR_ULA_E_SEND_ID_NACK),
+ .out_state_mask = S(VLR_ULA_S_WAIT_IMSI) |
+ S(VLR_ULA_S_WAIT_AUTH) |
+ S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_PVLR),
+ .action = lu_fsm_wait_pvlr,
+ },
+ [VLR_ULA_S_WAIT_AUTH] = {
+ .in_event_mask = S(VLR_ULA_E_AUTH_SUCCESS) |
+ S(VLR_ULA_E_AUTH_NO_INFO) |
+ S(VLR_ULA_E_AUTH_FAILURE),
+ .out_state_mask = S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_LU_COMPL) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_AUTH),
+ .action = lu_fsm_wait_auth,
+ },
+ [VLR_ULA_S_WAIT_CIPH] = {
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_CIPH),
+ .in_event_mask = S(VLR_ULA_E_CIPH_RES),
+ .out_state_mask = S(VLR_ULA_S_WAIT_LU_COMPL) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_DONE),
+ .action = lu_fsm_wait_ciph,
+ },
+ [VLR_ULA_S_WAIT_IMSI] = {
+ .in_event_mask = S(VLR_ULA_E_ID_IMSI),
+ .out_state_mask = S(VLR_ULA_S_WAIT_AUTH) |
+ S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_IMSI),
+ .onenter = lu_fsm_reset_n,
+ .action = lu_fsm_wait_imsi,
+ },
+ [VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY] = {
+ .in_event_mask = S(VLR_ULA_E_HLR_IMEI_ACK) |
+ S(VLR_ULA_E_HLR_IMEI_NACK),
+ .out_state_mask = S(VLR_ULA_S_WAIT_AUTH) |
+ S(VLR_ULA_S_WAIT_CIPH) |
+ S(VLR_ULA_S_WAIT_HLR_UPD) |
+ S(VLR_ULA_S_WAIT_LU_COMPL) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY),
+ .action = lu_fsm_wait_hlr_check_imei_early,
+ },
+ [VLR_ULA_S_WAIT_HLR_UPD] = {
+ .in_event_mask = S(VLR_ULA_E_HLR_LU_RES) |
+ S(VLR_ULA_E_UPD_HLR_COMPL) |
+ S(VLR_ULA_E_ID_IMEI) |
+ S(VLR_ULA_E_ID_IMEISV),
+ .out_state_mask = S(VLR_ULA_S_WAIT_LU_COMPL) |
+ S(VLR_ULA_S_WAIT_LU_COMPL_STANDALONE) |
+ S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_HLR_UPD),
+ .action = lu_fsm_wait_hlr_ul_res,
+ },
+ [VLR_ULA_S_WAIT_LU_COMPL] = {
+ .in_event_mask = S(VLR_ULA_E_LU_COMPL_SUCCESS) |
+ S(VLR_ULA_E_LU_COMPL_FAILURE) |
+ S(VLR_ULA_E_NEW_TMSI_ACK) |
+ S(VLR_ULA_E_ID_IMEI) |
+ S(VLR_ULA_E_ID_IMEISV) |
+ S(VLR_ULA_E_HLR_IMEI_ACK) |
+ S(VLR_ULA_E_HLR_IMEI_NACK),
+ .out_state_mask = S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_LU_COMPL),
+ .action = lu_fsm_wait_lu_compl,
+ },
+ [VLR_ULA_S_WAIT_LU_COMPL_STANDALONE] = {
+ .in_event_mask = S(VLR_ULA_E_LU_COMPL_SUCCESS) |
+ S(VLR_ULA_E_LU_COMPL_FAILURE) |
+ S(VLR_ULA_E_NEW_TMSI_ACK),
+ .out_state_mask = S(VLR_ULA_S_DONE),
+ .name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_LU_COMPL_STANDALONE),
+ .action = lu_fsm_wait_lu_compl_standalone,
+ },
+ [VLR_ULA_S_DONE] = {
+ .name = OSMO_STRINGIFY(VLR_ULA_S_DONE),
+ .onenter = lu_fsm_dispatch_result,
+ },
+};
+
+static void fsm_lu_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cause)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_subscr *vsub = lfp->vsub;
+
+ LOGPFSM(fi, "fsm_lu_cleanup called with cause %s\n",
+ osmo_fsm_term_cause_name(cause));
+ if (vsub && vsub->lu_fsm == fi)
+ vsub->lu_fsm = NULL;
+}
+
+static void fsm_lu_preterm(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cause)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ uint8_t gsm48_cause;
+
+ if (vlr_is_cs(lfp->vlr))
+ return;
+
+ if (cause != OSMO_FSM_TERM_TIMEOUT)
+ return;
+
+ switch (fi->state) {
+ case VLR_ULA_S_WAIT_IMSI:
+ gsm48_cause = GSM48_REJECT_MS_IDENTITY_NOT_DERVIVABLE;
+ break;
+ case VLR_ULA_S_WAIT_AUTH:
+ default:
+ gsm48_cause = GSM48_REJECT_NETWORK_FAILURE;
+ break;
+ }
+
+ lfp->vlr->ops.tx_lu_rej(lfp->msc_conn_ref, gsm48_cause, lfp->lu_type);
+}
+
+int fsm_lu_timer_cb(struct osmo_fsm_inst *fi)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ /* only PS requires resending, CS terminate FSM */
+ if (vlr_is_cs(vlr))
+ return 1;
+
+ /* PS: we have to resend the complete message 5x times, before failing */
+ if (++lfp->N >= 5)
+ return 1;
+
+ switch (fi->state) {
+ case VLR_ULA_S_WAIT_IMSI:
+ vlr->ops.tx_id_req(lfp->msc_conn_ref, GSM_MI_TYPE_IMSI);
+ break;
+ }
+
+ osmo_timer_schedule(&fi->timer, vlr_timer_secs(vlr, fi->T, fi->T), 0);
+
+ return 0;
+}
+
+
+static struct osmo_fsm vlr_lu_fsm = {
+ .name = "vlr_lu_fsm",
+ .states = vlr_lu_fsm_states,
+ .num_states = ARRAY_SIZE(vlr_lu_fsm_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = fsm_lu_event_names,
+ .cleanup = fsm_lu_cleanup,
+ .pre_term = fsm_lu_preterm,
+ .timer_cb = fsm_lu_timer_cb,
+};
+
+static inline struct lu_fsm_priv *lu_fsm_fi_priv(struct osmo_fsm_inst *fi)
+{
+ OSMO_ASSERT(fi->fsm == &vlr_lu_fsm);
+ return (struct lu_fsm_priv*)fi->priv;
+}
+
+static struct osmo_fsm_inst *
+_vlr_loc_update(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_lu_type type, uint32_t tmsi, const char *imsi,
+ const struct osmo_location_area_id *old_lai,
+ const struct osmo_location_area_id *new_lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran,
+ bool assign_tmsi)
+{
+ struct osmo_fsm_inst *fi;
+ struct lu_fsm_priv *lfp;
+
+ if (is_ciphering_required)
+ OSMO_ASSERT(is_ciphering_to_be_attempted);
+
+ fi = osmo_fsm_inst_alloc_child(&vlr_lu_fsm, parent, parent_event_failure);
+ if (!fi)
+ return NULL;
+
+ lfp = talloc_zero(fi, struct lu_fsm_priv);
+ lfp->vlr = vlr;
+ lfp->msc_conn_ref = msc_conn_ref;
+ lfp->tmsi = tmsi;
+ lfp->lu_type = type;
+ lfp->old_lai = *old_lai;
+ lfp->new_lai = *new_lai;
+ lfp->lu_by_tmsi = true;
+ lfp->parent_event_success = parent_event_success;
+ lfp->parent_event_failure = parent_event_failure;
+ lfp->parent_event_data = parent_event_data;
+ lfp->authentication_required = authentication_required;
+ lfp->is_ciphering_to_be_attempted = is_ciphering_to_be_attempted;
+ lfp->is_ciphering_required = is_ciphering_required;
+ lfp->key_seq = key_seq;
+ lfp->is_r99 = is_r99;
+ lfp->is_utran = is_utran;
+ lfp->assign_tmsi = assign_tmsi;
+ if (imsi) {
+ strncpy(lfp->imsi, imsi, sizeof(lfp->imsi)-1);
+ lfp->imsi[sizeof(lfp->imsi)-1] = '\0';
+ lfp->lu_by_tmsi = false;
+ }
+ fi->priv = lfp;
+
+ return fi;
+}
+
+struct osmo_fsm_inst *
+vlr_loc_update(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_lu_type type, uint32_t tmsi, const char *imsi,
+ const struct osmo_location_area_id *old_lai,
+ const struct osmo_location_area_id *new_lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran,
+ bool assign_tmsi)
+{
+ struct osmo_fsm_inst *fi = _vlr_loc_update(
+ parent,
+ parent_event_success,
+ parent_event_failure,
+ parent_event_data,
+ vlr, msc_conn_ref,
+ type, tmsi, imsi,
+ old_lai,
+ new_lai,
+ authentication_required,
+ is_ciphering_to_be_attempted,
+ is_ciphering_required,
+ key_seq,
+ is_r99, is_utran,
+ assign_tmsi);
+
+ if (!fi)
+ return NULL;
+
+ LOGPFSM(fi, "rev=%s net=%s%s%s\n",
+ is_r99 ? "R99" : "GSM",
+ is_utran ? "UTRAN" : "GERAN",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ " Auth" : " (no Auth)",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ (is_ciphering_to_be_attempted ? "+Ciph" : " (no Ciph)")
+ : "");
+
+ if (is_utran && !authentication_required)
+ LOGPFSML(fi, LOGL_ERROR,
+ "Authentication off on UTRAN network. Good luck.\n");
+
+ osmo_fsm_inst_dispatch(fi, VLR_ULA_E_UPDATE_LA, NULL);
+
+ return fi;
+}
+
+
+struct osmo_fsm_inst *
+vlr_ra_update(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_lu_type type, uint32_t tmsi, const char *imsi,
+ const struct osmo_routing_area_id *old_rai,
+ const struct osmo_routing_area_id *new_rai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran,
+ bool assign_tmsi)
+{
+ struct lu_fsm_priv *lfp;
+ struct osmo_fsm_inst *fi = _vlr_loc_update(
+ parent,
+ parent_event_success,
+ parent_event_failure,
+ parent_event_data,
+ vlr, msc_conn_ref,
+ type, tmsi, imsi,
+ &old_rai->lac,
+ &new_rai->lac,
+ authentication_required,
+ is_ciphering_to_be_attempted,
+ is_ciphering_required,
+ key_seq,
+ is_r99, is_utran,
+ assign_tmsi);
+
+ if (!fi)
+ return NULL;
+
+ lfp = fi->priv;
+ lfp->old_rai = *old_rai;
+ lfp->new_rai = *new_rai;
+
+ LOGPFSM(fi, "rev=%s net=%s%s%s\n",
+ is_r99 ? "R99" : "GSM",
+ is_utran ? "UTRAN" : "GERAN",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ " Auth" : " (no Auth)",
+ (authentication_required || is_ciphering_to_be_attempted) ?
+ (is_ciphering_to_be_attempted ? "+Ciph" : " (no Ciph)")
+ : "");
+
+ if (is_utran && !authentication_required)
+ LOGPFSML(fi, LOGL_ERROR,
+ "Authentication off on UTRAN network. Good luck.\n");
+
+ osmo_fsm_inst_dispatch(fi, VLR_ULA_E_UPDATE_LA, NULL);
+
+ return fi;
+}
+
+void vlr_loc_update_cancel(struct osmo_fsm_inst *fi,
+ enum osmo_fsm_term_cause fsm_cause,
+ uint8_t gsm48_cause)
+{
+ struct lu_fsm_priv *lfp;
+
+ OSMO_ASSERT(fi);
+ OSMO_ASSERT(fi->fsm == &vlr_lu_fsm);
+
+ lfp = fi->priv;
+ lfp->rej_cause = gsm48_cause;
+
+ if (fi->state != VLR_ULA_S_DONE)
+ lu_fsm_failure(fi, gsm48_cause);
+}
+
+void vlr_lu_fsm_init(bool is_ps)
+{
+ if (is_ps) {
+ lu_fsm_state_tdef = sgsn_lu_tdef_states;
+ lu_compl_fsm_state_tdef = sgsn_lu_compl_tdef_states;
+ } else {
+ lu_fsm_state_tdef = msc_lu_tdef_states;
+ lu_compl_fsm_state_tdef = msc_lu_compl_tdef_states;
+ }
+
+ OSMO_ASSERT(osmo_fsm_register(&vlr_lu_fsm) == 0);
+ OSMO_ASSERT(osmo_fsm_register(&upd_hlr_vlr_fsm) == 0);
+ OSMO_ASSERT(osmo_fsm_register(&sub_pres_vlr_fsm) == 0);
+ OSMO_ASSERT(osmo_fsm_register(&lu_compl_vlr_fsm) == 0);
+}
+
+void vlr_lu_fsm_set_log_subsys(int log_subsys)
+{
+ vlr_lu_fsm.log_subsys = log_subsys;
+ upd_hlr_vlr_fsm.log_subsys = log_subsys;
+ sub_pres_vlr_fsm.log_subsys = log_subsys;
+ lu_compl_vlr_fsm.log_subsys = log_subsys;
+}
diff --git a/src/libvlr/vlr_lu_fsm.h b/src/libvlr/vlr_lu_fsm.h
new file mode 100644
index 0000000..1eee75d
--- /dev/null
+++ b/src/libvlr/vlr_lu_fsm.h
@@ -0,0 +1,20 @@
+#pragma once
+
+#include <osmocom/core/fsm.h>
+
+enum vlr_lu_state {
+ VLR_ULA_S_IDLE,
+ VLR_ULA_S_WAIT_IMEISV,
+ VLR_ULA_S_WAIT_PVLR, /* Waiting for ID from PVLR */
+ VLR_ULA_S_WAIT_AUTH, /* Waiting for Authentication */
+ VLR_ULA_S_WAIT_CIPH, /* Waiting for Ciphering Complete */
+ VLR_ULA_S_WAIT_IMSI, /* Waiting for IMSI from MS */
+ VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY, /* Waiting for Check IMEI result from HLR */
+ VLR_ULA_S_WAIT_HLR_UPD, /* Waiting for end of HLR update */
+ VLR_ULA_S_WAIT_LU_COMPL,/* Waiting for LU complete */
+ VLR_ULA_S_WAIT_LU_COMPL_STANDALONE, /* Standalone VLR */
+ VLR_ULA_S_DONE
+};
+
+void vlr_lu_fsm_init(bool is_ps);
+void vlr_lu_fsm_set_log_subsys(int log_subsys);
diff --git a/src/libvlr/vlr_sgs.c b/src/libvlr/vlr_sgs.c
new file mode 100644
index 0000000..f7fea09
--- /dev/null
+++ b/src/libvlr/vlr_sgs.c
@@ -0,0 +1,369 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <errno.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/vlr/vlr.h>
+#include <osmocom/vlr/vlr_sgs.h>
+
+#include "vlr_core.h"
+#include "vlr_sgs_fsm.h"
+
+const struct value_string sgs_state_timer_names[] = {
+ {SGS_STATE_TS5, "Ts5"},
+ {SGS_STATE_TS6_2, "Ts6-2"},
+ {SGS_STATE_TS7, "Ts7"},
+ {SGS_STATE_TS11, "Ts11"},
+ {SGS_STATE_TS14, "Ts14"},
+ {SGS_STATE_TS15, "Ts15"},
+ {0, NULL}
+};
+
+const struct value_string sgs_state_counter_names[] = {
+ {SGS_STATE_NS7, "Ns7"},
+ {SGS_STATE_NS11, "Ns11"},
+ {0, NULL}
+};
+
+/* Reset all SGs-Associations back to zero.
+ * \param[in] vlr VLR instance. */
+void vlr_sgs_reset(struct vlr_instance *vlr)
+{
+ struct vlr_subscr *vsub;
+
+ OSMO_ASSERT(vlr);
+
+ LOGSGS(LOGL_INFO, "dropping all SGs associations.\n");
+
+ llist_for_each_entry(vsub, &vlr->subscribers, list) {
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_RESET_FROM_MME, NULL);
+ }
+}
+
+/*! Perform an SGs location update.
+ * \param[in] vlr VLR instance.
+ * \param[in] cfg SGs interface configuration parameters.
+ * \param[in] response_cb callback function that is called when LU is done.
+ * \param[in] paging_cb callback function that is called when LU needs to page.
+ * \param[in] mminfo_cb callback function that is called to provide MM info to the UE.
+ * \param[in] mme_name fqdn of the requesting MME (mme-name).
+ * \param[in] type location update type (normal or IMSI attach).
+ * \param[in] imsi mobile identity (IMSI).
+ * \param[in] new_lai identifier of the new location area.
+ * \param[in] last_eutran_plnm_id Last E-UTRAN PLMN ID (can be NULL).
+ * \returns 0 in case of success, -EINVAL in case of error. */
+int vlr_sgs_loc_update(struct vlr_instance *vlr, struct vlr_sgs_cfg *cfg,
+ vlr_sgs_lu_response_cb_t response_cb, vlr_sgs_lu_paging_cb_t paging_cb,
+ vlr_sgs_lu_mminfo_cb_t mminfo_cb, char *mme_name, enum vlr_lu_type type, const char *imsi,
+ struct osmo_location_area_id *new_lai, struct osmo_plmn_id *last_eutran_plmn)
+{
+ struct vlr_subscr *vsub = NULL;
+
+ OSMO_ASSERT(response_cb);
+ OSMO_ASSERT(paging_cb);
+ OSMO_ASSERT(mminfo_cb);
+ OSMO_ASSERT(cfg);
+ OSMO_ASSERT(imsi);
+
+ vsub = vlr_subscr_find_or_create_by_imsi(vlr, imsi, VSUB_USE_SGS_LU, NULL);
+ if (!vsub) {
+ LOGSGS(LOGL_ERROR, "VLR subscriber allocation failed\n");
+ return -EINVAL;
+ }
+
+ vsub->sgs.cfg = *cfg;
+ vsub->sgs.response_cb = response_cb;
+ vsub->sgs.paging_cb = paging_cb;
+ vsub->sgs.mminfo_cb = mminfo_cb;
+ vlr_subscr_set_imsi(vsub, imsi);
+ vlr_subscr_set_last_used_eutran_plmn_id(vsub, last_eutran_plmn);
+ osmo_strlcpy(vsub->sgs.mme_name, mme_name, sizeof(vsub->sgs.mme_name));
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_LU_FROM_MME, NULL);
+
+ /* FIXME: Use the "type" type parameter (for what is it useful?) */
+
+ vsub->sgs.lai = *new_lai;
+ vsub->cgi.lai = *new_lai;
+ vsub->cs.lac = vsub->sgs.lai.lac;
+
+ /* Subscribers that are created by the SGs location update will not
+ * expire automatically, however a 2G LU or an implicit IMSI detach
+ * from EPS services may change this. */
+ vsub->expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION;
+
+ return 0;
+}
+
+/*! Notify that the SGs Location Update accept message has been sent to MME.
+ * \param[in] vsub VLR subscriber. */
+void vlr_sgs_loc_update_acc_sent(struct vlr_subscr *vsub)
+{
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_TX_LU_ACCEPT, NULL);
+
+ /* Balance vlr_subscr_find_or_create_by_imsi() in vlr_sgs_loc_update() */
+ vlr_subscr_put(vsub, VSUB_USE_SGS_LU);
+
+ /* FIXME: At this point we need to check the status of Ts5 and if
+ * it is still running this means the LU has interrupted the paging,
+ * and we need to start paging again. 3GPP TS 29.118,
+ * chapter 5.2.3.2 */
+}
+
+/*! Notify that the SGs Location Update reject message has been sent to MME.
+ * \param[in] vsub VLR subscriber. */
+void vlr_sgs_loc_update_rej_sent(struct vlr_subscr *vsub)
+{
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_TX_LU_REJECT, NULL);
+ /* Balance vlr_subscr_find_or_create_by_imsi() in vlr_sgs_loc_update() */
+ vlr_subscr_put(vsub, VSUB_USE_SGS_LU);
+}
+
+/*! Perform an SGs IMSI detach.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI).
+ * \param[in] type datach type. */
+void vlr_sgs_imsi_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_noneps_type type)
+{
+ struct vlr_subscr *vsub;
+ enum sgs_ue_fsm_event evt;
+
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ /* See also: 3GPP TS 29.118, 5.6.3 Procedures in the VLR: In case of
+ * an implicit detach, we are supposed to check if the state of the
+ * SGs-association, and only when it is not SGs-NULL, we may proceed. */
+ if (vsub->sgs_fsm->state == SGS_UE_ST_NULL && type == SGSAP_ID_NONEPS_T_IMPLICIT_UE_EPS_NONEPS) {
+ vlr_subscr_put(vsub, __func__);
+ return;
+ }
+
+ switch (type) {
+ case SGSAP_ID_NONEPS_T_EXPLICIT_UE_NONEPS:
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_UE;
+ break;
+ case SGSAP_ID_NONEPS_T_COMBINED_UE_EPS_NONEPS:
+ case SGSAP_ID_NONEPS_T_IMPLICIT_UE_EPS_NONEPS:
+ /* FIXME: Is that right? */
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_MME;
+ break;
+ default:
+ LOGSGS(LOGL_ERROR, "(sub %s) invalid SGS IMSI detach type, detaching anyway...\n",
+ vlr_subscr_msisdn_or_name(vsub));
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_MME;
+ break;
+ }
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, evt, NULL);
+
+ /* Detaching from non EPS services essentially means that the
+ * subscriber is detached from 2G. In any case the VLR will
+ * get rid of the subscriber. */
+ vlr_subscr_expire(vsub);
+ vlr_subscr_put(vsub, __func__);
+}
+
+/*! Perform an SGs EPS detach.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI).
+ * \param[in] type datach type. */
+void vlr_sgs_eps_detach(struct vlr_instance *vlr, const char *imsi, enum sgsap_imsi_det_eps_type type)
+{
+ struct vlr_subscr *vsub;
+ enum sgs_ue_fsm_event evt;
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ switch (type) {
+ case SGSAP_ID_EPS_T_NETWORK_INITIATED:
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_MME;
+ break;
+ case SGSAP_ID_EPS_T_UE_INITIATED:
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_UE;
+ break;
+ case SGSAP_ID_EPS_T_EPS_NOT_ALLOWED:
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_MME;
+ break;
+ default:
+ LOGSGS(LOGL_ERROR, "(sub %s) invalid SGS IMSI detach type, detaching anyway...\n",
+ vlr_subscr_msisdn_or_name(vsub));
+ evt = SGS_UE_E_RX_DETACH_IND_FROM_MME;
+ break;
+ }
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, evt, NULL);
+
+ /* See also 3GPP TS 29.118, 5.4.3 Procedures in the VLR. Detaching from
+ * EPS services essentially means that the subscriber leaves the 4G RAN
+ * but continues to live on 2G, this basically turns the subscriber into
+ * a normal 2G subscriber and we need to make sure that the lu-
+ * expiration timer is running. */
+ if (vsub->expire_lu == VLR_SUBSCRIBER_NO_EXPIRATION)
+ vlr_subscr_enable_expire_lu(vsub);
+
+ vlr_subscr_put(vsub, __func__);
+}
+
+/*! Perform an SGs TMSI reallocation complete.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI). */
+void vlr_sgs_tmsi_reall_compl(struct vlr_instance *vlr, const char *imsi)
+{
+ struct vlr_subscr *vsub;
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_TMSI_REALLOC, NULL);
+ vlr_subscr_put(vsub, __func__);
+}
+
+/*! Notify that an SGs paging has been rejected by the MME.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI).
+ * \param[in] cause SGs cause code. */
+void vlr_sgs_pag_rej(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause)
+{
+ struct vlr_subscr *vsub;
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ /* On the reception of a paging rej the VLR is supposed to stop Ts5,
+ also 3GPP TS 29.118, chapter 5.1.2.4 */
+ osmo_timer_del(&vsub->sgs.Ts5);
+ LOGSGS(LOGL_DEBUG, "(sub %s) Paging via SGs interface rejected by MME, %s stopped, cause: %s!\n",
+ vlr_subscr_msisdn_or_name(vsub), vlr_sgs_state_timer_name(SGS_STATE_TS5), sgsap_sgs_cause_name(cause));
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_PAGING_FAILURE, &cause);
+ /* Balance ref count increment from vlr_sgs_pag() */
+ vlr_subscr_put(vsub, VSUB_USE_SGS_PAGING_REQ);
+
+ vlr_subscr_put(vsub, __func__);
+}
+
+/*! Notify that an SGs paging has been accepted by the MME.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI). */
+void vlr_sgs_pag_ack(struct vlr_instance *vlr, const char *imsi)
+{
+ struct vlr_subscr *vsub;
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ /* Stop Ts5 and and consider the paging as successful */
+ osmo_timer_del(&vsub->sgs.Ts5);
+ /* Balance ref count increment from vlr_sgs_pag() */
+ vlr_subscr_put(vsub, VSUB_USE_SGS_PAGING_REQ);
+
+ vlr_subscr_put(vsub, __func__);
+}
+
+/*! Notify that the UE has been marked as unreachable by the MME.
+ * \param[in] vsub VLR subscriber.
+ * \param[in] imsi mobile identity (IMSI).
+ * \param[in] cause SGs cause code. */
+void vlr_sgs_ue_unr(struct vlr_instance *vlr, const char *imsi, enum sgsap_sgs_cause cause)
+{
+ struct vlr_subscr *vsub;
+ vsub = vlr_subscr_find_by_imsi(vlr, imsi, __func__);
+ if (!vsub)
+ return;
+
+ /* On the reception of an UE unreachable the VLR is supposed to stop
+ * Ts5, also 3GPP TS 29.118, chapter 5.1.2.5 */
+ osmo_timer_del(&vsub->sgs.Ts5);
+ LOGSGS(LOGL_DEBUG,
+ "(sub %s) Paging via SGs interface not possible, UE unreachable, %s stopped, cause: %s\n",
+ vlr_subscr_msisdn_or_name(vsub), vlr_sgs_state_timer_name(SGS_STATE_TS5), sgsap_sgs_cause_name(cause));
+
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_RX_SGSAP_UE_UNREACHABLE, &cause);
+ vlr_subscr_put(vsub, __func__);
+}
+
+/* Callback function that is called when an SGs paging request times out */
+static void Ts5_timeout_cb(void *arg)
+{
+ struct vlr_subscr *vsub = arg;
+
+ /* 3GPP TS 29.118 does not specify a specific action that has to happen
+ * in case Ts5 times out. The timeout just indicates that the paging
+ * failed. Other actions may check the status of Ts5 to see if a paging
+ * is still ongoing or not. */
+
+ LOGSGS(LOGL_ERROR, "(sub %s) Paging via SGs interface timed out (%s expired)!\n",
+ vlr_subscr_msisdn_or_name(vsub), vlr_sgs_state_timer_name(SGS_STATE_TS5));
+
+ /* Balance ref count increment from vlr_sgs_pag() */
+ vlr_subscr_put(vsub, VSUB_USE_SGS_PAGING_REQ);
+
+ return;
+}
+
+/*! Notify that a paging message has been sent and a paging is now in progress.
+ * \param[in] vsub VLR subscriber. */
+void vlr_sgs_pag(struct vlr_subscr *vsub, enum sgsap_service_ind serv_ind)
+{
+
+ /* In cases where we have to respawn a paging after an intermitted LU,
+ * there may e a Ts5 still running. In those cases we have to remove
+ * the old timer first */
+ if (osmo_timer_pending(&vsub->sgs.Ts5))
+ osmo_timer_del(&vsub->sgs.Ts5);
+
+ /* Note: 3GPP TS 29.118, chapter 4.2.2 mentions paging in the FSM
+ * diagram, but paging never causes a state transition except when
+ * an explicit failure is indicated (MME actively rejects paging).
+ * Apparently it is also possible that an LU happens while the paging
+ * is still ongoing and Ts5 is running. (chapter 5.1.2.3). This means
+ * that the paging procedure is intended to run in parallel to the
+ * SGs FSM and given that the benaviour around Ts5 must be implemented
+ * also separately, to emphasize this separation Ts5 is implemented
+ * here in and not in vlr_sgs_fsm.c. */
+ osmo_timer_setup(&vsub->sgs.Ts5, Ts5_timeout_cb, vsub);
+ osmo_timer_schedule(&vsub->sgs.Ts5, vsub->sgs.cfg.timer[SGS_STATE_TS5], 0);
+
+ /* Formally 3GPP TS 29.118 defines the sending of a paging request
+ * as an event, but as far as the VLR is concerned only Ts5 is
+ * started. */
+ osmo_fsm_inst_dispatch(vsub->sgs_fsm, SGS_UE_E_TX_PAGING, NULL);
+
+ /* Memorize service type in for the case that the paging must be
+ * respawned after an LU */
+ vsub->sgs.paging_serv_ind = serv_ind;
+
+ /* Ensure that the reference count is increased by one while the
+ * paging is happening. We will balance this again in vlr_sgs_pag_rej()
+ * and vlr_sgs_pag_ack(); */
+ vlr_subscr_get(vsub, VSUB_USE_SGS_PAGING_REQ);
+}
+
+/*! Check if the SGs interface is currently paging
+ * \param[in] vsub VLR subscriber. */
+bool vlr_sgs_pag_pend(struct vlr_subscr *vsub)
+{
+ return osmo_timer_pending(&vsub->sgs.Ts5);
+}
diff --git a/src/libvlr/vlr_sgs_fsm.c b/src/libvlr/vlr_sgs_fsm.c
new file mode 100644
index 0000000..f576b86
--- /dev/null
+++ b/src/libvlr/vlr_sgs_fsm.c
@@ -0,0 +1,416 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/fsm.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/vlr/vlr.h>
+#include <osmocom/vlr/vlr_sgs.h>
+
+#include "vlr_sgs_fsm.h"
+#include "vlr_core.h"
+
+#define S(x) (1 << (x))
+
+static const struct value_string sgs_ue_fsm_event_names[] = {
+ {SGS_UE_E_VLR_FAILURE, "VLR_FAILURE"},
+ {SGS_UE_E_RX_RESET_FROM_MME, "RX_RESET_FROM_MME"},
+ {SGS_UE_E_RX_DETACH_IND_FROM_MME, "RX_DETACH_IND_FROM_MME"},
+ {SGS_UE_E_RX_DETACH_IND_FROM_UE, "RX_DETACH_IND_FROM_UE"}, /* vlr.c */
+ {SGS_UE_E_RX_LU_FROM_A_IU_GS, "RX_LU_FROM_A_Iu_Gs"}, /* vlr_lu_fsm.c */
+ {SGS_UE_E_RX_PAGING_FAILURE, "RX_PAGING_FAILURE"},
+ {SGS_UE_E_RX_ALERT_FAILURE, "RX_ALERT_FAILURE"},
+ {SGS_UE_E_RX_LU_FROM_MME, "RX_LU_FROM_MME"},
+ {SGS_UE_E_TX_LU_REJECT, "TX_LU_REJECT"},
+ {SGS_UE_E_TX_LU_ACCEPT, "TX_LU_ACCEPT"},
+ {SGS_UE_E_TX_PAGING, "TX_PAGING"},
+ {SGS_UE_E_RX_SGSAP_UE_UNREACHABLE, "RX_SGSAP_UE_UNREACH"},
+ {SGS_UE_E_RX_TMSI_REALLOC, "RX_TMSI_REALLOC"},
+ {0, NULL}
+};
+
+/* Send the SGs Association to NULL state immediately */
+static void to_null(struct osmo_fsm_inst *fi)
+{
+ struct vlr_subscr *vsub = fi->priv;
+ osmo_fsm_inst_state_chg(fi, SGS_UE_ST_NULL, 0, 0);
+
+ /* Note: This is only relevant for cases where we are in the middle
+ * of an TMSI reallocation procedure. Should a failure of some sort
+ * put us to NULL state, we have to free the pending TMSI */
+ vsub->tmsi_new = GSM_RESERVED_TMSI;
+
+ /* Make sure we remove recorded Last EUTRAN PLMN Id when UE ceases to be
+ * available over SGs */
+ vlr_subscr_set_last_used_eutran_plmn_id(vsub, NULL);
+
+ /* Make sure any ongoing paging is aborted. */
+ if (vsub->cs.is_paging && vsub->sgs.paging_cb)
+ vsub->sgs.paging_cb(vsub, SGSAP_SERV_IND_PAGING_TIMEOUT);
+
+ /* Ensure that Ts5 (pending paging via SGs) is deleted */
+ if (vlr_sgs_pag_pend(vsub))
+ osmo_timer_del(&vsub->sgs.Ts5);
+}
+
+/* Initiate location update and change to SGS_UE_ST_LA_UPD_PRES state */
+static void perform_lu(struct osmo_fsm_inst *fi)
+{
+ struct vlr_subscr *vsub = fi->priv;
+ struct sgs_lu_response sgs_lu_response = {0};
+ int rc;
+
+ /* Note: At the moment we allocate a new TMSI on each LU. */
+ rc = vlr_subscr_alloc_tmsi(vsub);
+ if (rc != 0) {
+ LOGPFSML(fi, LOGL_ERROR, "(sub %s) VLR LU tmsi allocation failed\n", vlr_subscr_name(vsub));
+ goto error;
+ }
+
+ rc = vlr_subscr_req_lu(vsub);
+ if (rc != 0) {
+ LOGPFSML(fi, LOGL_ERROR, "(sub %s) HLR LU request failed\n", vlr_subscr_name(vsub));
+ goto error;
+ }
+
+ osmo_fsm_inst_state_chg(fi, SGS_UE_ST_LA_UPD_PRES, 0, 0);
+ vsub->ms_not_reachable_flag = false;
+ return;
+
+error:
+ to_null(fi);
+ sgs_lu_response.error = true;
+ sgs_lu_response.vsub = vsub;
+ vsub->sgs.response_cb(&sgs_lu_response);
+}
+
+/* Respawn a pending paging (Timer is reset and a new paging request is sent) */
+static void respawn_paging(struct vlr_subscr *vsub)
+{
+ if (vlr_sgs_pag_pend(vsub)) {
+
+ /* Delete the old paging timer first. */
+ osmo_timer_del(&vsub->sgs.Ts5);
+
+ /* Issue a fresh paging request */
+ vsub->sgs.paging_cb(vsub, vsub->sgs.paging_serv_ind);
+ }
+}
+
+/* Figure 4.2.2.1 SGs-NULL */
+static void sgs_ue_fsm_null(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ switch (event) {
+ case SGS_UE_E_RX_LU_FROM_MME:
+ perform_lu(fi);
+ break;
+ case SGS_UE_E_TX_PAGING:
+ /* do nothing */
+ break;
+ case SGS_UE_E_RX_PAGING_FAILURE:
+ /* do nothing */
+ break;
+ default:
+ OSMO_ASSERT(0);
+ }
+}
+
+/* Figure 4.2.2.1 SGs-LA-UPDATE-PRESENT */
+static void sgs_ue_fsm_lau_present(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct vlr_subscr *vsub = fi->priv;
+ enum sgsap_sgs_cause *cause = NULL;
+
+ switch (event) {
+ case SGS_UE_E_TX_LU_ACCEPT:
+ vsub->conf_by_radio_contact_ind = true;
+ vsub->sub_dataconf_by_hlr_ind = true;
+ vsub->loc_conf_in_hlr_ind = true;
+ vsub->la_allowed = true;
+ vsub->imsi_detached_flag = false;
+
+ if (!vsub->lu_complete) {
+ vsub->lu_complete = true;
+ /* Balanced by vlr_subscr_expire() */
+ vlr_subscr_get(vsub, VSUB_USE_ATTACHED);
+ }
+
+ vlr_sgs_fsm_update_id(vsub);
+ vsub->cs.attached_via_ran = OSMO_RAT_EUTRAN_SGS;
+
+ /* Check if we expect a TMSI REALLOCATION COMPLETE message from the MME
+ * by checking the tmsi_new flag. If this flag is not GSM_RESERVED_TMSI
+ * we know that we have a TMSI pending and need to wait for the MME
+ * to acknowledge first */
+ if (vsub->tmsi_new != GSM_RESERVED_TMSI) {
+ osmo_fsm_inst_state_chg(fi, SGS_UE_ST_ASSOCIATED, vsub->sgs.cfg.timer[SGS_STATE_TS6_2],
+ SGS_STATE_TS6_2);
+ } else {
+ /* Trigger sending of an MM information request */
+ vsub->sgs.mminfo_cb(vsub);
+
+ /* In cases where the LU has interrupted the paging, respawn the paging now,
+ * See also: 3GPP TS 29.118, chapter 5.2.3.2 Location update response */
+ if (vlr_sgs_pag_pend(vsub))
+ respawn_paging(vsub);
+
+ osmo_fsm_inst_state_chg(fi, SGS_UE_ST_ASSOCIATED, 0, 0);
+ }
+
+ break;
+ case SGS_UE_E_RX_PAGING_FAILURE:
+ cause = data;
+ if (*cause == SGSAP_SGS_CAUSE_MT_CSFB_REJ_USER)
+ break;
+ to_null(fi);
+ break;
+ case SGS_UE_E_TX_LU_REJECT:
+ case SGS_UE_E_RX_ALERT_FAILURE:
+ to_null(fi);
+ break;
+ case SGS_UE_E_TX_PAGING:
+ /* do nothing */
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Figure 4.2.2.1 SGs-ASSOCIATED */
+static void sgs_ue_fsm_associated(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct vlr_subscr *vsub = fi->priv;
+ enum sgsap_sgs_cause *cause = NULL;
+
+ switch (event) {
+ case SGS_UE_E_TX_PAGING:
+ /* do nothing */
+ break;
+ case SGS_UE_E_RX_TMSI_REALLOC:
+ if (vsub->tmsi_new == GSM_RESERVED_TMSI) {
+ LOGPFSML(fi, LOGL_ERROR,
+ "(sub %s) TMSI reallocation completed at the MME, but no TMSI reallocation ordered.\n",
+ vlr_subscr_msisdn_or_name(vsub));
+ }
+
+ vsub->tmsi = vsub->tmsi_new;
+ vsub->tmsi_new = GSM_RESERVED_TMSI;
+
+ /* Trigger sending of MM information */
+ vsub->sgs.mminfo_cb(vsub);
+
+ /* In cases where the LU has interrupted the paging, respawn the paging now,
+ * See also: 3GPP TS 29.118, chapter 5.2.3.2 Location update response */
+ if (vlr_sgs_pag_pend(vsub))
+ respawn_paging(vsub);
+
+ /* Note: We are already in SGS_UE_ST_ASSOCIATED but the
+ * transition that lead us here had is guarded with Ts6-1,
+ * so we change the state now once more without timeout
+ * to ensure the timer is stopped */
+ osmo_fsm_inst_state_chg(fi, SGS_UE_ST_ASSOCIATED, 0, 0);
+ break;
+ case SGS_UE_E_RX_SGSAP_UE_UNREACHABLE:
+ /* do nothing */
+ break;
+ case SGS_UE_E_RX_PAGING_FAILURE:
+ cause = data;
+ if (*cause == SGSAP_SGS_CAUSE_MT_CSFB_REJ_USER)
+ break;
+ to_null(fi);
+ break;
+ case SGS_UE_E_RX_ALERT_FAILURE:
+ to_null(fi);
+ break;
+ case SGS_UE_E_RX_LU_FROM_MME:
+ perform_lu(fi);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+/* Figure 4.2.2.1 From any of the three states (at the VLR) */
+static void sgs_ue_fsm_allstate(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct vlr_subscr *vsub = fi->priv;
+
+ switch (event) {
+ case SGS_UE_E_RX_DETACH_IND_FROM_MME:
+ case SGS_UE_E_RX_DETACH_IND_FROM_UE:
+ vsub->imsi_detached_flag = true;
+ vsub->expire_lu = VLR_SUBSCRIBER_NO_EXPIRATION;
+ /* See 5.4.3 and 5.5.3 */
+ to_null(fi);
+ break;
+ case SGS_UE_E_RX_RESET_FROM_MME:
+ /* See also 3GPP TS 29.118, chapter 5.7.2.1 VLR Reset Initiation */
+ vsub->conf_by_radio_contact_ind = false;
+ to_null(fi);
+ break;
+ case SGS_UE_E_VLR_FAILURE:
+ case SGS_UE_E_RX_LU_FROM_A_IU_GS:
+ to_null(fi);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+static int sgs_ue_fsm_timer_cb(struct osmo_fsm_inst *fi)
+{
+ struct vlr_subscr *vsub = fi->priv;
+ switch (fi->T) {
+
+ case SGS_STATE_TS6_2:
+ /* Failed TMSI reallocation procedure, deallocate all TMSI
+ * information, but don't change the SGs association state. */
+ vsub->tmsi_new = GSM_RESERVED_TMSI;
+ vsub->tmsi = GSM_RESERVED_TMSI;
+ break;
+ default:
+ /* Unhandled timer */
+ OSMO_ASSERT(false);
+ break;
+ }
+ return 0;
+}
+
+static const struct osmo_fsm_state sgs_ue_fsm_states[] = {
+ [SGS_UE_ST_NULL] = {
+ .name = "SGs-NULL",
+ .action = sgs_ue_fsm_null,
+ .in_event_mask = 0
+ | S(SGS_UE_E_RX_LU_FROM_MME)
+ | S(SGS_UE_E_TX_PAGING)
+ | S(SGS_UE_E_RX_PAGING_FAILURE)
+ ,
+ .out_state_mask = 0
+ | S(SGS_UE_ST_NULL)
+ | S(SGS_UE_ST_LA_UPD_PRES)
+ ,
+ },
+ [SGS_UE_ST_LA_UPD_PRES] = {
+ .name = "SGs-LA-UPDATE-PRESENT",
+ .action = sgs_ue_fsm_lau_present,
+ .in_event_mask = 0
+ | S(SGS_UE_E_TX_LU_ACCEPT)
+ | S(SGS_UE_E_TX_LU_REJECT)
+ | S(SGS_UE_E_TX_PAGING)
+ | S(SGS_UE_E_RX_PAGING_FAILURE)
+ | S(SGS_UE_E_RX_ALERT_FAILURE)
+ ,
+ .out_state_mask = 0
+ | S(SGS_UE_ST_NULL)
+ | S(SGS_UE_ST_ASSOCIATED)
+ | S(SGS_UE_ST_LA_UPD_PRES)
+ ,
+ },
+ [SGS_UE_ST_ASSOCIATED] = {
+ .name = "SGs-ASSOCIATED",
+ .action = sgs_ue_fsm_associated,
+ .in_event_mask = 0
+ | S(SGS_UE_E_TX_PAGING)
+ | S(SGS_UE_E_RX_TMSI_REALLOC)
+ | S(SGS_UE_E_RX_SGSAP_UE_UNREACHABLE)
+ | S(SGS_UE_E_RX_PAGING_FAILURE)
+ | S(SGS_UE_E_RX_ALERT_FAILURE)
+ | S(SGS_UE_E_RX_LU_FROM_MME)
+ ,
+ .out_state_mask = 0
+ | S(SGS_UE_ST_NULL)
+ | S(SGS_UE_ST_ASSOCIATED)
+ | S(SGS_UE_ST_LA_UPD_PRES)
+ ,
+ },
+};
+
+static struct osmo_fsm sgs_ue_fsm = {
+ .name = "SGs-UE",
+ .states = sgs_ue_fsm_states,
+ .num_states = ARRAY_SIZE(sgs_ue_fsm_states),
+ .allstate_event_mask = S(SGS_UE_E_RX_RESET_FROM_MME) |
+ S(SGS_UE_E_VLR_FAILURE) | S(SGS_UE_E_RX_DETACH_IND_FROM_MME) | S(SGS_UE_E_RX_DETACH_IND_FROM_UE) |
+ S(SGS_UE_E_RX_LU_FROM_A_IU_GS),
+ .allstate_action = sgs_ue_fsm_allstate,
+ .timer_cb = sgs_ue_fsm_timer_cb,
+ .log_subsys = DLGLOBAL,
+ .event_names = sgs_ue_fsm_event_names,
+};
+
+/*! Initialize/Register SGs FSM in osmo-fsm subsystem */
+void vlr_sgs_fsm_init(void)
+{
+ if (osmo_fsm_find_by_name(sgs_ue_fsm.name) != &sgs_ue_fsm)
+ OSMO_ASSERT(osmo_fsm_register(&sgs_ue_fsm) == 0);
+}
+
+/*! Set the log level of the fsm */
+void vlr_sgs_fsm_set_log_subsys(int log_level)
+{
+ sgs_ue_fsm.log_subsys = log_level;
+}
+
+/*! Crate SGs FSM in struct vlr_subscr.
+ * \param[in] vsub VLR subscriber for which the SGs FSM should be created. */
+void vlr_sgs_fsm_create(struct vlr_subscr *vsub)
+{
+ char interim_fsm_id[256];
+ static unsigned int fsm_id_num = 0;
+
+ /* An SGSs FSM must not be created twice! */
+ OSMO_ASSERT(!vsub->sgs_fsm);
+
+ snprintf(interim_fsm_id, sizeof(interim_fsm_id), "num:%u", fsm_id_num);
+
+ vsub->sgs_fsm = osmo_fsm_inst_alloc(&sgs_ue_fsm, vsub, vsub, LOGL_INFO, interim_fsm_id);
+ OSMO_ASSERT(vsub->sgs_fsm);
+
+ osmo_fsm_inst_state_chg(vsub->sgs_fsm, SGS_UE_ST_NULL, 0, 0);
+
+ fsm_id_num++;
+}
+
+/*! Remove SGs FSM from struct vlr_subscr.
+ * \param[in] vsub VLR subscriber from which the SGs FSM should be removed. */
+void vlr_sgs_fsm_remove(struct vlr_subscr *vsub)
+{
+ /* An SGSs FSM must exist! */
+ OSMO_ASSERT(vsub->sgs_fsm);
+
+ osmo_fsm_inst_state_chg(vsub->sgs_fsm, SGS_UE_ST_NULL, 0, 0);
+ osmo_fsm_inst_term(vsub->sgs_fsm, OSMO_FSM_TERM_REGULAR, NULL);
+ vsub->sgs_fsm = NULL;
+}
+
+/*! Update the ID of the SGs FSM with the subscriber IMSI
+ * \param[in] vsub VLR subscriber to update. */
+void vlr_sgs_fsm_update_id(struct vlr_subscr *vsub)
+{
+ char fsm_id[256];
+
+ if (strlen(vsub->imsi) > 0) {
+ snprintf(fsm_id, sizeof(fsm_id), "imsi:%s", vsub->imsi);
+ osmo_fsm_inst_update_id(vsub->sgs_fsm, fsm_id);
+ }
+}
diff --git a/src/libvlr/vlr_sgs_fsm.h b/src/libvlr/vlr_sgs_fsm.h
new file mode 100644
index 0000000..f36ed32
--- /dev/null
+++ b/src/libvlr/vlr_sgs_fsm.h
@@ -0,0 +1,45 @@
+/* (C) 2018-2019 by sysmocom s.f.m.c. GmbH
+ * All Rights Reserved
+ *
+ * Author: Harald Welte, Philipp Maier
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+struct vlr_subscr;
+
+enum sgs_ue_fsm_event {
+ SGS_UE_E_VLR_FAILURE,
+ SGS_UE_E_RX_RESET_FROM_MME,
+ SGS_UE_E_RX_DETACH_IND_FROM_MME,
+ SGS_UE_E_RX_DETACH_IND_FROM_UE,
+ SGS_UE_E_RX_LU_FROM_A_IU_GS,
+ SGS_UE_E_RX_PAGING_FAILURE,
+ SGS_UE_E_RX_ALERT_FAILURE,
+ SGS_UE_E_RX_LU_FROM_MME,
+ SGS_UE_E_TX_LU_REJECT,
+ SGS_UE_E_TX_LU_ACCEPT,
+ SGS_UE_E_TX_PAGING,
+ SGS_UE_E_RX_SGSAP_UE_UNREACHABLE,
+ SGS_UE_E_RX_TMSI_REALLOC,
+};
+
+void vlr_sgs_fsm_init(void);
+void vlr_sgs_fsm_set_log_subsys(int log_subsys);
+void vlr_sgs_fsm_create(struct vlr_subscr *vsub);
+void vlr_sgs_fsm_remove(struct vlr_subscr *vsub);
+void vlr_sgs_fsm_update_id(struct vlr_subscr *vsub);
diff --git a/src/sgsn/Makefile.am b/src/sgsn/Makefile.am
index 660e490..a2c6901 100644
--- a/src/sgsn/Makefile.am
+++ b/src/sgsn/Makefile.am
@@ -80,6 +80,7 @@
$(top_builddir)/src/gprs/crc24.o \
$(top_builddir)/src/gprs/gprs_utils.o \
$(top_builddir)/src/gprs/sgsn_ares.o \
+ $(top_builddir)/src/libvlr/libvlr.a \
$(OSMO_LIBS) \
$(LIBOSMOGSUPCLIENT_LIBS) \
$(LIBCARES_LIBS) \
diff --git a/tests/gprs_routing_area/Makefile.am b/tests/gprs_routing_area/Makefile.am
index f95d3ae..e15769d 100644
--- a/tests/gprs_routing_area/Makefile.am
+++ b/tests/gprs_routing_area/Makefile.am
@@ -72,6 +72,7 @@
$(top_builddir)/src/gprs/gprs_llc_parse.o \
$(top_builddir)/src/gprs/crc24.o \
$(top_builddir)/src/gprs/sgsn_ares.o \
+ $(top_builddir)/src/libvlr/libvlr.a \
$(LIBOSMOCORE_LIBS) \
$(LIBOSMOCTRL_LIBS) \
$(LIBOSMOGSM_LIBS) \
diff --git a/tests/sgsn/Makefile.am b/tests/sgsn/Makefile.am
index f698774..85b6d76 100644
--- a/tests/sgsn/Makefile.am
+++ b/tests/sgsn/Makefile.am
@@ -86,6 +86,7 @@
$(top_builddir)/src/gprs/gprs_llc_parse.o \
$(top_builddir)/src/gprs/crc24.o \
$(top_builddir)/src/gprs/sgsn_ares.o \
+ $(top_builddir)/src/libvlr/libvlr.a \
$(LIBOSMOCORE_LIBS) \
$(LIBOSMOCTRL_LIBS) \
$(LIBOSMOGSM_LIBS) \
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39560?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I221114e00e6f338a75ae0dd7ac285e262b23635d
Gerrit-Change-Number: 39560
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
1
0
16 Feb '25
lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39561?usp=email )
Change subject: libvlr: squash libvlr reworks
......................................................................
libvlr: squash libvlr reworks
* logging/debug.h: add own debug
* add PVLR support
* add vlr_ra_update()
* internally use RAI instead of LAI
Change-Id: I7ef8e10e9553181913c66546c97a71b21fa9ef64
---
A include/osmocom/vlr/debug.h
M include/osmocom/vlr/vlr.h
M src/libvlr/vlr.c
M src/libvlr/vlr_lu_fsm.c
4 files changed, 99 insertions(+), 29 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/61/39561/1
diff --git a/include/osmocom/vlr/debug.h b/include/osmocom/vlr/debug.h
new file mode 100644
index 0000000..c1be654
--- /dev/null
+++ b/include/osmocom/vlr/debug.h
@@ -0,0 +1,20 @@
+#pragma once
+
+#include <osmocom/core/logging.h>
+#include <osmocom/sgsn/debug.h>
+
+enum osmo_vlr_cat {
+ OSMO_VLR_LOGC_VLR,
+ OSMO_VLR_LOGC_SGS,
+ _OSMO_VLR_LOGC_MAX,
+};
+
+void osmo_vlr_set_log_cat(enum osmo_vlr_cat logc, int logc_num);
+
+
+// FIXME: private following
+
+extern int g_vlr_log_cat[_OSMO_VLR_LOGC_MAX];
+
+#define LOGVLR(lvl, fmt, args...) LOGP(g_vlr_log_cat[OSMO_VLR_LOGC_VLR], lvl, fmt, ## args)
+#define LOGSGS(lvl, fmt, args...) LOGP(g_vlr_log_cat[OSMO_VLR_LOGC_SGS], lvl, fmt, ## args)
diff --git a/include/osmocom/vlr/vlr.h b/include/osmocom/vlr/vlr.h
index 03b76f3..7bb2ed3 100644
--- a/include/osmocom/vlr/vlr.h
+++ b/include/osmocom/vlr/vlr.h
@@ -244,6 +244,8 @@
int (*tx_mm_info)(void *msc_conn_ref);
+ int (*tx_pvlr_request)(void *msc_conn_ref, const struct osmo_routing_area_id *old_rai);
+
/* notify MSC/SGSN that the subscriber data in VLR has been updated */
void (*subscr_update)(struct vlr_subscr *vsub);
/* notify MSC/SGSN that the given subscriber has been associated
@@ -254,6 +256,9 @@
*/
void (*subscr_inval)(void *msc_conn_ref, struct vlr_subscr *vsub,
enum gsm48_reject_value cause, bool cancel_by_update);
+
+ /* decide if the location/routing area id is within the VLR or not */
+ bool (*location_served)(struct vlr_subscr *vsub, const struct osmo_routing_area_id *rai);
};
/* An instance of the VLR codebase */
@@ -304,6 +309,22 @@
bool is_r99, bool is_utran,
bool assign_tmsi);
+struct osmo_fsm_inst *
+vlr_ra_update(struct osmo_fsm_inst *parent,
+ uint32_t parent_event_success,
+ uint32_t parent_event_failure,
+ void *parent_event_data,
+ struct vlr_instance *vlr, void *msc_conn_ref,
+ enum vlr_lu_type type, uint32_t tmsi, const char *imsi,
+ const struct osmo_routing_area_id *old_lai,
+ const struct osmo_routing_area_id *new_lai,
+ bool authentication_required,
+ bool is_ciphering_to_be_attempted,
+ bool is_ciphering_required,
+ uint8_t key_seq,
+ bool is_r99, bool is_utran,
+ bool assign_tmsi);
+
void vlr_loc_update_cancel(struct osmo_fsm_inst *fi,
enum osmo_fsm_term_cause fsm_cause,
uint8_t gsm48_cause);
@@ -319,6 +340,9 @@
void vlr_subscr_rx_ciph_res(struct vlr_subscr *vsub, enum vlr_ciph_result_cause result);
int vlr_subscr_rx_tmsi_reall_compl(struct vlr_subscr *vsub);
int vlr_subscr_rx_imsi_detach(struct vlr_subscr *vsub);
+int vlr_subscr_rx_rau_complete(struct vlr_subscr *vsub);
+void vlr_subscr_rx_pvlr_id_ack(struct vlr_subscr *vsub);
+void vlr_subscr_rx_pvlr_id_nack(struct vlr_subscr *vsub);
struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops, bool is_ps);
int vlr_start(struct vlr_instance *vlr, struct gsup_client_mux *gcm);
diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index 2b56a8b..54d95de 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -574,6 +574,7 @@
const char *file,
int line)
{
+ /* FIXME: we need to add a type to the tmsi (local, foreign) so overlaps doesn't matter */
struct vlr_subscr *vsub;
vsub = _vlr_subscr_find_by_tmsi(vlr, tmsi, use, file, line);
if (vsub) {
@@ -598,10 +599,13 @@
struct vlr_instance *vlr = exists->vlr;
int i;
int j;
- LOGVSUBP(LOGL_NOTICE, vsub,
- "There is an existing subscriber for IMSI %s used by %s, replacing with this VLR subscr, used by %s\n",
- exists->imsi, osmo_use_count_to_str_c(OTC_SELECT, &exists->use_count),
- osmo_use_count_to_str_c(OTC_SELECT, &vsub->use_count));
+ void *tmp = talloc_zero_size(vsub, 4);
+ LOGVLR(LOGL_NOTICE,
+ "There is an existing subscriber for IMSI %s used by %s, replacing with new VLR subscr: %s used by %s\n",
+ exists->imsi, osmo_use_count_to_str_c(tmp, &exists->use_count),
+ vlr_subscr_name(vsub),
+ osmo_use_count_to_str_c(tmp, &vsub->use_count));
+ talloc_free(tmp);
if (!vsub->msisdn[0])
OSMO_STRLCPY_ARRAY(vsub->msisdn, exists->msisdn);
@@ -1533,6 +1537,23 @@
return rc;
}
+void vlr_subscr_rx_pvlr_id_ack(struct vlr_subscr *vsub)
+{
+ if (!vsub->lu_fsm)
+ return;
+
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_SEND_ID_ACK, NULL);
+}
+
+void vlr_subscr_rx_pvlr_id_nack(struct vlr_subscr *vsub)
+{
+ if (!vsub->lu_fsm)
+ return;
+
+ osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_SEND_ID_NACK, NULL);
+}
+
+
/* Tear down any running FSMs due to MSC connection timeout.
* Visit all vsub->*_fsm pointers and give them a queue to send a final reject
* message before the entire connection is torn down.
@@ -1561,6 +1582,7 @@
OSMO_ASSERT(ops->tx_common_id);
OSMO_ASSERT(ops->subscr_update);
OSMO_ASSERT(ops->subscr_assoc);
+ OSMO_ASSERT(ops->location_served);
INIT_LLIST_HEAD(&vlr->subscribers);
INIT_LLIST_HEAD(&vlr->operations);
diff --git a/src/libvlr/vlr_lu_fsm.c b/src/libvlr/vlr_lu_fsm.c
index 4bbbbbe..176246e 100644
--- a/src/libvlr/vlr_lu_fsm.c
+++ b/src/libvlr/vlr_lu_fsm.c
@@ -752,8 +752,6 @@
bool lu_by_tmsi;
char imsi[16];
uint32_t tmsi;
- struct osmo_location_area_id old_lai;
- struct osmo_location_area_id new_lai;
struct osmo_routing_area_id old_rai;
struct osmo_routing_area_id new_rai;
bool authentication_required;
@@ -767,20 +765,12 @@
bool is_r99;
bool is_utran;
bool assign_tmsi;
+ bool hlr_update_req;
/*! count times timer T timed out */
int N;
};
-
-/* Determine if given location area is served by this VLR */
-static bool lai_in_this_vlr(struct vlr_instance *vlr,
- const struct osmo_location_area_id *lai)
-{
- /* TODO: VLR needs to keep a locally configured list of LAIs */
- return true;
-}
-
/* Return true when authentication should be attempted. */
static bool try_auth(struct lu_fsm_priv *lfp)
{
@@ -882,7 +872,7 @@
return;
}
- if (lfp->lu_type == VLR_LU_TYPE_IMSI_ATTACH) {
+ if (lfp->lu_type == VLR_LU_TYPE_IMSI_ATTACH || lfp->hlr_update_req) {
/* Update_HLR_VLR */
osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_HLR_UPD,
LU_TIMEOUT_LONG, 0);
@@ -931,7 +921,7 @@
vsub->conf_by_radio_contact_ind = true;
/* Update LAI */
- vsub->cgi.lai = lfp->new_lai;
+ vsub->cgi.lai = lfp->new_rai.lac;
vsub->dormant_ind = false;
vsub->cancel_loc_rx = false;
if (hlr_update_needed(vsub)) {
@@ -1084,7 +1074,7 @@
vsub->lu_fsm = fi;
vsub->msc_conn_ref = lfp->msc_conn_ref;
/* FIXME: send new LAC to HLR? */
- vsub->cgi.lai.lac = lfp->new_lai.lac;
+ vsub->cgi.lai = lfp->new_rai.lac;
lfp->vsub = vsub;
/* Tell MSC to associate this subscriber with the given
* connection */
@@ -1152,17 +1142,11 @@
/* TODO: PUESBINE related handling */
- /* Is previous LAI in this VLR? */
- if (!lai_in_this_vlr(vlr, &lfp->old_lai)) {
-#if 0
- /* FIXME: check previous VLR, (3) */
+ /* Is previous LAI/RAI in this VLR? */
+ if (!vlr->ops.location_served(lfp->vsub, &lfp->old_rai)) {
osmo_fsm_inst_state_chg(fi, VLR_ULA_S_WAIT_PVLR,
LU_TIMEOUT_LONG, 0);
return;
-#endif
- LOGPFSML(fi, LOGL_NOTICE, "LAI change from %s,"
- " but checking previous VLR not implemented\n",
- osmo_lai_name(&lfp->old_lai));
}
/* If this is a TMSI based LU, we may not have the IMSI. Make sure that
@@ -1217,16 +1201,35 @@
}
}
+static void lu_fsm_wait_pvlr_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+ struct vlr_instance *vlr = lfp->vlr;
+
+ lfp->hlr_update_req = true;
+ vlr->ops.tx_pvlr_request(lfp->msc_conn_ref, &lfp->old_rai);
+}
+
/* Wait for response from Send_Identification to PVLR */
static void lu_fsm_wait_pvlr(struct osmo_fsm_inst *fi, uint32_t event,
void *data)
{
+ struct lu_fsm_priv *lfp = lu_fsm_fi_priv(fi);
+
switch (event) {
case VLR_ULA_E_SEND_ID_ACK:
vlr_loc_upd_node1_pre(fi);
break;
case VLR_ULA_E_SEND_ID_NACK:
- vlr_loc_upd_want_imsi(fi);
+ if (vlr_is_cs(lfp->vlr)) {
+ vlr_loc_upd_want_imsi(fi);
+ break;
+ }
+ /* PS */
+ if (lfp->lu_type == VLR_LU_TYPE_IMSI_ATTACH)
+ vlr_loc_upd_want_imsi(fi);
+ else
+ lu_fsm_failure(fi, GSM48_REJECT_MS_IDENTITY_NOT_DERVIVABLE);
break;
default:
OSMO_ASSERT(0);
@@ -1484,6 +1487,7 @@
S(VLR_ULA_S_WAIT_HLR_CHECK_IMEI_EARLY) |
S(VLR_ULA_S_DONE),
.name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_PVLR),
+ .onenter = lu_fsm_wait_pvlr_onenter,
.action = lu_fsm_wait_pvlr,
},
[VLR_ULA_S_WAIT_AUTH] = {
@@ -1674,8 +1678,8 @@
lfp->msc_conn_ref = msc_conn_ref;
lfp->tmsi = tmsi;
lfp->lu_type = type;
- lfp->old_lai = *old_lai;
- lfp->new_lai = *new_lai;
+ lfp->old_rai.lac = *old_lai;
+ lfp->new_rai.lac = *new_lai;
lfp->lu_by_tmsi = true;
lfp->parent_event_success = parent_event_success;
lfp->parent_event_failure = parent_event_failure;
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39561?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I7ef8e10e9553181913c66546c97a71b21fa9ef64
Gerrit-Change-Number: 39561
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
1
0
[XL] Change in osmo-sgsn[master]: Rework SGSN code to use new libvlr code
by lynxis lazus 16 Feb '25
by lynxis lazus 16 Feb '25
16 Feb '25
lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email )
Change subject: Rework SGSN code to use new libvlr code
......................................................................
Rework SGSN code to use new libvlr code
The libvlr code will take most of the logic of the Routing Area handling.
By using the new libvlr code, the ACL and usage of the SGSN without the
HLR has been removed.
Change-Id: I9c5b4ec1b337c35e85c2d1a3d09b318380ae6ef8
---
M include/osmocom/sgsn/debug.h
M include/osmocom/sgsn/gprs_gmm.h
M include/osmocom/sgsn/gprs_gmm_attach.h
M include/osmocom/sgsn/gprs_gmm_fsm.h
A include/osmocom/sgsn/gprs_rau_fsm.h
M include/osmocom/sgsn/gprs_subscriber.h
M include/osmocom/sgsn/mmctx.h
M include/osmocom/sgsn/sgsn.h
M src/sgsn/Makefile.am
M src/sgsn/gprs_gmm.c
M src/sgsn/gprs_gmm_attach.c
M src/sgsn/gprs_gmm_fsm.c
M src/sgsn/gprs_ranap.c
A src/sgsn/gprs_rau_fsm.c
M src/sgsn/gprs_subscriber.c
M src/sgsn/mmctx.c
M src/sgsn/sgsn.c
M src/sgsn/sgsn_auth.c
M src/sgsn/sgsn_libgtp.c
M src/sgsn/sgsn_main.c
M src/sgsn/sgsn_vty.c
M tests/Makefile.am
M tests/gprs_routing_area/Makefile.am
M tests/sgsn/sgsn_test.c
M tests/testsuite.at
M tests/vty_test_runner.py
26 files changed, 1,305 insertions(+), 2,648 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/62/39562/1
diff --git a/include/osmocom/sgsn/debug.h b/include/osmocom/sgsn/debug.h
index 04ba3c0..3e43b2f 100644
--- a/include/osmocom/sgsn/debug.h
+++ b/include/osmocom/sgsn/debug.h
@@ -28,6 +28,8 @@
DOBJ,
DRIM,
DRA, /* Routing Area handling */
+ DVLR,
+ DSGS, /* only as placeholder, SGS isn't used by the SGSN */
Debug_LastEntry,
};
diff --git a/include/osmocom/sgsn/gprs_gmm.h b/include/osmocom/sgsn/gprs_gmm.h
index 900ad6a..6a2f023 100644
--- a/include/osmocom/sgsn/gprs_gmm.h
+++ b/include/osmocom/sgsn/gprs_gmm.h
@@ -7,6 +7,7 @@
#include <osmocom/gsm/gsm48.h>
#include <osmocom/crypt/auth.h>
+struct sgsn_instance;
struct sgsn_mm_ctx;
struct gprs_llc_llme;
struct osmo_routing_area_id;
@@ -14,6 +15,11 @@
int gsm48_tx_gmm_auth_ciph_req(struct sgsn_mm_ctx *mm,
const struct osmo_auth_vector *vec,
uint8_t key_seq, bool force_standby);
+int gsm48_tx_gmm_auth_ciph_rej(struct sgsn_mm_ctx *mm);
+
+int gsm48_tx_gmm_ra_upd_ack(struct sgsn_mm_ctx *mm);
+int gsm48_tx_gmm_ra_upd_rej_oldmsg(struct msgb *old_msg, uint8_t reject_cause);
+int gsm48_tx_gmm_ra_upd_rej(struct sgsn_mm_ctx *mm, uint8_t cause);
int gsm0408_gprs_rcvmsg_gb(struct msgb *msg, struct gprs_llc_llme *llme,
bool drop_cipherable);
@@ -27,7 +33,8 @@
void gsm0408_gprs_access_granted(struct sgsn_mm_ctx *mmctx);
void gsm0408_gprs_access_denied(struct sgsn_mm_ctx *mmctx, int gmm_cause);
void gsm0408_gprs_access_cancelled(struct sgsn_mm_ctx *mmctx, int gmm_cause);
-void gsm0408_gprs_authenticate(struct sgsn_mm_ctx *mmctx);
+
+void gprs_gmm_service_accepted(struct sgsn_mm_ctx *ctx);
int gprs_gmm_rx_suspend(struct osmo_routing_area_id *raid, uint32_t tlli);
int gprs_gmm_rx_resume(struct osmo_routing_area_id *raid, uint32_t tlli,
@@ -44,6 +51,8 @@
int gsm48_tx_gmm_att_rej(struct sgsn_mm_ctx *mm,
uint8_t gmm_cause);
int gsm48_tx_gmm_att_ack(struct sgsn_mm_ctx *mm);
+int gsm48_tx_gmm_detach_req(struct sgsn_mm_ctx *mmctx, uint8_t detach_type, uint8_t cause);
+int gsm48_tx_gmm_det_ack(struct sgsn_mm_ctx *mm, uint8_t force_stby);
int gprs_gmm_msg_cmp(struct msgb *a, struct msgb *b);
@@ -54,4 +63,6 @@
void msgid2mmctx(struct sgsn_mm_ctx *mm, const struct msgb *msg);
void mmctx2msgid(struct msgb *msg, const struct sgsn_mm_ctx *mm);
+
+int gmm_vlr_init(struct sgsn_instance *sgi);
#endif /* _GPRS_GMM_H */
diff --git a/include/osmocom/sgsn/gprs_gmm_attach.h b/include/osmocom/sgsn/gprs_gmm_attach.h
index 0aa2123..e69de29 100644
--- a/include/osmocom/sgsn/gprs_gmm_attach.h
+++ b/include/osmocom/sgsn/gprs_gmm_attach.h
@@ -1,39 +0,0 @@
-#ifndef GPRS_GMM_ATTACH_H
-#define GPRS_GMM_ATTACH_H
-
-#include <osmocom/core/fsm.h>
-
-struct sgsn_mm_ctx;
-
-enum gmm_attach_req_fsm_states {
- ST_INIT,
- ST_IDENTIY,
- ST_RETRIEVE_AUTH,
- ST_AUTH,
- ST_ASK_VLR,
- ST_IU_SECURITY_CMD,
- ST_ACCEPT,
- ST_REJECT
-};
-
-enum gmm_attach_req_fsm_events {
- E_ATTACH_REQ_RECV,
- E_IDEN_RESP_RECV,
- E_AUTH_RESP_RECV_SUCCESS,
- E_AUTH_RESP_RECV_RESYNC,
- E_IU_SECURITY_CMD_COMPLETE,
- E_ATTACH_ACCEPTED,
- E_ATTACH_ACCEPT_SENT,
- E_ATTACH_COMPLETE_RECV,
- E_REJECT,
- E_VLR_ANSWERED,
-};
-
-#define GMM_DISCARD_MS_WITHOUT_REJECT -1
-
-extern const struct value_string gmm_attach_req_fsm_event_names[];
-extern struct osmo_fsm gmm_attach_req_fsm;
-
-void gmm_att_req_free(struct sgsn_mm_ctx *mm);
-
-#endif // GPRS_GMM_ATTACH_H
diff --git a/include/osmocom/sgsn/gprs_gmm_fsm.h b/include/osmocom/sgsn/gprs_gmm_fsm.h
index 2f0e81a..e2e525d 100644
--- a/include/osmocom/sgsn/gprs_gmm_fsm.h
+++ b/include/osmocom/sgsn/gprs_gmm_fsm.h
@@ -17,17 +17,22 @@
enum gmm_fsm_events {
E_GMM_COMMON_PROC_INIT_REQ,
- /* E_GMM_COMMON_PROC_FAILED, NOT USED */
+ E_GMM_COMMON_PROC_FAILED,
/* E_GMM_LOWER_LAYER_FAILED, NOT USED */
E_GMM_COMMON_PROC_SUCCESS,
E_GMM_ATTACH_SUCCESS,
- /* E_GMM_NET_INIT_DETACH_REQ, NOT USED */
- /* E_GMM_MS_INIT_DETACH_REQ, NOT USED */
- /* E_GMM_DETACH_ACCEPTED, */
+ E_GMM_ATTACH_FAILED, /* Osmocom specific */
+ E_GMM_RAU_SUCCESS,
+ E_GMM_RAU_FAILED,
+ E_GMM_NET_INIT_DETACH_REQ,
+ E_GMM_MS_INIT_DETACH_REQ,
+ E_GMM_DETACH_ACCEPTED,
E_GMM_SUSPEND,
E_GMM_RESUME,
E_GMM_CLEANUP,
E_GMM_RAT_CHANGE,
+ E_GMM_SERVICE_ACCEPT, /* When a Service Request got accepted, Osmocom specific */
+ E_GMM_SERVICE_REJECT, /* When a Service Request got rejected, Osmocom specific */
};
struct gmm_rat_change_data {
diff --git a/include/osmocom/sgsn/gprs_rau_fsm.h b/include/osmocom/sgsn/gprs_rau_fsm.h
new file mode 100644
index 0000000..8cf47f4
--- /dev/null
+++ b/include/osmocom/sgsn/gprs_rau_fsm.h
@@ -0,0 +1,51 @@
+/* Routing Area Update FSM for MMCtx to synchrozie for foreign RAU to local RAU transistions */
+
+/* (C) 2024 by sysmocom s.f.m.c. GmbH <info(a)sysmocom.de>
+ *
+ * Author: Alexander Couzens <lynxis(a)fe80.eu>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/utils.h>
+
+struct sgsn_mm_ctx;
+
+enum gmm_rau_state {
+ GMM_RAU_S_INIT,
+ GMM_RAU_S_WAIT_VLR_ANSWER,
+ GMM_RAU_S_WAIT_UE_RAU_COMPLETE,
+};
+
+enum gmm_rau_events {
+ GMM_RAU_E_UE_RAU_REQUEST,
+ GMM_RAU_E_UE_RAU_COMPLETE,
+ GMM_RAU_E_VLR_RAU_ACCEPT, /* Request to transmit Att/RAU Accept */
+ GMM_RAU_E_VLR_RAU_REJECT, /* Request to transmit Att/RAU Reject */
+ GMM_RAU_E_VLR_TERM_SUCCESS, /* VLR Lu FSM terminates. Inform GMM about Att/RAU Success (including Att/RAU complete) */
+ GMM_RAU_E_VLR_TERM_FAIL, /* VLR Lu FSM terminates. Inform GMM about Att/RAU fail */
+};
+
+/* To be used as data when terminating the fsm */
+extern char *fsm_term_rau_att_req; /*! while RAU, receive a Attach Req */
+extern char *fsm_term_att_req_chg; /*! Second Attach Req with changed context */
+extern char *fsm_term_att_rej; /*! By SGSN decision, tx Reject */
+extern char *fsm_term_rau_req_chg; /*! Second Rau Req with changed context */
+extern char *fsm_term_rau_rej; /*! By SGSN decision, tx Reject */
+
+extern const struct value_string gmm_rau_event_names[];
+
+void gmm_rau_fsm_req(struct sgsn_mm_ctx *mmctx);
diff --git a/include/osmocom/sgsn/gprs_subscriber.h b/include/osmocom/sgsn/gprs_subscriber.h
index 0d4a594..e7f63ab 100644
--- a/include/osmocom/sgsn/gprs_subscriber.h
+++ b/include/osmocom/sgsn/gprs_subscriber.h
@@ -12,6 +12,7 @@
struct sgsn_instance;
struct sgsn_mm_ctx;
+struct osmo_gsup_message;
extern struct llist_head * const gprs_subscribers;
@@ -71,6 +72,7 @@
struct gprs_subscr {
struct llist_head entry;
int use_count;
+ struct vlr_subscr *vlr_subscr;
char imsi[GSM23003_IMSI_MAX_DIGITS+1];
uint32_t tmsi;
@@ -102,7 +104,7 @@
void gprs_subscr_cancel(struct gprs_subscr *subscr);
void gprs_subscr_update(struct gprs_subscr *subscr);
void gprs_subscr_update_auth_info(struct gprs_subscr *subscr);
-int gprs_subscr_rx_gsup_message(struct msgb *msg);
+int gprs_subscr_rx_gsup_message(const struct osmo_gsup_message *gsup_msg);
#define LOGGSUBSCRP(level, subscr, fmt, args...) \
LOGP(DGPRS, level, "SUBSCR(%s) " fmt, \
diff --git a/include/osmocom/sgsn/mmctx.h b/include/osmocom/sgsn/mmctx.h
index 9fa06dc..1f1559e 100644
--- a/include/osmocom/sgsn/mmctx.h
+++ b/include/osmocom/sgsn/mmctx.h
@@ -16,6 +16,7 @@
#include <osmocom/sgsn/apn.h>
#include <osmocom/sgsn/auth.h>
#include <osmocom/sgsn/gprs_subscriber.h>
+#include <osmocom/vlr/vlr.h>
#define GSM_EXTENSION_LENGTH 15
@@ -99,9 +100,14 @@
char imsi[GSM23003_IMSI_MAX_DIGITS+1];
struct osmo_fsm_inst *gmm_fsm;
+ struct {
+ /* When a Common Procedure Succeeds, to which state do we change? */
+ bool common_proc_to_registered;
+ } gmm_priv;
+
uint32_t p_tmsi;
uint32_t p_tmsi_old; /* old P-TMSI before new is confirmed */
- uint32_t p_tmsi_sig;
+ char p_tmsi_sig[3];
char imei[GSM23003_IMEISV_NUM_DIGITS+1];
/* Opt: Software Version Numbber / TS 23.195 */
char msisdn[GSM_EXTENSION_LENGTH];
@@ -142,10 +148,25 @@
/* when a second attach req arrives while in this procedure,
* the fsm needs to compare it against old to decide what to do */
- struct msgb *attach_req;
uint32_t id_type;
unsigned int auth_reattempt; /* tracking UMTS resync auth attempts */
} gmm_att_req;
+
+ struct {
+ /* when a second attach req arrives while in this procedure,
+ * the fsm needs to compare it against old to decide what to do */
+ struct msgb *req;
+ char p_tmsi_sig[3];
+ bool p_tmsi_sig_valid;
+ struct osmo_routing_area_id old_rai;
+ struct osmo_routing_area_id new_rai;
+ struct osmo_fsm_inst *rau_fsm;
+ enum vlr_lu_type rau_type;
+ uint8_t cksq;
+ uint16_t pdp_status;
+ bool pdp_status_valid;
+ bool foreign;
+ } attach_rau;
/* VLR number */
uint32_t new_sgsn_addr;
/* Authentication Triplet */
@@ -212,6 +233,9 @@
struct sgsn_ggsn_lookup *ggsn_lookup;
struct gprs_subscr *subscr;
+ struct vlr_subscr *vsub;
+ /* to know if subscriber is doing an attach or location update */
+ bool attached;
};
static inline bool sgsn_mm_ctx_is_authenticated(struct sgsn_mm_ctx *ctx)
@@ -282,6 +306,9 @@
struct sgsn_pdp_ctx *sgsn_pdp_ctx_by_tid(const struct sgsn_mm_ctx *mm,
uint8_t tid);
+/* lookup vsub by imsi or ptmsi */
+int sgsn_mm_ctx_bind_vsub(struct sgsn_mm_ctx *mm, const char *imsi, uint32_t ptmsi);
+
bool sgsn_mm_ctx_is_r99(const struct sgsn_mm_ctx *mm);
uint32_t sgsn_alloc_ptmsi(void);
diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h
index 9190a61..6682733 100644
--- a/include/osmocom/sgsn/sgsn.h
+++ b/include/osmocom/sgsn/sgsn.h
@@ -132,6 +132,9 @@
char *sgsn_ipa_name;
};
+struct gsup_client_mux;
+struct vlr_instance;
+
struct sgsn_instance {
char *config_file;
struct sgsn_config cfg;
@@ -143,6 +146,8 @@
struct gsn_t *gsn;
/* Subscriber */
struct osmo_gsup_client *gsup_client;
+ struct gsup_client_mux *gcm;
+ struct vlr_instance *vlr;
/* LLME inactivity timer */
struct osmo_timer_list llme_timer;
diff --git a/src/sgsn/Makefile.am b/src/sgsn/Makefile.am
index a2c6901..708e914 100644
--- a/src/sgsn/Makefile.am
+++ b/src/sgsn/Makefile.am
@@ -46,6 +46,7 @@
gprs_gmm.c \
gprs_gmm_fsm.c \
gprs_gmm_util.c \
+ gprs_rau_fsm.c \
gprs_mm_state_gb_fsm.c \
gprs_ns.c \
gprs_routing_area.c \
@@ -75,6 +76,7 @@
gprs_llc_xid.c \
v42bis.c \
$(NULL)
+
osmo_sgsn_LDADD = \
$(top_builddir)/src/gprs/gprs_llc_parse.o \
$(top_builddir)/src/gprs/crc24.o \
diff --git a/src/sgsn/gprs_gmm.c b/src/sgsn/gprs_gmm.c
index 1c457a2..83497d2 100644
--- a/src/sgsn/gprs_gmm.c
+++ b/src/sgsn/gprs_gmm.c
@@ -33,6 +33,7 @@
#include "config.h"
#include <osmocom/core/msgb.h>
+#include <osmocom/core/utils.h>
#include <osmocom/gsm/tlv.h>
#include <osmocom/gsm/gsm_utils.h>
#include <osmocom/core/signal.h>
@@ -60,12 +61,17 @@
#include <osmocom/sgsn/gprs_mm_state_iu_fsm.h>
#include <osmocom/sgsn/gprs_gmm_fsm.h>
#include <osmocom/sgsn/signal.h>
+#include <osmocom/sgsn/gprs_routing_area.h>
#include <osmocom/sgsn/gprs_sndcp.h>
#include <osmocom/sgsn/gprs_ranap.h>
#include <osmocom/sgsn/gprs_sm.h>
#include <osmocom/sgsn/gtp.h>
#include <osmocom/sgsn/pdpctx.h>
#include <osmocom/sgsn/gprs_gmm_util.h>
+#include <osmocom/sgsn/gprs_rau_fsm.h>
+
+#include <osmocom/gsupclient/gsup_client_mux.h>
+#include <osmocom/vlr/vlr.h>
#define PTMSI_ALLOC
@@ -196,7 +202,6 @@
sgsn_mm_ctx_cleanup_free(ctx);
}
-
/* 3GPP TS 24.008 § 10.5.7.1 Process PDP context status value, bit 0 corresponds to nsapi 0 */
static void process_ms_ctx_status(struct sgsn_mm_ctx *mmctx,
uint16_t pdp_status)
@@ -251,6 +256,25 @@
return (pdp_status >> 5) != 0;
}
+/* IU only: When a MO Service Request has been accepted, handle
+ * all the required state changes */
+void gprs_gmm_service_accepted(struct sgsn_mm_ctx *ctx)
+{
+#ifdef BUILD_IU
+ ctx->pending_req = 0;
+ if (ctx->ran_type != MM_CTX_T_UTRAN_Iu) {
+ LOGMMCTXP(LOGL_ERROR, ctx, "GMM handling Service Accepted, but MM ran is not Iu");
+ return;
+ }
+
+ osmo_fsm_inst_dispatch(ctx->iu.mm_state_fsm, E_PMM_PS_CONN_ESTABLISH, NULL);
+
+ if (ctx->iu.service.type != GPRS_SERVICE_T_SIGNALLING)
+ activate_pdp_rabs(ctx);
+
+#endif /* BUILD_IU */
+}
+
/* Chapter 9.4.18 */
static int _tx_status(struct msgb *msg, uint8_t cause,
struct sgsn_mm_ctx *mmctx)
@@ -300,7 +324,7 @@
return gsm48_gmm_sendmsg(msg, 0, mmctx, true);
}
-static int gsm48_tx_gmm_detach_req(struct sgsn_mm_ctx *mmctx,
+int gsm48_tx_gmm_detach_req(struct sgsn_mm_ctx *mmctx,
uint8_t detach_type, uint8_t cause)
{
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 DET REQ");
@@ -443,7 +467,7 @@
return gsm48_gmm_sendmsg(msg, 0, mm, true);
}
-static int gsm48_tx_gmm_det_ack(struct sgsn_mm_ctx *mm, uint8_t force_stby)
+int gsm48_tx_gmm_det_ack(struct sgsn_mm_ctx *mm, uint8_t force_stby)
{
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 DET ACK");
@@ -559,7 +583,7 @@
}
/* 3GPP TS 24.008 § 9.4.11: Authentication and Ciphering Reject */
-static int gsm48_tx_gmm_auth_ciph_rej(struct sgsn_mm_ctx *mm)
+int gsm48_tx_gmm_auth_ciph_rej(struct sgsn_mm_ctx *mm)
{
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 AUTH CIPH REJ");
struct gsm48_hdr *gh;
@@ -695,6 +719,8 @@
}
memcpy(&ctx->imei, mi.imeisv, ARRAY_SIZE(ctx->imei));
+ if (ctx->vsub)
+ vlr_subscr_set_imeisv(ctx->vsub, mi.imeisv);
/* Start with the good old 4-byte SRES */
memcpy(res, TLVP_VAL(&tp, GSM48_IE_GMM_AUTH_SRES), 4);
@@ -713,6 +739,7 @@
at = &ctx->auth_triplet;
+ /* FIXME: the VLR should check the auth and not here a second time! */
LOGMMCTXP(LOGL_DEBUG, ctx, "checking auth: received %s = %s\n",
res_name, osmo_hexdump(res, res_len));
ctx->sec_ctx = check_auth_resp(ctx, false, &at->vec, res, res_len);
@@ -726,9 +753,10 @@
ctx->iu.new_key = 1;
/* FIXME: enable LLC cipheirng */
+ /* FIXME: This should _not_ trigger a FSM success */
+ osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_COMMON_PROC_SUCCESS, NULL);
- /* Check if we can let the mobile station enter */
- return osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_AUTH_RESP_RECV_SUCCESS, NULL);
+ return vlr_subscr_rx_auth_resp(ctx->vsub, sgsn_mm_ctx_is_r99(ctx), ctx->ran_type == MM_CTX_T_UTRAN_Iu, res, res_len);
}
/* 3GPP TS 24.008 § 9.4.10: Authentication and Ciphering Failure */
@@ -738,12 +766,15 @@
struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
struct tlv_parsed tp;
const uint8_t gmm_cause = gh->data[0];
- const uint8_t *auts;
- int rc;
+ const uint8_t *auts = NULL;
+ int rc = 0;
LOGMMCTXP(LOGL_INFO, ctx, "-> GMM AUTH AND CIPH FAILURE (cause = %s)\n",
get_value_string(gsm48_gmm_cause_names, gmm_cause));
+ if (!ctx->vsub)
+ return -EINVAL;
+
tlv_parse(&tp, &gsm48_gmm_ie_tlvdef, gh->data+1, msg->len - 1, 0, 0);
/* Only if GMM cause is present and the AUTS is provided, we can
@@ -768,70 +799,39 @@
/* make sure we'll retry authentication after the resync */
ctx->auth_state = SGSN_AUTH_UMTS_RESYNC;
-
- /* Send AUTS to HLR and wait for new Auth Info Result */
- rc = gprs_subscr_request_auth_info(ctx, auts,
- ctx->auth_triplet.vec.rand);
- if (!rc)
- return osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_AUTH_RESP_RECV_RESYNC, NULL);
- /* on error, fall through to send a reject */
- LOGMMCTXP(LOGL_ERROR, ctx,
- "Sending AUTS to HLR failed (rc = %d)\n", rc);
}
+ /* VLR doesn't accept Auth Ciph Fail */
+ vlr_subscr_rx_auth_fail(ctx->vsub, auts);
+
LOGMMCTXP(LOGL_NOTICE, ctx, "Authentication failed\n");
- rc = gsm48_tx_gmm_auth_ciph_rej(ctx);
- mm_ctx_cleanup_free(ctx, "GMM AUTH FAILURE");
return rc;
}
void extract_subscr_msisdn(struct sgsn_mm_ctx *ctx)
{
- struct gsm_mncc_number called;
- uint8_t msisdn[sizeof(ctx->subscr->sgsn_data->msisdn) + 1];
+ osmo_static_assert(GSM_EXTENSION_LENGTH == GSM23003_MSISDN_MAX_DIGITS, gmm_msisdn_vsub)
- /* Convert MSISDN from encoded to string.. */
- if (!ctx->subscr)
- return;
-
- if (ctx->subscr->sgsn_data->msisdn_len < 1)
- return;
-
- /* prepare the data for the decoder */
- memset(&called, 0, sizeof(called));
- msisdn[0] = ctx->subscr->sgsn_data->msisdn_len;
- memcpy(&msisdn[1], ctx->subscr->sgsn_data->msisdn,
- ctx->subscr->sgsn_data->msisdn_len);
-
- /* decode the string now */
- gsm48_decode_called(&called, msisdn);
-
- /* Prepend a '+' for international numbers */
- if (called.plan == 1 && called.type == 1) {
- ctx->msisdn[0] = '+';
- osmo_strlcpy(&ctx->msisdn[1], called.number,
- sizeof(ctx->msisdn));
- } else {
- osmo_strlcpy(ctx->msisdn, called.number, sizeof(ctx->msisdn));
- }
+ if (ctx->vsub)
+ memcpy(ctx->msisdn, ctx->vsub->msisdn, GSM_EXTENSION_LENGTH);
}
void extract_subscr_hlr(struct sgsn_mm_ctx *ctx)
{
struct gsm_mncc_number called;
- uint8_t hlr_number[sizeof(ctx->subscr->sgsn_data->hlr) + 1];
+ uint8_t hlr_number[sizeof(ctx->vsub->hlr.buf) + 1];
- if (!ctx->subscr)
+ if (!ctx->vsub)
return;
- if (ctx->subscr->sgsn_data->hlr_len < 1)
+ if (ctx->vsub->hlr.len == 0 || ctx->vsub->hlr.len > sizeof(ctx->vsub->hlr.buf))
return;
/* prepare the data for the decoder */
memset(&called, 0, sizeof(called));
- hlr_number[0] = ctx->subscr->sgsn_data->hlr_len;
- memcpy(&hlr_number[1], ctx->subscr->sgsn_data->hlr,
- ctx->subscr->sgsn_data->hlr_len);
+ hlr_number[0] = ctx->vsub->hlr.len & 0xff;
+ memcpy(&hlr_number[1], ctx->vsub->hlr.buf,
+ ctx->vsub->hlr.len);
/* decode the string now */
gsm48_decode_called(&called, hlr_number);
@@ -898,167 +898,15 @@
gmm_copy_id(msg, old_msg);
return _tx_gmm_service_rej(msg, gmm_cause, NULL);
}
-#if 0
--- currently unused --
+
static int gsm48_tx_gmm_service_rej(struct sgsn_mm_ctx *mm,
uint8_t gmm_cause)
{
+#ifdef BUILD_IU
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 SERVICE REJ");
mmctx2msgid(msg, mm);
return _tx_gmm_service_rej(msg, gmm_cause, mm);
-}
-#endif
-
-static int gsm48_tx_gmm_ra_upd_ack(struct sgsn_mm_ctx *mm);
-
-/* Check if we can already authorize a subscriber */
-int gsm48_gmm_authorize(struct sgsn_mm_ctx *ctx)
-{
-#ifdef BUILD_IU
- int rc;
-#endif
-#ifndef PTMSI_ALLOC
- struct sgsn_signal_data sig_data;
-#endif
-
- /* Request IMSI and IMEI from the MS if they are unknown */
- if (!strlen(ctx->imei)) {
- ctx->t3370_id_type = GSM_MI_TYPE_IMEI;
- mmctx_timer_start(ctx, 3370);
- return gsm48_tx_gmm_id_req(ctx, GSM_MI_TYPE_IMEI);
- }
- if (!strlen(ctx->imsi)) {
- ctx->t3370_id_type = GSM_MI_TYPE_IMSI;
- mmctx_timer_start(ctx, 3370);
- return gsm48_tx_gmm_id_req(ctx, GSM_MI_TYPE_IMSI);
- }
-
- /* All information required for authentication is available */
- ctx->t3370_id_type = GSM_MI_TYPE_NONE;
-
- if (ctx->auth_state == SGSN_AUTH_UNKNOWN) {
- /* Request authorization, this leads to a call to
- * sgsn_auth_update which in turn calls
- * gsm0408_gprs_access_granted or gsm0408_gprs_access_denied */
-
- sgsn_auth_request(ctx);
- /* Note that gsm48_gmm_authorize can be called recursively via
- * sgsn_auth_request iff ctx->auth_info changes to AUTH_ACCEPTED
- */
- return 0;
- }
-
- if (ctx->auth_state == SGSN_AUTH_AUTHENTICATE
- && !sgsn_mm_ctx_is_authenticated(ctx)) {
- struct gsm_auth_tuple *at = &ctx->auth_triplet;
-
- mmctx_timer_start(ctx, 3360);
- return gsm48_tx_gmm_auth_ciph_req(ctx, &at->vec, at->key_seq,
- false);
- }
-
- if (ctx->auth_state == SGSN_AUTH_AUTHENTICATE && sgsn_mm_ctx_is_authenticated(ctx) &&
- ctx->auth_triplet.key_seq != GSM_KEY_SEQ_INVAL) {
- /* Check again for authorization */
- sgsn_auth_request(ctx);
- return 0;
- }
-
- if (ctx->auth_state != SGSN_AUTH_ACCEPTED) {
- LOGMMCTXP(LOGL_NOTICE, ctx,
- "authorization is denied, aborting procedure\n");
- return -EACCES;
- }
-
- /* The MS is authorized */
-#ifdef BUILD_IU
- if (ctx->ran_type == MM_CTX_T_UTRAN_Iu && !ctx->iu.ue_ctx->integrity_active) {
- /* Is any encryption above UEA0 enabled? */
- bool send_ck = sgsn->cfg.uea_encryption_mask > (1 << OSMO_UTRAN_UEA0);
- LOGMMCTXP(LOGL_DEBUG, ctx, "Iu Security Mode Command: %s encryption key (UEA encryption mask = 0x%x)\n",
- send_ck ? "sending" : "not sending", sgsn->cfg.uea_encryption_mask);
- /* FIXME: we should send the set of allowed UEA, as in ranap_new_msg_sec_mod_cmd2(). However, this
- * is not possible in the iu_client API. See OS#5487. */
- rc = ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, send_ck, ctx->iu.new_key);
- ctx->iu.new_key = 0;
- return rc;
- }
-#endif
-
- switch (ctx->pending_req) {
- case 0:
- LOGMMCTXP(LOGL_INFO, ctx,
- "no pending request, authorization completed\n");
- break;
- case GSM48_MT_GMM_ATTACH_REQ:
- ctx->pending_req = 0;
-
- extract_subscr_msisdn(ctx);
- extract_subscr_hlr(ctx);
-#ifdef PTMSI_ALLOC
- /* Start T3350 and re-transmit up to 5 times until ATTACH COMPLETE */
- mmctx_timer_start(ctx, 3350);
- ctx->t3350_mode = GMM_T3350_MODE_ATT;
-#else
- memset(&sig_data, 0, sizeof(sig_data));
- sig_data.mm = ctx;
- osmo_signal_dispatch(SS_SGSN, S_SGSN_ATTACH, &sig_data);
- osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_ATTACH_SUCCESS, NULL);
-#endif
-
- return gsm48_tx_gmm_att_ack(ctx);
-#ifdef BUILD_IU
- case GSM48_MT_GMM_SERVICE_REQ:
- ctx->pending_req = 0;
- osmo_fsm_inst_dispatch(ctx->iu.mm_state_fsm, E_PMM_PS_CONN_ESTABLISH, NULL);
- rc = gsm48_tx_gmm_service_ack(ctx);
-
- if (ctx->iu.service.type != GPRS_SERVICE_T_SIGNALLING)
- activate_pdp_rabs(ctx);
-
- return rc;
-#endif
- case GSM48_MT_GMM_RA_UPD_REQ:
- ctx->pending_req = 0;
- /* Send RA UPDATE ACCEPT */
- return gsm48_tx_gmm_ra_upd_ack(ctx);
-
- default:
- LOGMMCTXP(LOGL_ERROR, ctx,
- "only Attach Request is supported yet, "
- "got request type %u\n", ctx->pending_req);
- break;
- }
-
- return 0;
-}
-
-void gsm0408_gprs_authenticate(struct sgsn_mm_ctx *ctx)
-{
- ctx->sec_ctx = OSMO_AUTH_TYPE_NONE;
-
- if (ctx->gmm_att_req.fsm->state != ST_INIT)
- osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_VLR_ANSWERED, (void *) 0);
- else
- gsm48_gmm_authorize(ctx);
-}
-
-void gsm0408_gprs_access_granted(struct sgsn_mm_ctx *ctx)
-{
- switch (ctx->gmm_fsm->state) {
- case ST_GMM_COMMON_PROC_INIT:
- LOGMMCTXP(LOGL_NOTICE, ctx,
- "Authorized, continuing procedure, IMSI=%s\n",
- ctx->imsi);
- /* Continue with the authorization */
- if (ctx->gmm_att_req.fsm->state != ST_INIT)
- osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_VLR_ANSWERED, (void *) 0);
- break;
- default:
- LOGMMCTXP(LOGL_INFO, ctx,
- "Authorized, ignored, IMSI=%s\n",
- ctx->imsi);
- }
+#endif /* BUILD_IU */
}
void gsm0408_gprs_access_denied(struct sgsn_mm_ctx *ctx, int gmm_cause)
@@ -1073,8 +921,6 @@
"with cause '%s' (%d)\n",
get_value_string(gsm48_gmm_cause_names, gmm_cause),
gmm_cause);
- if (ctx->gmm_att_req.fsm->state != ST_INIT)
- osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_REJECT, (void *) (long) gmm_cause);
break;
case ST_GMM_REGISTERED_NORMAL:
case ST_GMM_REGISTERED_SUSPENDED:
@@ -1116,7 +962,6 @@
static int gsm48_rx_gmm_id_resp(struct sgsn_mm_ctx *ctx, struct msgb *msg)
{
struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
- long mi_typel;
char mi_log_string[32];
struct osmo_mobile_identity mi;
@@ -1133,17 +978,6 @@
LOGMMCTXP(LOGL_DEBUG, ctx, "-> GMM IDENTITY RESPONSE: MI=%s\n", mi_log_string);
- if (ctx->t3370_id_type == GSM_MI_TYPE_NONE) {
- LOGMMCTXP(LOGL_NOTICE, ctx,
- "Got unexpected IDENTITY RESPONSE: MI=%s, "
- "ignoring message\n",
- mi_log_string);
- return -EINVAL;
- }
-
- if (mi.type == ctx->t3370_id_type)
- mmctx_timer_stop(ctx, 3370);
-
switch (mi.type) {
case GSM_MI_TYPE_IMSI:
/* we already have a mm context with current TLLI, but no
@@ -1173,9 +1007,10 @@
break;
}
- /* Check if we can let the mobile station enter */
- mi_typel = mi.type;
- return osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_IDEN_RESP_RECV, (void *)mi_typel);
+ if (ctx->vsub)
+ return vlr_subscr_rx_id_resp(ctx->vsub, &mi);
+
+ return 0;
}
/* Allocate a new P-TMSI and change context state */
@@ -1244,20 +1079,22 @@
static int gsm48_rx_gmm_att_req(struct sgsn_mm_ctx *ctx, struct msgb *msg,
struct gprs_llc_llme *llme)
{
- struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
- uint8_t *cur = gh->data, *msnc, *mi_data, *ms_ra_acc_cap;
- uint8_t msnc_len, att_type, mi_len, ms_ra_acc_cap_len;
- uint16_t drx_par;
+ struct gprs_gmm_att_req req = {};
char mi_log_string[32];
struct osmo_routing_area_id ra_id;
uint16_t cid = 0;
enum gsm48_gmm_cause reject_cause;
- struct osmo_mobile_identity mi;
int rc;
LOGMMCTXP(LOGL_INFO, ctx, "-> GMM ATTACH REQUEST ");
rate_ctr_inc(rate_ctr_group_get_ctr(sgsn->rate_ctrs, CTR_GPRS_ATTACH_REQUEST));
+ rc = gprs_gmm_parse_att_req(msg, &req);
+ if (rc) {
+ LOGP(DMM, LOGL_ERROR, "Invalid Attach Request message received.\n");
+ goto err_inval;
+ }
+
/* As per TS 04.08 Chapter 4.7.1.4, the attach request arrives either
* with a foreign TLLI (P-TMSI that was allocated to the MS before),
* or with random TLLI. */
@@ -1274,58 +1111,23 @@
#endif
}
- /* MS network capability 10.5.5.12 */
- msnc_len = *cur++;
- msnc = cur;
- if (msnc_len > sizeof(ctx->ms_network_capa.buf))
- goto err_inval;
- cur += msnc_len;
-
/* TODO: In iu mode - handle follow-on request.
* The follow-on request can be signaled in an Attach Request on IuPS.
* This means the MS/UE asks to keep the PS connection open for further requests
* after the Attach Request succeed.
* The SGSN can decide if it close the connection or not. Both are spec conform. */
- /* aTTACH Type 10.5.5.2 */
- att_type = *cur++ & 0x07;
-
- /* DRX parameter 10.5.5.6 */
- drx_par = *cur++ << 8;
- drx_par |= *cur++;
-
- /* Mobile Identity (P-TMSI or IMSI) 10.5.1.4 */
- mi_len = *cur++;
- mi_data = cur;
- cur += mi_len;
-
- rc = osmo_mobile_identity_decode(&mi, mi_data, mi_len, false);
- if (rc)
- goto err_inval;
- osmo_mobile_identity_to_str_buf(mi_log_string, sizeof(mi_log_string), &mi);
-
- DEBUGPC(DMM, "MI(%s) type=\"%s\" ", mi_log_string,
- get_value_string(gprs_att_t_strs, att_type));
-
- /* Old routing area identification 10.5.5.15. Skip it */
- cur += 6;
-
- /* MS Radio Access Capability 10.5.5.12a */
- ms_ra_acc_cap_len = *cur++;
- ms_ra_acc_cap = cur;
- if (ms_ra_acc_cap_len > sizeof(ctx->ms_radio_access_capa.buf))
- goto err_inval;
- cur += ms_ra_acc_cap_len;
-
- LOGPC(DMM, LOGL_INFO, "\n");
+ osmo_mobile_identity_to_str_buf(mi_log_string, sizeof(mi_log_string), &req.mi);
+ LOGPC(DMM, LOGL_INFO, "MI(%s) type=\"%s\" ", mi_log_string,
+ get_value_string(gprs_att_t_strs, req.attach_type));
/* Optional: Old P-TMSI Signature, Requested READY timer, TMSI Status */
- switch (mi.type) {
+ switch (req.mi.type) {
case GSM_MI_TYPE_IMSI:
/* Try to find MM context based on IMSI */
if (!ctx)
- ctx = sgsn_mm_ctx_by_imsi(mi.imsi);
+ ctx = sgsn_mm_ctx_by_imsi(req.mi.imsi);
if (!ctx) {
if (MSG_IU_UE_CTX(msg))
ctx = sgsn_mm_ctx_alloc_iu(MSG_IU_UE_CTX(msg));
@@ -1335,13 +1137,13 @@
reject_cause = GMM_CAUSE_NET_FAIL;
goto rejected;
}
- OSMO_STRLCPY_ARRAY(ctx->imsi, mi.imsi);
+ OSMO_STRLCPY_ARRAY(ctx->imsi, req.mi.imsi);
}
break;
case GSM_MI_TYPE_TMSI:
/* Try to find MM context based on P-TMSI */
if (!ctx)
- ctx = sgsn_mm_ctx_by_ptmsi(mi.tmsi);
+ ctx = sgsn_mm_ctx_by_ptmsi(req.mi.tmsi);
if (!ctx) {
/* Allocate a context as most of our code expects one.
* Context will not have an IMSI ultil ID RESP is received */
@@ -1353,7 +1155,7 @@
reject_cause = GMM_CAUSE_NET_FAIL;
goto rejected;
}
- ctx->p_tmsi = mi.tmsi;
+ ctx->p_tmsi = req.mi.tmsi;
}
break;
default:
@@ -1363,6 +1165,16 @@
goto rejected;
}
+ /* Check if this Attach Request is a retransmission */
+ if (ctx->attach_rau.req) {
+ if (!gprs_gmm_msg_cmp(ctx->attach_rau.req, msg)) {
+ /* Retransmission of the old Attach Req */
+ /* TODO: retransmit ID Req/Resp from VLR. Currently this will run into a timeout to retransmit */
+ osmo_fsm_inst_dispatch(ctx->attach_rau.rau_fsm, GMM_RAU_E_UE_RAU_REQUEST, (void *) 1);
+ return 0;
+ }
+ }
+
if (mmctx_did_rat_change(ctx, msg))
mmctx_handle_rat_change(ctx, msg, llme);
@@ -1377,14 +1189,15 @@
ctx->gb.cell_id = cid;
/* Update MM Context with other data */
- ctx->drx_parms = drx_par;
- ctx->ms_radio_access_capa.len = ms_ra_acc_cap_len;
- memcpy(ctx->ms_radio_access_capa.buf, ms_ra_acc_cap,
+ ctx->drx_parms = req.drx_parms;
+ ctx->ms_radio_access_capa.len = OSMO_MIN(req.ms_radio_cap_len, sizeof(ctx->ms_radio_access_capa.buf));
+ memcpy(ctx->ms_radio_access_capa.buf, req.ms_radio_cap,
ctx->ms_radio_access_capa.len);
- ctx->ms_network_capa.len = msnc_len;
- memcpy(ctx->ms_network_capa.buf, msnc, msnc_len);
- ctx->ue_cipher_mask = gprs_ms_net_cap_gea_mask(ctx->ms_network_capa.buf, msnc_len);
+ ctx->ms_network_capa.len = OSMO_MIN(req.ms_network_cap_len, sizeof(ctx->ms_network_capa.buf));
+ memcpy(ctx->ms_network_capa.buf, req.ms_network_cap, ctx->ms_network_capa.len);
+
+ ctx->ue_cipher_mask = gprs_ms_net_cap_gea_mask(ctx->ms_network_capa.buf, ctx->ms_network_capa.len);
if (!(ctx->ue_cipher_mask & sgsn->cfg.gea_encryption_mask)) {
reject_cause = GMM_CAUSE_PROTO_ERR_UNSPEC;
@@ -1404,24 +1217,29 @@
ctx->ciph_algo = gprs_ms_net_select_best_gea(ctx->ue_cipher_mask, sgsn->cfg.gea_encryption_mask);
-#ifdef PTMSI_ALLOC
- /* Allocate a new P-TMSI (+ P-TMSI signature) and update TLLI */
- ptmsi_update(ctx);
-#endif
-
- if (ctx->ran_type == MM_CTX_T_GERAN_Gb) {
- /* Even if there is no P-TMSI allocated, the MS will
- * switch from foreign TLLI to local TLLI */
- ctx->gb.tlli_new = gprs_tmsi2tlli(ctx->p_tmsi, TLLI_LOCAL);
-
- /* Inform LLC layer about new TLLI but keep old active */
- if (sgsn_mm_ctx_is_authenticated(ctx))
- gprs_llme_copy_key(ctx, ctx->gb.llme);
-
- gprs_llgmm_assign(ctx->gb.llme, ctx->gb.tlli, ctx->gb.tlli_new);
+ if (req.mi.type == GSM_MI_TYPE_IMSI) {
+ sgsn_mm_ctx_bind_vsub(ctx, req.mi.imsi, 0);
+ } else if (req.mi.type == GSM_MI_TYPE_TMSI) {
+ sgsn_mm_ctx_bind_vsub(ctx, NULL, req.mi.tmsi);
+ } else {
+ goto err_inval;
}
- osmo_fsm_inst_dispatch(ctx->gmm_att_req.fsm, E_ATTACH_REQ_RECV, msg);
+ if (!ctx->vsub) {
+ reject_cause = GMM_CAUSE_NET_FAIL;
+ goto rejected;
+ }
+
+ if (ctx->attach_rau.rau_fsm)
+ osmo_fsm_inst_term(ctx->attach_rau.rau_fsm, OSMO_FSM_TERM_REQUEST, fsm_term_att_req_chg);
+
+ ctx->attach_rau.cksq = req.cksq;
+ ctx->attach_rau.old_rai = req.old_rai;
+ ctx->attach_rau.rau_type = VLR_LU_TYPE_IMSI_ATTACH;
+ ctx->attach_rau.req = msgb_copy_c(ctx, msg, "GMM ATTACH REQ");
+
+ gmm_rau_fsm_req(ctx);
+
return 0;
err_inval:
@@ -1440,45 +1258,38 @@
gprs_llgmm_unassign(llme);
return rc;
-
}
/* 3GPP TS 24.008 § 9.4.3 Attach complete */
static int gsm48_rx_gmm_att_compl(struct sgsn_mm_ctx *mmctx)
{
- struct sgsn_signal_data sig_data;
+ int rc = 0;
/* only in case SGSN offered new P-TMSI */
LOGMMCTXP(LOGL_INFO, mmctx, "-> GMM ATTACH COMPLETE\n");
#ifdef BUILD_IU
+ /* TODO: check follow-on request */
if (mmctx->iu.ue_ctx) {
ranap_iu_tx_release(mmctx->iu.ue_ctx, NULL);
}
#endif
+ /* If the mmctx doesn't contain a VLR subscriber, ignore this message */
+ if (!mmctx->vsub)
+ return 0;
+
mmctx_timer_stop(mmctx, 3350);
mmctx->t3350_mode = GMM_T3350_MODE_NONE;
mmctx->p_tmsi_old = 0;
mmctx->pending_req = 0;
- osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_ATTACH_SUCCESS, NULL);
- switch(mmctx->ran_type) {
- case MM_CTX_T_UTRAN_Iu:
- osmo_fsm_inst_dispatch(mmctx->iu.mm_state_fsm, E_PMM_PS_ATTACH, NULL);
- break;
- case MM_CTX_T_GERAN_Gb:
- /* Unassign the old TLLI */
- mmctx->gb.tlli = mmctx->gb.tlli_new;
- gprs_llme_copy_key(mmctx, mmctx->gb.llme);
- gprs_llgmm_assign(mmctx->gb.llme, TLLI_UNASSIGNED,
- mmctx->gb.tlli_new);
- osmo_fsm_inst_dispatch(mmctx->gb.mm_state_fsm, E_MM_GPRS_ATTACH, NULL);
- break;
+
+ if (mmctx->attach_rau.rau_fsm) {
+ rc = osmo_fsm_inst_dispatch(mmctx->attach_rau.rau_fsm, GMM_RAU_E_UE_RAU_COMPLETE, NULL);
}
- osmo_fsm_inst_dispatch(mmctx->gmm_att_req.fsm, E_ATTACH_COMPLETE_RECV, 0);
- memset(&sig_data, 0, sizeof(sig_data));
- sig_data.mm = mmctx;
- osmo_signal_dispatch(SS_SGSN, S_SGSN_ATTACH, &sig_data);
+ if (!mmctx->attach_rau.rau_fsm || rc != 0) {
+ /* FIXME: fail gracefully here or just ignore?! */
+ }
return 0;
}
@@ -1501,7 +1312,9 @@
static int gsm48_rx_gmm_det_req(struct sgsn_mm_ctx *ctx, struct msgb *msg)
{
struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_gmmh(msg);
+ struct sgsn_signal_data sig_data;
uint8_t detach_type, power_off;
+ long data;
int rc = 0;
detach_type = gh->data[0] & 0x7;
@@ -1513,29 +1326,39 @@
msgb_tlli(msg), get_value_string(gprs_det_t_mo_strs, detach_type),
power_off ? "Power-off" : "");
+
/* Only send the Detach Accept (MO) if power off isn't indicated,
* see 04.08, 4.7.4.1.2/3 for details */
- if (!power_off) {
- /* force_stby = 0 */
- if (ctx)
- rc = gsm48_tx_gmm_det_ack(ctx, 0);
- else
+ if (!ctx) {
+ if (!power_off)
rc = gsm48_tx_gmm_det_ack_oldmsg(msg, 0);
+ return rc;
}
- if (ctx) {
- struct sgsn_signal_data sig_data;
- memset(&sig_data, 0, sizeof(sig_data));
- sig_data.mm = ctx;
- osmo_signal_dispatch(SS_SGSN, S_SGSN_DETACH, &sig_data);
- mm_ctx_cleanup_free(ctx, "GMM DETACH REQUEST");
- }
+ memset(&sig_data, 0, sizeof(sig_data));
+ sig_data.mm = ctx;
+ /* FIXME: in theory there shouldn't be a MMCTX without VLR sub */
+ if (ctx->vsub)
+ vlr_subscr_rx_imsi_detach(ctx->vsub);
+
+ data = power_off;
+ osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_MS_INIT_DETACH_REQ, &data);
+ osmo_signal_dispatch(SS_SGSN, S_SGSN_DETACH, &sig_data);
+ mm_ctx_cleanup_free(ctx, "GMM DETACH REQUEST");
return rc;
}
+/* CHapter 9.4.6: MT Detach Ack */
+static int gsm48_rx_gmm_det_accept(struct sgsn_mm_ctx *ctx, struct msgb *msg)
+{
+ LOGMMCTXP(LOGL_INFO, ctx, "-> DETACH ACK\n");
+ osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_DETACH_ACCEPTED, NULL);
+ return 0;
+}
+
/* Chapter 9.4.15: Routing area update accept */
-static int gsm48_tx_gmm_ra_upd_ack(struct sgsn_mm_ctx *mm)
+int gsm48_tx_gmm_ra_upd_ack(struct sgsn_mm_ctx *mm)
{
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 UPD ACK");
struct gsm48_hdr *gh;
@@ -1599,6 +1422,10 @@
/* GMM cause */
/* PDP Context Status */
uint16_t pdp_ctx_status = encode_ms_ctx_status(mm);
+ if (mm->attach_rau.pdp_status_valid && pdp_ctx_status != mm->attach_rau.pdp_status) {
+ process_ms_ctx_status(mm, mm->attach_rau.pdp_status);
+ pdp_ctx_status = encode_ms_ctx_status(mm);
+ }
msgb_tlv_put(msg, GSM48_IE_GMM_PDP_CTX_STATUS, 2, (uint8_t *) &pdp_ctx_status);
/* MS ID, ... */
@@ -1606,7 +1433,26 @@
}
/* Chapter 9.4.17: Routing area update reject */
-int gsm48_tx_gmm_ra_upd_rej(struct msgb *old_msg, uint8_t cause)
+int gsm48_tx_gmm_ra_upd_rej(struct sgsn_mm_ctx *mm, uint8_t cause)
+{
+ struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 RA UPD REJ");
+ struct gsm48_hdr *gh;
+
+ LOGP(DMM, LOGL_NOTICE, "<- ROUTING AREA UPDATE REJECT\n");
+ rate_ctr_inc(rate_ctr_group_get_ctr(sgsn->rate_ctrs, CTR_GPRS_ROUTING_AREA_REJECT));
+ mmctx2msgid(msg, mm);
+
+ gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 2);
+ gh->proto_discr = GSM48_PDISC_MM_GPRS;
+ gh->msg_type = GSM48_MT_GMM_RA_UPD_REJ;
+ gh->data[0] = cause;
+ gh->data[1] = 0; /* ? */
+
+ return gsm48_gmm_sendmsg(msg, 0, mm, false);
+}
+
+/* Chapter 9.4.17: Routing area update reject */
+int gsm48_tx_gmm_ra_upd_rej_oldmsg(struct msgb *old_msg, uint8_t cause)
{
struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 RA UPD REJ");
struct gsm48_hdr *gh;
@@ -1635,7 +1481,13 @@
#endif
enum gsm48_gmm_cause reject_cause = GMM_CAUSE_PROTO_ERR_UNSPEC;
struct gprs_gmm_ra_upd_req req;
+ struct osmo_routing_area_id new_ra_id = {};
+ enum vlr_lu_type vlr_rau_type = VLR_LU_TYPE_REGULAR;
+ bool foreign_ra = false;
+ enum gsm48_ptsmi_type ptmsi_type = PTMSI_TYPE_NATIVE;
int rc;
+ uint32_t ptmsi = 0xffffffff;
+ uint32_t tlli = 0xffffffff;
rc = gprs_gmm_parse_ra_upd_req(msg, &req);
if (rc) {
@@ -1660,78 +1512,110 @@
reject_cause = GMM_CAUSE_PROTO_ERR_UNSPEC;
goto rejected;
case GPRS_UPD_T_RA:
+ vlr_rau_type = VLR_LU_TYPE_REGULAR;
+ break;
case GPRS_UPD_T_PERIODIC:
+ vlr_rau_type = VLR_LU_TYPE_PERIODIC;
break;
}
- if (!mmctx) {
- /* BSSGP doesn't give us an mmctx */
-
- /* TODO: Check if there is an MM CTX with old_ra_id and
- * the P-TMSI (if given, reguired for UMTS) or as last resort
- * if the TLLI matches foreign_tlli (P-TMSI). Note that this
- * is an optimization to avoid the RA reject (impl detached)
- * below, which will cause a new attach cycle. */
- /* Look-up the MM context based on old RA-ID and TLLI */
- if (!MSG_IU_UE_CTX(msg)) {
- /* Gb */
- mmctx = sgsn_mm_ctx_by_tlli_and_ptmsi(msgb_tlli(msg), &req.old_rai);
- } else if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI)) {
-#ifdef BUILD_IU
- /* In Iu mode search only for ptmsi */
- struct osmo_mobile_identity mi;
- if (osmo_mobile_identity_decode(&mi, TLVP_VAL(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI),
- TLVP_LEN(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI), false)
- || mi.type != GSM_MI_TYPE_TMSI) {
- LOGIUP(MSG_IU_UE_CTX(msg), LOGL_ERROR, "Cannot decode P-TMSI\n");
- goto rejected;
- }
- mmctx = sgsn_mm_ctx_by_ptmsi(mi.tmsi);
-#else
- LOGIUP(MSG_IU_UE_CTX(msg), LOGL_ERROR,
- "Rejecting GMM RA Update Request: No Iu support\n");
- goto rejected;
-#endif
- }
- if (mmctx) {
- LOGMMCTXP(LOGL_INFO, mmctx,
- "Looked up by matching TLLI and P_TMSI. "
- "BSSGP TLLI: %08x, P-TMSI: %08x (%08x), "
- "TLLI: %08x (%08x), RA: %s\n",
- msgb_tlli(msg),
- mmctx->p_tmsi, mmctx->p_tmsi_old,
- mmctx->gb.tlli, mmctx->gb.tlli_new,
- osmo_rai_name2(&mmctx->ra));
- /* A RAT change will trigger the common procedure
- * below after handling the RAT change. Protect it
- * here from being called twice */
- if (!mmctx_did_rat_change(mmctx, msg))
- osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
-
- }
- } else if (osmo_rai_cmp(&mmctx->ra, &req.old_rai) ||
- mmctx->gmm_fsm->state == ST_GMM_DEREGISTERED)
- {
- /* We've received either a RAU for a MS which isn't registered
- * or a RAU with an unknown RA ID. As long the SGSN doesn't support
- * PS handover we treat this as invalid RAU */
- struct osmo_routing_area_id new_ra_id = {};
- char new_ra[32];
-
+ /* GERAN via Gb */
+ if (msgb_bcid(msg)) {
bssgp_parse_cell_id2(&new_ra_id, NULL, msgb_bcid(msg), 8);
- osmo_rai_name2_buf(new_ra, sizeof(new_ra), &new_ra_id);
+ tlli = msgb_tlli(msg);
+ ptmsi = gprs_tlli2tmsi(tlli);
+ }
+#ifdef BUILD_IU
+ /* UTRAN via Iu */
+ else if (MSG_IU_UE_CTX(msg)) {
+ struct osmo_mobile_identity mi;
+ gprs_rai_to_osmo(&new_ra_id, &MSG_IU_UE_CTX(msg)->ra_id);
- if (mmctx->gmm_fsm->state == ST_GMM_DEREGISTERED)
- LOGMMCTXP(LOGL_INFO, mmctx,
- "Rejecting RAU - GMM state is deregistered. Old RA: %s New RA: %s\n",
- osmo_rai_name2(&req.old_rai), new_ra);
- else
- LOGMMCTXP(LOGL_INFO, mmctx,
- "Rejecting RAU - Old RA doesn't match MM. Old RA: %s New RA: %s\n",
- osmo_rai_name2(&req.old_rai), new_ra);
+ if (!TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI)) {
+ LOGMMCTXP(LOGL_NOTICE, mmctx, "GMM RA UPDATE REQUEST: missing PTMSI IE on Iu\n");
+ reject_cause = GMM_CAUSE_IE_NOTEXIST_NOTIMPL;
+ goto rejected;
+ }
+
+ if (osmo_mobile_identity_decode(&mi, TLVP_VAL(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI),
+ TLVP_LEN(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI), false)
+ || mi.type != GSM_MI_TYPE_TMSI) {
+ LOGIUP(MSG_IU_UE_CTX(msg), LOGL_ERROR, "Cannot decode P-TMSI\n");
+ reject_cause = GMM_CAUSE_IE_NOTEXIST_NOTIMPL;
+ goto rejected;
+ }
+
+ ptmsi = mi.tmsi;
+ }
+#endif /* BUILD_IU */
+ else {
+ OSMO_ASSERT(0);
+ }
+
+ if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_PTMSI_TYPE)) {
+ ptmsi_type = (*TLVP_VAL(&req.tlv, GSM48_IE_GMM_PTMSI_TYPE)) & 0x1;
+ }
+
+ /* TODO: Check if there is an MM CTX with old_ra_id and
+ * the P-TMSI (if given, reguired for UMTS) or as last resort
+ * if the TLLI matches foreign_tlli (P-TMSI). Note that this
+ * is an optimization to avoid the RA reject (impl detached)
+ * below, which will cause a new attach cycle. */
+ /* Look-up the MM context based on old RA-ID and TLLI */
+ if (!MSG_IU_UE_CTX(msg)) {
+ /* Gb */
+ mmctx = sgsn_mm_ctx_by_tlli_and_ptmsi(tlli, &req.old_rai);
+ } else if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_ALLOC_PTMSI)) {
+#ifdef BUILD_IU
+ /* In Iu mode search only for ptmsi */
+ mmctx = sgsn_mm_ctx_by_ptmsi(ptmsi);
+#else
+ LOGIUP(MSG_IU_UE_CTX(msg), LOGL_ERROR,
+ "Rejecting GMM RA Update Request: No Iu support\n");
+ goto rejected;
+#endif
+ }
+
+ if (ptmsi_type == PTMSI_TYPE_MAPPED) {
+ /* the UE is transitioning from EUTRAN to GERAN/UTRAN */
+ foreign_ra = true;
reject_cause = GMM_CAUSE_IMPL_DETACHED;
+ LOGP(DGPRS, LOGL_ERROR, "UE has a mapped P-TMSI. MME-to-SGSN mobility not implemented. Rejecting\n");
goto rejected;
+ } else { /* (ptmsi_type == PTMSI_TYPE_NATIVE) - 2G/3G PTMSI */
+ /* Check if this a local RA or a foreign */
+ struct sgsn_ra *ra;
+
+ ra = sgsn_ra_get_ra(&req.old_rai);
+ if (!ra) {
+ LOGP(DGPRS, LOGL_ERROR, "Can't find RA for native PTMSI. SGSN-to-SGSN mobility not implemented. Rejecting\n");
+ foreign_ra = true;
+ reject_cause = GMM_CAUSE_IMPL_DETACHED;
+ goto rejected;
+ }
+
+ /* GERAN / UTRAN with local RA */
+ if (!mmctx) {
+ /* BSSGP doesn't give us an mmctx, old RAI is GERAN or UTRAN */
+
+
+ if (mmctx) {
+ LOGMMCTXP(LOGL_INFO, mmctx,
+ "Looked up by matching TLLI and P_TMSI. "
+ "BSSGP TLLI: %08x, P-TMSI: %08x (%08x), "
+ "TLLI: %08x (%08x), RA: %s\n",
+ msgb_tlli(msg),
+ mmctx->p_tmsi, mmctx->p_tmsi_old,
+ mmctx->gb.tlli, mmctx->gb.tlli_new,
+ osmo_rai_name2(&mmctx->ra));
+ /* A RAT change will trigger the common procedure
+ * below after handling the RAT change. Protect it
+ * here from being called twice */
+ if (!mmctx_did_rat_change(mmctx, msg))
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
+ }
+ }
}
if (!mmctx) {
@@ -1764,6 +1648,52 @@
goto rejected;
}
+ /* MS Radio Capability */
+ mmctx->ms_radio_access_capa.len = OSMO_MIN(req.ms_radio_cap_len, sizeof(mmctx->ms_radio_access_capa.buf));
+ memcpy(&mmctx->ms_radio_access_capa.buf, req.ms_radio_cap, req.ms_radio_cap_len);
+
+ /* MS Network Capability */
+ if (TLVP_PRES_LEN(&req.tlv, GSM48_IE_GMM_MS_NET_CAPA, 1)) {
+ mmctx->ms_network_capa.len = OSMO_MIN(TLVP_LEN(&req.tlv, GSM48_IE_GMM_MS_NET_CAPA), sizeof(mmctx->ms_network_capa.buf));
+ memcpy(&mmctx->ms_network_capa.buf, TLVP_VAL(&req.tlv, GSM48_IE_GMM_MS_NET_CAPA), mmctx->ms_network_capa.len);
+ } else if (foreign_ra) {
+ /* If this isn't a foreign RA, we can continue to use the old network capability,
+ * the UE should have sent us its current network capability anyways */
+ mmctx->ms_network_capa.len = 0;
+ }
+
+ if (TLVP_PRES_LEN(&req.tlv, GSM48_IE_GMM_PTMSI_SIG, 3)) {
+ memcpy(mmctx->attach_rau.p_tmsi_sig, TLVP_VAL(&req.tlv, GSM48_IE_GMM_PTMSI_SIG), sizeof(mmctx->attach_rau.p_tmsi_sig));
+ mmctx->attach_rau.p_tmsi_sig_valid = true;
+ } else {
+ mmctx->attach_rau.p_tmsi_sig_valid = false;
+ }
+
+ /* check state for local UE */
+ if (!foreign_ra &&
+ (osmo_rai_cmp(&mmctx->ra, &req.old_rai) ||
+ mmctx->gmm_fsm->state == ST_GMM_DEREGISTERED))
+ {
+ /* We've received either a RAU for a MS which isn't registered
+ * or a RAU with an unknown RA ID. As long the SGSN doesn't support
+ * PS handover we treat this as invalid RAU */
+ char new_ra[32];
+
+ osmo_rai_name2_buf(new_ra, sizeof(new_ra), &new_ra_id);
+
+ if (mmctx->gmm_fsm->state == ST_GMM_DEREGISTERED)
+ LOGMMCTXP(LOGL_INFO, mmctx,
+ "Rejecting RAU - GMM state is deregistered. Old RA: %s New RA: %s\n",
+ osmo_rai_name2(&req.old_rai), new_ra);
+ else
+ LOGMMCTXP(LOGL_INFO, mmctx,
+ "Rejecting RAU - Old RA doesn't match MM. Old RA: %s New RA: %s\n",
+ osmo_rai_name2(&req.old_rai), new_ra);
+
+ reject_cause = GMM_CAUSE_IMPL_DETACHED;
+ goto rejected;
+ }
+
if (mmctx_did_rat_change(mmctx, msg)) {
mmctx_handle_rat_change(mmctx, msg, llme);
osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
@@ -1784,14 +1714,9 @@
if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_DRX_PARAM))
memcpy(&mmctx->drx_parms, TLVP_VAL(&req.tlv, GSM48_IE_GMM_DRX_PARAM), sizeof(mmctx->drx_parms));
- /* FIXME: Update the MM context with the MS radio acc capabilities */
- /* FIXME: Update the MM context with the MS network capabilities */
-
rate_ctr_inc(rate_ctr_group_get_ctr(mmctx->ctrg, GMM_CTR_RA_UPDATE));
#ifdef PTMSI_ALLOC
- ptmsi_update(mmctx);
-
/* Start T3350 and re-transmit up to 5 times until ATTACH COMPLETE */
mmctx->t3350_mode = GMM_T3350_MODE_RAU;
mmctx_timer_start(mmctx, 3350);
@@ -1805,39 +1730,67 @@
#endif
if (mmctx->ran_type == MM_CTX_T_GERAN_Gb) {
/* Even if there is no P-TMSI allocated, the MS will switch from
- * foreign TLLI to local TLLI */
+ * foreign TLLI to local TLLI */
mmctx->gb.tlli_new = gprs_tmsi2tlli(mmctx->p_tmsi, TLLI_LOCAL);
-
- /* Inform LLC layer about new TLLI but keep accepting the old one during Rx */
- gprs_llgmm_assign(mmctx->gb.llme, mmctx->gb.tlli,
- mmctx->gb.tlli_new);
}
/* Look at PDP Context Status IE and see if MS's view of
* activated/deactivated NSAPIs agrees with our view */
- if (TLVP_PRESENT(&req.tlv, GSM48_IE_GMM_PDP_CTX_STATUS)) {
- uint16_t pdp_status = osmo_load16le(TLVP_VAL(&req.tlv, GSM48_IE_GMM_PDP_CTX_STATUS));
- process_ms_ctx_status(mmctx, pdp_status);
+ if (TLVP_PRES_LEN(&req.tlv, GSM48_IE_GMM_PDP_CTX_STATUS, 2)) {
+ mmctx->attach_rau.pdp_status_valid = true;
+ mmctx->attach_rau.pdp_status = osmo_load16le(TLVP_VAL(&req.tlv, GSM48_IE_GMM_PDP_CTX_STATUS));
}
/* Send RA UPDATE ACCEPT. In Iu, the RA upd request can be called from
* a new Iu connection, so we might need to re-authenticate the
* connection as well as turn on integrity protection. */
mmctx->pending_req = GSM48_MT_GMM_RA_UPD_REQ;
- return gsm48_gmm_authorize(mmctx);
+
+ bool vlr_created = false;
+ if (!mmctx->vsub) {
+ mmctx->vsub = vlr_subscr_find_or_create_by_tmsi(sgsn->vlr, ptmsi, "mmctx", &vlr_created);
+ if (!mmctx->vsub)
+ goto rejected;
+ }
+
+ mmctx->attach_rau.old_rai = req.old_rai;
+
+ /* FIXME: copy stuff from VSUB over */
+ if (!strlen(mmctx->imsi) && strlen(mmctx->vsub->imsi)) {
+ OSMO_STRLCPY_ARRAY(mmctx->imsi, mmctx->vsub->imsi);
+ }
+
+ if (mmctx->attach_rau.req)
+ osmo_fsm_inst_term(mmctx->attach_rau.rau_fsm, OSMO_FSM_TERM_REGULAR, fsm_term_att_req_chg);
+
+ mmctx->attach_rau.cksq = req.cksq;
+ mmctx->attach_rau.old_rai = req.old_rai;
+ mmctx->attach_rau.rau_type = vlr_rau_type;
+ mmctx->attach_rau.req = msgb_copy_c(mmctx, msg, "GMM ATTACH REQ");
+ mmctx->attach_rau.foreign = foreign_ra;
+
+ gmm_rau_fsm_req(mmctx);
+
+ return 0;
rejected:
/* Send RA UPDATE REJECT */
LOGMMCTXP(LOGL_NOTICE, mmctx,
"Rejecting RA Update Request with cause '%s' (%d)\n",
get_value_string(gsm48_gmm_cause_names, reject_cause), reject_cause);
- rc = gsm48_tx_gmm_ra_upd_rej(msg, reject_cause);
+ rc = gsm48_tx_gmm_ra_upd_rej_oldmsg(msg, reject_cause);
if (mmctx)
mm_ctx_cleanup_free(mmctx, "GMM RA UPDATE REJ");
- else if (llme)
- gprs_llgmm_unassign(llme);
+ else if (llme) {
+ /* There could be a corner case where the LLME is part of a MMCtx */
+ mmctx = sgsn_mm_ctx_by_llme(llme);
+ if (mmctx) {
+ mm_ctx_cleanup_free(mmctx, "GMM RA UPDATE REJ");
+ } else {
+ gprs_llgmm_unassign(llme);
+ }
#ifdef BUILD_IU
- else if (MSG_IU_UE_CTX(msg)) {
+ } else if (MSG_IU_UE_CTX(msg)) {
unsigned long X1001 = osmo_tdef_get(sgsn->cfg.T_defs, -1001, OSMO_TDEF_S, -1);
ranap_iu_tx_release_free(MSG_IU_UE_CTX(msg), NULL, (int) X1001);
}
@@ -1849,30 +1802,21 @@
/* 3GPP TS 24.008 § 9.4.16: Routing area update complete */
static int gsm48_rx_gmm_ra_upd_compl(struct sgsn_mm_ctx *mmctx)
{
- struct sgsn_signal_data sig_data;
+ int rc = 0;
/* only in case SGSN offered new P-TMSI */
LOGMMCTXP(LOGL_INFO, mmctx, "-> ROUTING AREA UPDATE COMPLETE\n");
mmctx_timer_stop(mmctx, 3350);
mmctx->t3350_mode = GMM_T3350_MODE_NONE;
mmctx->p_tmsi_old = 0;
mmctx->pending_req = 0;
- osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_SUCCESS, NULL);
- switch(mmctx->ran_type) {
- case MM_CTX_T_UTRAN_Iu:
- osmo_fsm_inst_dispatch(mmctx->iu.mm_state_fsm, E_PMM_RA_UPDATE, NULL);
- break;
- case MM_CTX_T_GERAN_Gb:
- /* Unassign the old TLLI */
- mmctx->gb.tlli = mmctx->gb.tlli_new;
- gprs_llgmm_assign(mmctx->gb.llme, TLLI_UNASSIGNED,
- mmctx->gb.tlli_new);
- osmo_fsm_inst_dispatch(mmctx->gb.mm_state_fsm, E_MM_RA_UPDATE, NULL);
- break;
+
+ if (mmctx->attach_rau.rau_fsm) {
+ rc = osmo_fsm_inst_dispatch(mmctx->attach_rau.rau_fsm, GMM_RAU_E_UE_RAU_COMPLETE, NULL);
}
- memset(&sig_data, 0, sizeof(sig_data));
- sig_data.mm = mmctx;
- osmo_signal_dispatch(SS_SGSN, S_SGSN_UPDATE, &sig_data);
+ if (!mmctx->attach_rau.rau_fsm || rc != 0) {
+ /* FIXME: fail gracefully here or just ignore?! */
+ }
return 0;
}
@@ -1903,6 +1847,7 @@
uint8_t service_type, mi_len;
struct tlv_parsed tp;
struct osmo_mobile_identity mi;
+ struct osmo_routing_area_id ra_id;
char mi_log_string[32];
enum gsm48_gmm_cause reject_cause;
int rc;
@@ -1915,8 +1860,10 @@
return -1;
}
- /* Skip Ciphering key sequence number 10.5.1.2 */
- /* uint8_t ciph_seq_nr = *cur & 0x07; */
+ gprs_rai_to_osmo(&ra_id, &MSG_IU_UE_CTX(msg)->ra_id);
+
+ /* Ciphering key sequence number 10.5.1.2 */
+ uint8_t key_seq = *cur & 0x07;
/* Service type 10.5.5.20 */
service_type = (*cur++ >> 4) & 0x07;
@@ -1968,7 +1915,6 @@
goto rejected;
}
- osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
ctx->iu.service.type = service_type;
@@ -1977,6 +1923,8 @@
if (TLVP_PRESENT(&tp, GSM48_IE_GMM_PDP_CTX_STATUS)) {
uint16_t pdp_status = tlvp_val16be(&tp, GSM48_IE_GMM_PDP_CTX_STATUS);
+ /* FIXME: this should be done after the connection has been authenticated! */
+
process_ms_ctx_status(ctx, pdp_status);
/* 3GPP TS 24.008 § 4.7.13.4 Service request procedure not
@@ -1990,9 +1938,34 @@
}
}
+ /* FIXME: validate the information *before* requesting the vlr proc acc,
+ * because if the information can't be served, we don't need/have to
+ * respond here. E.g. PDP session doesn't exist any more */
ctx->pending_req = GSM48_MT_GMM_SERVICE_REQ;
- return gsm48_gmm_authorize(ctx);
+
+ /* FIXME: we should validate this RA_ID is correct for the UE */
+ if (ctx->vsub) {
+ vlr_proc_acc_req(ctx->gmm_fsm,
+ E_GMM_SERVICE_ACCEPT,
+ E_GMM_SERVICE_REJECT,
+ NULL,
+ sgsn->vlr, ctx,
+ VLR_PR_ARQ_T_CM_SERV_REQ, GSM48_CMSERV_MO_CALL_PACKET,
+ &mi,
+ &ra_id.lac,
+ false, /* TODO: auth is not required when we still got a valid auth key */
+ true, /* TODO: is_ciphering_to_be_attempted, rework to allow no-auth-attach */
+ true, /* TODO: is_ciphering_required, rework to allow no-auth-attach */
+ key_seq,
+ sgsn_mm_ctx_is_r99(ctx), true);
+ /* FIXME: check PMM_IDLE / PMM CONNECT for ciphering complete as implicit */
+ return 0;
+ } else {
+ reject_cause = GMM_CAUSE_NET_FAIL;
+ goto rejected;
+ }
+
err_inval:
LOGPC(DMM, LOGL_INFO, "\n");
@@ -2009,7 +1982,6 @@
}
-
static int gsm48_rx_gmm_status(struct sgsn_mm_ctx *mmctx, struct msgb *msg)
{
struct gsm48_hdr *gh = msgb_l3(msg);
@@ -2132,9 +2104,7 @@
case GSM48_MT_GMM_DETACH_ACK:
if (!mmctx)
goto null_mmctx;
- LOGMMCTXP(LOGL_INFO, mmctx, "-> DETACH ACK\n");
- mm_ctx_cleanup_free(mmctx, "GMM DETACH ACK");
- rc = 0;
+ rc = gsm48_rx_gmm_det_accept(mmctx, msg);
break;
case GSM48_MT_GMM_ATTACH_COMPL:
if (!mmctx)
@@ -2182,74 +2152,9 @@
static void mmctx_timer_cb(void *_mm)
{
struct sgsn_mm_ctx *mm = _mm;
- struct gsm_auth_tuple *at;
- int rc;
- unsigned long seconds;
-
mm->num_T_exp++;
switch (mm->T) {
- case 3350: /* waiting for ATTACH COMPLETE */
- if (mm->num_T_exp >= 5) {
- LOGMMCTXP(LOGL_NOTICE, mm, "T3350 expired >= 5 times\n");
- mm_ctx_cleanup_free(mm, "T3350");
- /* FIXME: should we return some error? */
- break;
- }
- /* re-transmit the respective msg and re-start timer */
- switch (mm->t3350_mode) {
- case GMM_T3350_MODE_ATT:
- gsm48_tx_gmm_att_ack(mm);
- break;
- case GMM_T3350_MODE_RAU:
- gsm48_tx_gmm_ra_upd_ack(mm);
- break;
- case GMM_T3350_MODE_PTMSI_REALL:
- /* FIXME */
- break;
- case GMM_T3350_MODE_NONE:
- LOGMMCTXP(LOGL_NOTICE, mm,
- "T3350 mode wasn't set, ignoring timeout\n");
- break;
- }
- seconds = osmo_tdef_get(sgsn->cfg.T_defs, 3350, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&mm->timer, seconds, 0);
- break;
- case 3360: /* waiting for AUTH AND CIPH RESP */
- if (mm->num_T_exp >= 5) {
- LOGMMCTXP(LOGL_NOTICE, mm, "T3360 expired >= 5 times\n");
- mm_ctx_cleanup_free(mm, "T3360");
- break;
- }
- /* Re-transmit the respective msg and re-start timer */
- if (mm->auth_triplet.key_seq == GSM_KEY_SEQ_INVAL) {
- LOGMMCTXP(LOGL_ERROR, mm,
- "timeout: invalid auth triplet reference\n");
- mm_ctx_cleanup_free(mm, "T3360");
- break;
- }
- at = &mm->auth_triplet;
-
- rc = gsm48_tx_gmm_auth_ciph_req(mm, &at->vec, at->key_seq, false);
- if (rc < 0) {
- LOGMMCTXP(LOGL_ERROR, mm, "failed sending Auth. & Ciph. Request: %s \n", strerror(-rc));
- } else {
- seconds = osmo_tdef_get(sgsn->cfg.T_defs, 3360, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&mm->timer, seconds, 0);
- }
- break;
- case 3370: /* waiting for IDENTITY RESPONSE */
- if (mm->num_T_exp >= 5) {
- LOGMMCTXP(LOGL_NOTICE, mm, "T3370 expired >= 5 times\n");
- gsm48_tx_gmm_att_rej(mm, GMM_CAUSE_MS_ID_NOT_DERIVED);
- mm_ctx_cleanup_free(mm, "GMM ATTACH REJECT (T3370)");
- break;
- }
- /* re-tranmit IDENTITY REQUEST and re-start timer */
- gsm48_tx_gmm_id_req(mm, mm->t3370_id_type);
- seconds = osmo_tdef_get(sgsn->cfg.T_defs, 3370, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&mm->timer, seconds, 0);
- break;
default:
LOGMMCTXP(LOGL_ERROR, mm, "timer expired in unknown mode %u\n",
mm->T);
@@ -2378,3 +2283,288 @@
return rc;
}
+
+static int vlr_tx_auth_req_cb(void *ref, struct vlr_auth_tuple *at, bool send_autn)
+{
+ struct sgsn_mm_ctx *mmctx = ref;
+ if (!mmctx)
+ return -EINVAL;
+
+ mmctx->auth_triplet.key_seq = at->key_seq;
+ mmctx->auth_triplet.vec = at->vec;
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
+ return gsm48_tx_gmm_auth_ciph_req(mmctx, &at->vec, at->key_seq, false);
+}
+
+static int vlr_tx_auth_rej_cb(void *ref)
+{
+ struct sgsn_mm_ctx *mmctx = ref;
+ int rc;
+ if (!mmctx)
+ return -EINVAL;
+
+ rc = gsm48_tx_gmm_auth_ciph_rej(mmctx);
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_FAILED, NULL);
+
+ return rc;
+}
+
+static int vlr_subscr_assoc_cb(void *ref, struct vlr_subscr *vsub)
+{
+ struct sgsn_mm_ctx *mmctx = ref;
+ if (!mmctx)
+ return -EINVAL;
+
+ vlr_subscr_get(vsub, "mmctx");
+ mmctx->vsub = vsub;
+ /* FIXME: copy stuff from VSUB over */
+ if (!strlen(mmctx->imsi) && strlen(mmctx->vsub->imsi)) {
+ OSMO_STRLCPY_ARRAY(mmctx->imsi, mmctx->vsub->imsi);
+ }
+
+ return 0;
+}
+
+static void vlr_subscr_inval_cb(void *ref, struct vlr_subscr *vsub, enum gsm48_reject_value cause, bool is_update_procedure)
+{
+ struct sgsn_mm_ctx *mmctx = ref;
+ long data = cause;
+
+ if (!mmctx)
+ return;
+
+ if (!mmctx->vsub)
+ return;
+
+ if (!mmctx->gmm_fsm)
+ return;
+
+ if (gmm_fsm_is_registered(mmctx->gmm_fsm))
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, is_update_procedure ? E_GMM_CLEANUP : E_GMM_NET_INIT_DETACH_REQ, &data);
+
+ /* FIXME: when loosing the VLR subscriber, we should ensure the GMM is in IDLE (same for PMM) */
+ vlr_subscr_put(vsub, "mmctx");
+ mmctx->vsub = NULL;
+}
+
+static void vlr_subscr_update_cb(struct vlr_subscr *vsub)
+{
+ /* FIXME: update the subscriber, MSISDN, APN related infos */
+}
+
+static int vlr_tx_id_req_cb(void *ref, uint8_t mi_type)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
+ return gsm48_tx_gmm_id_req(ctx, mi_type);
+}
+
+static int vlr_tx_lu_acc_cb(void *ref, uint32_t send_tmsi, enum vlr_lu_type lu_type)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ /* FIXME: rethink p-tmsi relocation */
+ if (ctx->p_tmsi != send_tmsi && ctx->p_tmsi != GSM_RESERVED_TMSI && send_tmsi != GSM_RESERVED_TMSI)
+ {
+ ctx->p_tmsi_old = ctx->p_tmsi;
+ ctx->p_tmsi = send_tmsi;
+ ctx->gb.tlli_new = gprs_tmsi2tlli(ctx->p_tmsi, TLLI_LOCAL);
+
+ if (ctx->ran_type == MM_CTX_T_GERAN_Gb) {
+ /* Inform LLC layer about new TLLI but keep old active */
+ if (sgsn_mm_ctx_is_authenticated(ctx))
+ gprs_llme_copy_key(ctx, ctx->gb.llme);
+
+ gprs_llgmm_assign(ctx->gb.llme, ctx->gb.tlli, ctx->gb.tlli_new);
+ }
+ }
+
+ if (ctx->attach_rau.rau_fsm) {
+ osmo_fsm_inst_dispatch(ctx->attach_rau.rau_fsm, GMM_RAU_E_VLR_RAU_ACCEPT, (void *) lu_type);
+ }
+
+ /* FIXME: maybe move this */
+ if (ctx->attach_rau.foreign) {
+ switch(ctx->ran_type) {
+ case MM_CTX_T_UTRAN_Iu:
+ osmo_fsm_inst_dispatch(ctx->iu.mm_state_fsm, E_PMM_PS_ATTACH, NULL);
+ break;
+ case MM_CTX_T_GERAN_Gb:
+ osmo_fsm_inst_dispatch(ctx->gb.mm_state_fsm, E_MM_GPRS_ATTACH, NULL);
+ break;
+ }
+ }
+
+ // inform LLC layer
+
+ /* FIXME: kick GMM FSM - only on Complete, right? */
+ /* TODO: check here if we need to send a Attach Accept or Routing Area Accept (use update type?) */
+
+ return 0;
+}
+
+static int vlr_tx_lu_rej_cb(void *ref, enum gsm48_reject_value cause, enum vlr_lu_type lu_type)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ if (ctx->attach_rau.rau_fsm)
+ osmo_fsm_inst_dispatch(ctx->attach_rau.rau_fsm, GMM_RAU_E_VLR_RAU_REJECT, (void *) cause);
+
+ return 0;
+}
+
+static int vlr_tx_cm_serv_acc_cb(void *ref, enum osmo_cm_service_type cm_service_type)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ /* PMM_IDLE, a successful Security Command is an implicit Service Accept */
+ /* PMM_DETACHED shouldn't reached and a Service Request is checked before */
+ if (ctx->iu.mm_state_fsm->state == ST_PMM_CONNECTED) {
+ gsm48_tx_gmm_service_ack(ctx);
+ }
+
+ return 0;
+}
+
+static int vlr_tx_cm_serv_rej_cb(void *ref, enum osmo_cm_service_type cm_service_type, enum gsm48_reject_value cause)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ return gsm48_tx_gmm_service_rej(ctx, cause);
+}
+
+static int vlr_set_ciph_mode_cb(void *ref, bool umts_aka, bool retrieve_imeisv)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ struct vlr_subscr *vsub;
+ bool send_ck;
+
+ if (!ctx)
+ return -EINVAL;
+
+ // FIXME: decide if we want the VLR code to decide which ciphering
+
+ /* for geran, we do nothing right now */
+ if (ctx->ran_type == MM_CTX_T_GERAN_Gb)
+ return 0;
+
+ vsub = ctx->vsub;
+ if (!vsub || !vsub->last_tuple) {
+ LOGMMCTXP(LOGL_ERROR, ctx, "Set cipher mode callback failed with NULL vsub or empty tuple");
+ return -EINVAL;
+ }
+
+ send_ck = sgsn->cfg.uea_encryption_mask > (1 << OSMO_UTRAN_UEA0);
+ ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, send_ck, ctx->iu.new_key);
+
+ return 0;
+}
+
+static int vlr_tx_common_id_cb(void *ref)
+{
+ struct sgsn_mm_ctx *ctx = ref;
+ if (!ctx)
+ return -EINVAL;
+
+ if (ctx->ran_type == MM_CTX_T_UTRAN_Iu)
+ return ranap_iu_tx_common_id(ctx->iu.ue_ctx, ctx->imsi);
+
+ return 0;
+}
+
+static int vlr_tx_mm_info_cb(void *ref)
+{
+ return 0;
+}
+
+/* decide if the location/routing area id is within the VLR or not */
+static bool vlr_location_served_cb(struct vlr_subscr *vsub, const struct osmo_routing_area_id *rai)
+{
+ return false;
+}
+
+int vlr_pvlr_request_cb(void *ref, const struct osmo_routing_area_id *old_rai)
+{
+ return 1;
+}
+
+
+/* Fixme: rename into gsup .client mux init */
+int gmm_vlr_init(struct sgsn_instance *sgi)
+{
+ const char *addr_str;
+ struct ipaccess_unit *ipa_dev;
+ int rc;
+
+ osmo_vlr_set_log_cat(OSMO_VLR_LOGC_VLR, DVLR);
+
+ struct vlr_ops vlr_ops = {
+ .subscr_assoc = vlr_subscr_assoc_cb,
+ .subscr_inval = vlr_subscr_inval_cb,
+ .subscr_update = vlr_subscr_update_cb,
+ .location_served = vlr_location_served_cb,
+
+ .set_ciph_mode = vlr_set_ciph_mode_cb,
+
+ .tx_id_req = vlr_tx_id_req_cb,
+ .tx_auth_req = vlr_tx_auth_req_cb,
+ .tx_auth_rej = vlr_tx_auth_rej_cb,
+
+ .tx_cm_serv_acc = vlr_tx_cm_serv_acc_cb,
+ .tx_cm_serv_rej = vlr_tx_cm_serv_rej_cb,
+ .tx_mm_info = vlr_tx_mm_info_cb,
+ .tx_lu_acc = vlr_tx_lu_acc_cb,
+ .tx_lu_rej = vlr_tx_lu_rej_cb,
+
+ .tx_common_id = vlr_tx_common_id_cb,
+
+ .tx_pvlr_request = vlr_pvlr_request_cb,
+ };
+
+ addr_str = inet_ntoa(sgi->cfg.gsup_server_addr.sin_addr);
+
+ sgi->gcm = gsup_client_mux_alloc(sgi);
+ OSMO_ASSERT(sgi->gcm);
+
+ ipa_dev = talloc_zero(sgi, struct ipaccess_unit);
+ ipa_dev->unit_name = "SGSN";
+ ipa_dev->serno = sgi->cfg.sgsn_ipa_name; /* NULL unless configured via VTY */
+ ipa_dev->swversion = PACKAGE_NAME "-" PACKAGE_VERSION;
+
+ sgi->gcm->rx_cb[OSMO_GSUP_MESSAGE_CLASS_SUBSCRIBER_MANAGEMENT] = (struct gsup_client_mux_rx_cb){
+ .func = vlr_gsup_rx,
+ .data = sgsn->vlr,
+ };
+
+ rc = gsup_client_mux_start(sgi->gcm, addr_str, sgi->cfg.gsup_server_port, ipa_dev);
+ if (rc)
+ return rc;
+
+ sgi->vlr = vlr_alloc(sgi, &vlr_ops, true);
+ if (!sgi->vlr)
+ return -1;
+
+ sgsn->vlr->cfg.assign_tmsi = true;
+ sgsn->vlr->cfg.auth_reuse_old_sets_on_error = false;
+ sgsn->vlr->cfg.auth_tuple_max_reuse_count = 0;
+ sgsn->vlr->cfg.is_ps = true;
+
+ rc = vlr_start(sgsn->vlr, sgsn->gcm);
+ if (rc < 0) {
+ LOGP(DGPRS, LOGL_FATAL, "Cannot set up VLR\n");
+ return rc;
+ }
+
+ return 0;
+}
diff --git a/src/sgsn/gprs_gmm_attach.c b/src/sgsn/gprs_gmm_attach.c
index 6331992..e69de29 100644
--- a/src/sgsn/gprs_gmm_attach.c
+++ b/src/sgsn/gprs_gmm_attach.c
@@ -1,478 +0,0 @@
-#include <osmocom/core/tdef.h>
-#include <osmocom/crypt/utran_cipher.h>
-
-#include <osmocom/sgsn/gprs_gmm_attach.h>
-
-#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
-#include <osmocom/sgsn/debug.h>
-#include <osmocom/sgsn/gprs_gmm.h>
-#include <osmocom/sgsn/mmctx.h>
-#include <osmocom/sgsn/sgsn.h>
-
-#define X(s) (1 << (s))
-
-static int require_identity_imei = 1;
-static int require_auth = 1;
-
-static const struct osmo_tdef_state_timeout gmm_attach_fsm_timeouts[32] = {
- [ST_IDENTIY] = { .T=3370 },
- [ST_AUTH] = { .T=3360 },
- [ST_ACCEPT] = { .T=3350 },
- [ST_ASK_VLR] = { .T=3350 },
- [ST_IU_SECURITY_CMD] = { .T=3350 },
-};
-
-#define gmm_attach_fsm_state_chg(fi, NEXT_STATE) \
- osmo_tdef_fsm_inst_state_chg(fi, NEXT_STATE, gmm_attach_fsm_timeouts, sgsn->cfg.T_defs, -1)
-
-
-static void st_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
- struct msgb *attach_req = data;
-
- /* we can run st_init multiple times */
- if (ctx->gmm_att_req.attach_req)
- msgb_free(ctx->gmm_att_req.attach_req);
-
- ctx->gmm_att_req.attach_req = msgb_copy(attach_req, "Attach Request");
- ctx->auth_state = SGSN_AUTH_UNKNOWN;
- ctx->gmm_att_req.auth_reattempt = 0;
-
- /*
- * TODO: remove pending_req as soon the sgsn_auth code doesn't depend
- * on it.
- * pending_req must be set, even this fsm doesn't use it, because
- * the sgsn_auth code is using this too
- */
- ctx->pending_req = GSM48_MT_GMM_ATTACH_REQ;
-
- if (require_identity_imei) {
- ctx->gmm_att_req.id_type = GSM_MI_TYPE_IMEI;
- gmm_attach_fsm_state_chg(fi, ST_IDENTIY);
- } else if (!strlen(ctx->imsi)) {
- ctx->gmm_att_req.id_type = GSM_MI_TYPE_IMSI;
- gmm_attach_fsm_state_chg(fi, ST_IDENTIY);
- } else if (require_auth)
- gmm_attach_fsm_state_chg(fi, ST_AUTH);
- else
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
-}
-
-static void st_identity_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
- int ret = 0;
-
- ctx->num_T_exp = 0;
-
- switch (ctx->gmm_att_req.id_type) {
- case GSM_MI_TYPE_IMEI:
- case GSM_MI_TYPE_IMSI:
- break;
- default:
- /* TODO logging */
- osmo_fsm_inst_dispatch(fi, E_REJECT, NULL);
- return;
- }
-
- ctx->t3370_id_type = ctx->gmm_att_req.id_type;
- ret = gsm48_tx_gmm_id_req(ctx, ctx->gmm_att_req.id_type);
- if (ret < 0) {
- LOGPFSM(fi, "Can not send tx_gmm_id %d.\n", ret);
- osmo_fsm_inst_dispatch(fi, E_REJECT, NULL);
- }
-}
-
-static void st_identity(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
-
- OSMO_ASSERT(event == E_IDEN_RESP_RECV);
-
- /* check if we received a identity response */
- long type = (long) data;
- switch (type) {
- case GSM_MI_TYPE_IMEI:
- case GSM_MI_TYPE_IMSI:
- break;
- default:
- LOGMMCTXP(LOGL_ERROR, ctx, "Unknown mi type: 0x%lx, rejecting MS.\n", type);
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_CAUSE_NET_FAIL);
- return;
- }
-
- if (type != ctx->gmm_att_req.id_type) {
- /* ignore wrong package */
- /* TODO logging */
- return;
- }
-
- if (type == GSM_MI_TYPE_IMEI && !strlen(ctx->imsi)) {
- ctx->gmm_att_req.id_type = GSM_MI_TYPE_IMSI;
- gmm_attach_fsm_state_chg(fi, ST_IDENTIY);
- } else if (require_auth)
- gmm_attach_fsm_state_chg(fi, ST_AUTH);
- else
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
-}
-
-static void st_auth_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
- enum sgsn_auth_state auth_state;
-
- ctx->num_T_exp = 0;
-
- /* TODO: remove this layer violation. Don't parse any auth_policy here
- * The correct way would be to ask the SGSN is this mmctx has to be auth
- * regardless of the state.
- * Otherwise someone else could steal the TLLI and just use it without further
- * auth.
- */
- if (sgsn->cfg.auth_policy != SGSN_AUTH_POLICY_REMOTE) {
- /* we can "trust" sgsn_auth_state as long it's not remote */
- auth_state = sgsn_auth_state(ctx);
- } else {
- auth_state = ctx->auth_state;
- }
-
- switch(auth_state) {
- case SGSN_AUTH_UMTS_RESYNC: /* ask the vlr for a new vector to match the simcards seq */
- case SGSN_AUTH_UNKNOWN: /* the SGSN doesn know this MS */
- gmm_attach_fsm_state_chg(fi, ST_ASK_VLR);
- break;
- case SGSN_AUTH_REJECTED:
- /* TODO: correct GMM cause */
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_CAUSE_GPRS_NOTALLOWED);
- break;
- case SGSN_AUTH_ACCEPTED:
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
- break;
- case SGSN_AUTH_AUTHENTICATE:
- if (ctx->auth_triplet.key_seq == GSM_KEY_SEQ_INVAL) {
- /* invalid key material */
- gmm_attach_fsm_state_chg(fi, ST_ASK_VLR);
- }
-
- struct gsm_auth_tuple *at = &ctx->auth_triplet;
- if (gsm48_tx_gmm_auth_ciph_req(ctx, &at->vec, at->key_seq,
- false) < 0) {
- /* network failure */
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_CAUSE_NET_FAIL);
- }
- ctx->gmm_att_req.auth_reattempt++;
- break;
- }
-}
-
-static void st_auth(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
-
- switch (event) {
- case E_AUTH_RESP_RECV_SUCCESS:
- sgsn_auth_request(ctx);
-#ifdef BUILD_IU
- if (ctx->ran_type == MM_CTX_T_UTRAN_Iu && !ctx->iu.ue_ctx->integrity_active)
- gmm_attach_fsm_state_chg(fi, ST_IU_SECURITY_CMD);
- else
-#endif /* BUILD_IU */
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
- break;
- case E_AUTH_RESP_RECV_RESYNC:
- if (ctx->gmm_att_req.auth_reattempt <= 1)
- gmm_attach_fsm_state_chg(fi, ST_ASK_VLR);
- else
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_CAUSE_SYNC_FAIL);
- break;
- }
-}
-
-static void st_accept_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
-
- ctx->num_T_exp = 0;
-
- /* TODO: remove pending_req as soon the sgsn_auth code doesn't depend on it */
- ctx->pending_req = 0;
- gsm48_tx_gmm_att_ack(ctx);
-}
-
-static void st_accept(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
-
- switch(event) {
- case E_ATTACH_COMPLETE_RECV:
- /* TODO: #ifdef ! PTMSI_ALLOC is not supported */
- extract_subscr_msisdn(ctx);
- extract_subscr_hlr(ctx);
- osmo_fsm_inst_state_chg(fi, ST_INIT, 0, 0);
- break;
- case E_VLR_ANSWERED:
- extract_subscr_msisdn(ctx);
- extract_subscr_hlr(ctx);
- LOGMMCTXP(LOGL_NOTICE, ctx,
- "Unusual event: if MS got no data connection, check that it has APN configured.\n");
- break;
- }
-}
-
-static void st_reject(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
- long reject_cause = (long) data;
-
- if (reject_cause != GMM_DISCARD_MS_WITHOUT_REJECT)
- gsm48_tx_gmm_att_rej(ctx, (uint8_t) reject_cause);
-
- sgsn_mm_ctx_cleanup_free(ctx);
-}
-
-static void st_ask_vlr_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
-
- /* FIXME: remove this layer violation.
- * The VLR should send the message to the HLR and not the rx function
- * gsm48_rx_gmm_auth_ciph_fail. Because gmm_auth_ciph_fail already send a
- * message to the HLR, we don't send here a request. */
- if (ctx->auth_state == SGSN_AUTH_UMTS_RESYNC)
- return;
-
- /* ask the auth layer for more data */
- sgsn_auth_request(ctx);
-}
-
-static void st_ask_vlr(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- switch(event) {
- case E_VLR_ANSWERED:
- gmm_attach_fsm_state_chg(fi, ST_AUTH);
- break;
- }
-}
-
-static void st_iu_security_cmd_on_enter(struct osmo_fsm_inst *fi, uint32_t prev_state)
-{
-#ifdef BUILD_IU
- struct sgsn_mm_ctx *ctx = fi->priv;
- bool send_ck;
-
- /* TODO: shouldn't this set always? not only when the integrity_active? */
- if (ctx->iu.ue_ctx->integrity_active) {
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
- return;
- }
-
- /* Is any encryption above UEA0 enabled? */
- send_ck = sgsn->cfg.uea_encryption_mask > (1 << OSMO_UTRAN_UEA0);
- LOGMMCTXP(LOGL_DEBUG, ctx, "Iu Security Mode Command: %s encryption key (UEA encryption mask = 0x%x)\n",
- send_ck ? "sending" : "not sending", sgsn->cfg.uea_encryption_mask);
-
- /* FIXME: we should send the set of allowed UEA, as in ranap_new_msg_sec_mod_cmd2(). However, this
- * is not possible in the iu_client API. See OS#5487. */
- ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, send_ck, ctx->iu.new_key);
- ctx->iu.new_key = 0;
-#endif
-}
-
-static void st_iu_security_cmd(struct osmo_fsm_inst *fi, uint32_t event, void *data)
-{
- switch(event) {
- case E_VLR_ANSWERED:
- /* We may receive an event due to rx
- * OSMO_GSUP_MSGT_INSERT_DATA_REQUEST here. Do nothing, update of
- * subscriber is done by lower layers before event is signalled.
- * In this state we simply wait for E_IU_SECURITY_CMD_COMPLETE
- */
- break;
- case E_IU_SECURITY_CMD_COMPLETE:
- gmm_attach_fsm_state_chg(fi, ST_ACCEPT);
- break;
- }
-}
-
-static struct osmo_fsm_state gmm_attach_req_fsm_states[] = {
- /* default state for non-DTX and DTX when SPEECH is in progress */
- [ST_INIT] = {
- .in_event_mask = X(E_ATTACH_REQ_RECV),
- .out_state_mask = X(ST_INIT) | X(ST_IDENTIY) | X(ST_AUTH) | X(ST_ACCEPT),
- .name = "Init",
- .action = st_init,
- },
- [ST_ASK_VLR] = {
- .in_event_mask = X(E_VLR_ANSWERED),
- .out_state_mask = X(ST_INIT) | X(ST_AUTH) | X(ST_ACCEPT) | X(ST_REJECT),
- .name = "AskVLR",
- .onenter = st_ask_vlr_on_enter,
- .action = st_ask_vlr,
- },
- [ST_IDENTIY] = {
- .in_event_mask = X(E_IDEN_RESP_RECV),
- .out_state_mask = X(ST_INIT) | X(ST_AUTH) | X(ST_ACCEPT) | X(ST_IDENTIY) | X(ST_REJECT),
- .onenter = st_identity_on_enter,
- .name = "CheckIdentity",
- .action = st_identity,
- },
- [ST_AUTH] = {
- .in_event_mask = X(E_AUTH_RESP_RECV_SUCCESS) | X(E_AUTH_RESP_RECV_RESYNC),
- .out_state_mask = X(ST_INIT) | X(ST_AUTH) | X(ST_IU_SECURITY_CMD) | X(ST_ACCEPT) | X(ST_ASK_VLR) | X(ST_REJECT),
- .name = "Authenticate",
- .onenter = st_auth_on_enter,
- .action = st_auth,
- },
- [ST_IU_SECURITY_CMD] = {
- .in_event_mask = X(E_IU_SECURITY_CMD_COMPLETE) | X(E_VLR_ANSWERED),
- .out_state_mask = X(ST_INIT) | X(ST_AUTH) | X(ST_ACCEPT) | X(ST_REJECT),
- .name = "IuSecurityCommand",
- .onenter = st_iu_security_cmd_on_enter,
- .action = st_iu_security_cmd,
- },
- [ST_ACCEPT] = {
- .in_event_mask = X(E_ATTACH_COMPLETE_RECV) | X(E_VLR_ANSWERED),
- .out_state_mask = X(ST_INIT) | X(ST_REJECT),
- .name = "WaitAttachComplete",
- .onenter = st_accept_on_enter,
- .action = st_accept,
- },
- [ST_REJECT] = {
- .in_event_mask = X(E_REJECT),
- .out_state_mask = X(ST_INIT),
- .name = "Reject",
- .action = st_reject,
- },
-};
-
-const struct value_string gmm_attach_req_fsm_event_names[] = {
- OSMO_VALUE_STRING(E_ATTACH_REQ_RECV),
- OSMO_VALUE_STRING(E_IDEN_RESP_RECV),
- OSMO_VALUE_STRING(E_AUTH_RESP_RECV_SUCCESS),
- OSMO_VALUE_STRING(E_AUTH_RESP_RECV_RESYNC),
- OSMO_VALUE_STRING(E_ATTACH_ACCEPTED),
- OSMO_VALUE_STRING(E_ATTACH_ACCEPT_SENT),
- OSMO_VALUE_STRING(E_ATTACH_COMPLETE_RECV),
- OSMO_VALUE_STRING(E_IU_SECURITY_CMD_COMPLETE),
- OSMO_VALUE_STRING(E_REJECT),
- OSMO_VALUE_STRING(E_VLR_ANSWERED),
- { 0, NULL }
-};
-
-void gmm_attach_allstate_action(struct osmo_fsm_inst *fi, uint32_t event, void *data) {
- struct sgsn_mm_ctx *ctx = fi->priv;
- struct msgb *new_attach_req = data;
-
- switch (event) {
- case E_ATTACH_REQ_RECV:
- switch (fi->state) {
- case ST_INIT:
- case ST_REJECT:
- st_init(fi, event, data);
- break;
-
- case ST_ACCEPT:
- /* TODO: drop all state (e.g. PDP Ctx) and do this procedure */
- osmo_fsm_inst_state_chg(fi, ST_INIT, 0, 0);
- st_init(fi, event, data);
- break;
-
- case ST_ASK_VLR:
- case ST_AUTH:
- case ST_IDENTIY:
- case ST_RETRIEVE_AUTH:
- /* 04.08 4.7.3.1.6 d) Abnormal Case
- * Only do action if Req IEs differs. */
- if (ctx->gmm_att_req.attach_req &&
- gprs_gmm_msg_cmp(new_attach_req, ctx->gmm_att_req.attach_req)) {
- osmo_fsm_inst_state_chg(fi, ST_INIT, 0, 0);
- st_init(fi, event, data);
- }
- break;
- }
- break;
- case E_REJECT:
- if (fi->state != ST_REJECT)
- osmo_fsm_inst_state_chg(fi, ST_REJECT, 0, 0);
- st_reject(fi, event, data);
- break;
- }
-}
-
-int gmm_attach_timer_cb(struct osmo_fsm_inst *fi)
-{
- struct sgsn_mm_ctx *ctx = fi->priv;
- struct gsm_auth_tuple *at = &ctx->auth_triplet;
- unsigned long t_secs;
-
- ctx->num_T_exp++;
-
- switch(fi->state) {
- case ST_ASK_VLR:
- /* TODO: replace T3350 by a better timer or it's own
- * re-use T3350 - not defined by standard */
- LOGMMCTXP(LOGL_ERROR, ctx, "HLR did not answer in time. Rejecting.\n");
- osmo_fsm_inst_dispatch(fi, E_REJECT,
- (void *) GMM_CAUSE_NET_FAIL);
- break;
- case ST_IDENTIY:
- /* T3370 */
- if (ctx->num_T_exp >= 5) {
- osmo_fsm_inst_dispatch(fi, E_REJECT,
- (void *) GMM_CAUSE_MS_ID_NOT_DERIVED);
- break;
- }
- gsm48_tx_gmm_id_req(ctx, ctx->gmm_att_req.id_type);
- t_secs = osmo_tdef_get(sgsn->cfg.T_defs, 3370, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&fi->timer, t_secs, 0);
-
- break;
- case ST_AUTH:
- /* T3360 */
- if (ctx->num_T_exp >= 5) {
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_DISCARD_MS_WITHOUT_REJECT);
- break;
- }
- gsm48_tx_gmm_auth_ciph_req(ctx, &at->vec, at->key_seq, false);
- t_secs = osmo_tdef_get(sgsn->cfg.T_defs, 3360, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&fi->timer, t_secs, 0);
- break;
- case ST_ACCEPT:
- /* T3350 */
- if (ctx->num_T_exp >= 5) {
- osmo_fsm_inst_dispatch(fi, E_REJECT, (void *) GMM_DISCARD_MS_WITHOUT_REJECT);
- break;
- }
- gsm48_tx_gmm_att_ack(ctx);
- t_secs = osmo_tdef_get(sgsn->cfg.T_defs, 3350, OSMO_TDEF_S, -1);
- osmo_timer_schedule(&fi->timer, t_secs, 0);
- break;
- }
-
- return 0;
-}
-
-struct osmo_fsm gmm_attach_req_fsm = {
- .name = "GMM_ATTACH_REQ_FSM",
- .states = gmm_attach_req_fsm_states,
- .num_states = ARRAY_SIZE(gmm_attach_req_fsm_states),
- .event_names = gmm_attach_req_fsm_event_names,
- .allstate_event_mask = X(E_REJECT) | X(E_ATTACH_REQ_RECV),
- .allstate_action = gmm_attach_allstate_action,
- .log_subsys = DMM,
- .timer_cb = gmm_attach_timer_cb,
-};
-
-static __attribute__((constructor)) void gprs_gmm_fsm_init(void)
-{
- OSMO_ASSERT(osmo_fsm_register(&gmm_attach_req_fsm) == 0);
-}
-
-void gmm_att_req_free(struct sgsn_mm_ctx *mm) {
- if (mm->gmm_att_req.fsm)
- osmo_fsm_inst_free(mm->gmm_att_req.fsm);
-
- if (mm->gmm_att_req.attach_req)
- msgb_free(mm->gmm_att_req.attach_req);
-}
diff --git a/src/sgsn/gprs_gmm_fsm.c b/src/sgsn/gprs_gmm_fsm.c
index 57e1ec3..976356f 100644
--- a/src/sgsn/gprs_gmm_fsm.c
+++ b/src/sgsn/gprs_gmm_fsm.c
@@ -22,6 +22,7 @@
*/
#include <osmocom/core/tdef.h>
+#include <osmocom/sgsn/gprs_gmm.h>
#include <osmocom/sgsn/gprs_gmm_fsm.h>
#include <osmocom/sgsn/gprs_mm_state_gb_fsm.h>
#include <osmocom/sgsn/gprs_mm_state_iu_fsm.h>
@@ -42,6 +43,14 @@
#define gmm_fsm_state_chg(fi, NEXT_STATE) \
osmo_tdef_fsm_inst_state_chg(fi, NEXT_STATE, gmm_fsm_timeouts, sgsn->cfg.T_defs, -1)
+
+void st_gmm_deregistered_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct sgsn_mm_ctx *mmctx = fi->priv;
+
+ mmctx->gmm_priv.common_proc_to_registered = false;
+}
+
static void st_gmm_deregistered(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
switch(event) {
@@ -54,28 +63,51 @@
}
}
-static void st_gmm_common_proc_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+static void st_gmm_common_proc_init(struct osmo_fsm_inst *fi, uint32_t event, void *_data)
{
+ struct sgsn_mm_ctx *mmctx = fi->priv;
+
switch(event) {
case E_GMM_COMMON_PROC_INIT_REQ:
/* MS may retransmit GPRS Attach Request if for some reason
* CommonProcedure didn't go forward correctly */
break;
/* TODO: events not used
- case E_GMM_LOWER_LAYER_FAILED:
+ case E_GMM_LOWER_LAYER_FAILED: */
case E_GMM_COMMON_PROC_FAILED:
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
break;
- */
- case E_GMM_COMMON_PROC_SUCCESS:
+ case E_GMM_COMMON_PROC_SUCCESS: /* FIXME: a Common Proc Success shouldn't result in getting to Attach *if* this is part of an attach request */
+ /* ignore if a RAU or Attach is in progress */
+ if (mmctx->attach_rau.rau_fsm)
+ break;
+
+ gmm_fsm_state_chg(fi, ST_GMM_REGISTERED_NORMAL);
+ break;
+ case E_GMM_ATTACH_FAILED:
+ case E_GMM_RAU_FAILED:
+ gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
+ break;
case E_GMM_ATTACH_SUCCESS:
+ case E_GMM_RAU_SUCCESS:
gmm_fsm_state_chg(fi, ST_GMM_REGISTERED_NORMAL);
break;
}
}
-static void st_gmm_registered_normal(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+void st_gmm_registered_normal_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
{
+ struct sgsn_mm_ctx *mmctx = fi->priv;
+
+ mmctx->gmm_priv.common_proc_to_registered = true;
+}
+
+static void st_gmm_registered_normal(struct osmo_fsm_inst *fi, uint32_t event, void *_data)
+{
+ struct sgsn_mm_ctx *mmctx = fi->priv;
+ long *data = (long *) _data;
+ bool poweroff;
+
switch(event) {
case E_GMM_COMMON_PROC_INIT_REQ:
gmm_fsm_state_chg(fi, ST_GMM_COMMON_PROC_INIT);
@@ -85,12 +117,22 @@
* E_GMM_ATTACH_SUCCESS instead of E_GMM_COMMON_PROC_SUCCESS then we'll receive the latter here:
* we should simply ignore it */
break;
- /* case E_GMM_NET_INIT_DETACH_REQ:
+ case E_GMM_NET_INIT_DETACH_REQ:
+ OSMO_ASSERT(data);
+ /* data contains the gsm48 reject cause */
+ gsm48_tx_gmm_detach_req(mmctx, GPRS_DET_T_MT_IMSI, (uint8_t) (*data & 0xff));
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED_INIT);
- break; */
- /* case E_GMM_MS_INIT_DETACH_REQ:
+ break;
+ case E_GMM_MS_INIT_DETACH_REQ:
+ if (!data)
+ poweroff = false;
+ else
+ poweroff = !!(*data);
+
+ if (!poweroff)
+ gsm48_tx_gmm_det_ack(mmctx, false);
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
- break; */
+ break;
case E_GMM_SUSPEND:
gmm_fsm_state_chg(fi, ST_GMM_REGISTERED_SUSPENDED);
break;
@@ -112,8 +154,10 @@
static void st_gmm_deregistered_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
switch(event) {
- /* TODO: events not used in osmo-sgsn code
case E_GMM_DETACH_ACCEPTED:
+ gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
+ break;
+ /* TODO: events not used in osmo-sgsn code
case E_GMM_LOWER_LAYER_FAILED:
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
break;
@@ -125,7 +169,8 @@
[ST_GMM_DEREGISTERED] = {
.in_event_mask =
X(E_GMM_COMMON_PROC_INIT_REQ) |
- X(E_GMM_ATTACH_SUCCESS),
+ X(E_GMM_ATTACH_SUCCESS) |
+ X(E_GMM_ATTACH_FAILED),
.out_state_mask = X(ST_GMM_COMMON_PROC_INIT),
.name = "Deregistered",
.action = st_gmm_deregistered,
@@ -133,9 +178,12 @@
[ST_GMM_COMMON_PROC_INIT] = {
.in_event_mask =
/* X(E_GMM_LOWER_LAYER_FAILED) | */
- /* X(E_GMM_COMMON_PROC_FAILED) | */
+ X(E_GMM_COMMON_PROC_FAILED) |
X(E_GMM_COMMON_PROC_SUCCESS) |
X(E_GMM_ATTACH_SUCCESS) |
+ X(E_GMM_ATTACH_FAILED) |
+ X(E_GMM_RAU_SUCCESS) |
+ X(E_GMM_RAU_FAILED) |
X(E_GMM_COMMON_PROC_INIT_REQ),
.out_state_mask =
X(ST_GMM_DEREGISTERED) |
@@ -147,8 +195,8 @@
.in_event_mask =
X(E_GMM_COMMON_PROC_INIT_REQ) |
X(E_GMM_COMMON_PROC_SUCCESS) |
- /* X(E_GMM_NET_INIT_DETACH_REQ) | */
- /* X(E_GMM_MS_INIT_DETACH_REQ) | */
+ X(E_GMM_NET_INIT_DETACH_REQ) |
+ X(E_GMM_MS_INIT_DETACH_REQ) |
X(E_GMM_SUSPEND),
.out_state_mask =
X(ST_GMM_DEREGISTERED) |
@@ -157,10 +205,13 @@
X(ST_GMM_REGISTERED_SUSPENDED),
.name = "Registered.NORMAL",
.action = st_gmm_registered_normal,
+ .onenter = st_gmm_registered_normal_onenter,
},
[ST_GMM_REGISTERED_SUSPENDED] = {
.in_event_mask = X(E_GMM_RESUME) |
- X(E_GMM_COMMON_PROC_INIT_REQ),
+ X(E_GMM_COMMON_PROC_INIT_REQ) |
+ X(E_GMM_RAU_FAILED) |
+ X(E_GMM_RAU_SUCCESS),
.out_state_mask =
X(ST_GMM_DEREGISTERED) |
X(ST_GMM_REGISTERED_NORMAL) |
@@ -175,21 +226,27 @@
.out_state_mask = X(ST_GMM_DEREGISTERED),
.name = "DeregisteredInitiated",
.action = st_gmm_deregistered_init,
+ .onenter = st_gmm_deregistered_onenter,
},
};
const struct value_string gmm_fsm_event_names[] = {
OSMO_VALUE_STRING(E_GMM_COMMON_PROC_INIT_REQ),
- /* OSMO_VALUE_STRING(E_GMM_COMMON_PROC_FAILED), */
+ OSMO_VALUE_STRING(E_GMM_COMMON_PROC_FAILED),
/* OSMO_VALUE_STRING(E_GMM_LOWER_LAYER_FAILED), */
OSMO_VALUE_STRING(E_GMM_COMMON_PROC_SUCCESS),
OSMO_VALUE_STRING(E_GMM_ATTACH_SUCCESS),
- /* OSMO_VALUE_STRING(E_GMM_NET_INIT_DETACH_REQ), */
- /* OSMO_VALUE_STRING(E_GMM_MS_INIT_DETACH_REQ), */
+ OSMO_VALUE_STRING(E_GMM_ATTACH_FAILED),
+ OSMO_VALUE_STRING(E_GMM_RAU_SUCCESS),
+ OSMO_VALUE_STRING(E_GMM_RAU_FAILED),
+ OSMO_VALUE_STRING(E_GMM_NET_INIT_DETACH_REQ),
+ OSMO_VALUE_STRING(E_GMM_MS_INIT_DETACH_REQ),
/* OSMO_VALUE_STRING(E_GMM_DETACH_ACCEPTED), */
OSMO_VALUE_STRING(E_GMM_SUSPEND),
OSMO_VALUE_STRING(E_GMM_CLEANUP),
OSMO_VALUE_STRING(E_GMM_RAT_CHANGE),
+ OSMO_VALUE_STRING(E_GMM_SERVICE_ACCEPT),
+ OSMO_VALUE_STRING(E_GMM_SERVICE_REJECT),
{ 0, NULL }
};
@@ -202,6 +259,7 @@
switch (fi->state) {
case ST_GMM_COMMON_PROC_INIT:
+ /* fixme: this state seems to be wrong. When in COMMON_PROC_INIT, we shouldn't go into deregistered. */
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
default:
if (mmctx->ran_type == MM_CTX_T_GERAN_Gb)
@@ -216,6 +274,9 @@
}
case E_GMM_CLEANUP:
+ if (mmctx->attach_rau.rau_fsm)
+ osmo_fsm_inst_term(mmctx->attach_rau.rau_fsm, OSMO_FSM_TERM_REQUEST, NULL);
+
switch (fi->state) {
case ST_GMM_DEREGISTERED:
break;
@@ -223,6 +284,13 @@
gmm_fsm_state_chg(fi, ST_GMM_DEREGISTERED);
break;
}
+ case E_GMM_SERVICE_ACCEPT:
+ switch (fi->state) {
+ case ST_GMM_REGISTERED_NORMAL:
+ gprs_gmm_service_accepted(mmctx);
+ break;
+ }
+ break;
}
}
@@ -236,7 +304,7 @@
.states = gmm_fsm_states,
.num_states = ARRAY_SIZE(gmm_fsm_states),
.event_names = gmm_fsm_event_names,
- .allstate_event_mask = X(E_GMM_CLEANUP) | X(E_GMM_RAT_CHANGE),
+ .allstate_event_mask = X(E_GMM_CLEANUP) | X(E_GMM_RAT_CHANGE) | X(E_GMM_SERVICE_ACCEPT) | X(E_GMM_SERVICE_REJECT),
.allstate_action = gmm_fsm_allstate_action,
.log_subsys = DMM,
.timer_cb = gmm_fsm_timer_cb,
diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c
index af764de..ff62351 100644
--- a/src/sgsn/gprs_ranap.c
+++ b/src/sgsn/gprs_ranap.c
@@ -43,6 +43,8 @@
#include <osmocom/sgsn/pdpctx.h>
#include <osmocom/sgsn/mmctx.h>
+#include <osmocom/vlr/vlr.h>
+
/* Send RAB activation requests for all PDP contexts */
void activate_pdp_rabs(struct sgsn_mm_ctx *ctx)
{
@@ -163,9 +165,8 @@
if (rc < 0)
sgsn_ranap_iu_free(mm);
- /* TODO: move this into FSM */
- if (mm->ran_type == MM_CTX_T_UTRAN_Iu && mm->gmm_att_req.fsm->state != ST_INIT)
- osmo_fsm_inst_dispatch(mm->gmm_att_req.fsm, E_REJECT, (void *) GMM_DISCARD_MS_WITHOUT_REJECT);
+ if (mm->vsub)
+ vlr_subscr_disconnected(mm->vsub);
rc = 0;
break;
case RANAP_IU_EVENT_SECURITY_MODE_COMPLETE:
@@ -176,13 +177,10 @@
*/
/* Continue authentication here */
mm->iu.ue_ctx->integrity_active = 1;
- ranap_iu_tx_common_id(mm->iu.ue_ctx, mm->imsi);
- /* FIXME: remove gmm_authorize */
- if (mm->pending_req != GSM48_MT_GMM_ATTACH_REQ)
- gsm48_gmm_authorize(mm);
- else
- osmo_fsm_inst_dispatch(mm->gmm_att_req.fsm, E_IU_SECURITY_CMD_COMPLETE, NULL);
+ if (mm->vsub)
+ vlr_subscr_rx_ciph_res(mm->vsub, VLR_CIPH_COMPL);
+
rc = 0;
break;
default:
diff --git a/src/sgsn/gprs_rau_fsm.c b/src/sgsn/gprs_rau_fsm.c
new file mode 100644
index 0000000..60ca6be
--- /dev/null
+++ b/src/sgsn/gprs_rau_fsm.c
@@ -0,0 +1,342 @@
+/* Routing Area Update FSM for MMCtx to synchrozie for foreign RAU to local RAU transistions */
+
+/* (C) 2024 by sysmocom s.f.m.c. GmbH <info(a)sysmocom.de>
+ *
+ * Author: Alexander Couzens <lynxis(a)fe80.eu>
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmocom/core/fsm.h>
+#include <osmocom/core/signal.h>
+#include <osmocom/core/tdef.h>
+#include <osmocom/gsm/gsm48.h>
+#include <osmocom/vlr/vlr.h>
+
+#include <osmocom/sgsn/gprs_llc.h>
+#include <osmocom/sgsn/gprs_mm_state_gb_fsm.h>
+#include <osmocom/sgsn/gprs_mm_state_iu_fsm.h>
+#include <osmocom/sgsn/gprs_gmm.h>
+#include <osmocom/sgsn/gprs_gmm_fsm.h>
+#include <osmocom/sgsn/gprs_rau_fsm.h>
+#include <osmocom/sgsn/gtp.h>
+#include <osmocom/sgsn/mmctx.h>
+#include <osmocom/sgsn/pdpctx.h>
+#include <osmocom/sgsn/sgsn.h>
+#include <osmocom/sgsn/signal.h>
+
+#define S(x) (1 << (x))
+
+const struct value_string gmm_rau_event_names[] = {
+ OSMO_VALUE_STRING(GMM_RAU_E_UE_RAU_REQUEST),
+ OSMO_VALUE_STRING(GMM_RAU_E_VLR_RAU_ACCEPT),
+ OSMO_VALUE_STRING(GMM_RAU_E_VLR_RAU_REJECT),
+ OSMO_VALUE_STRING(GMM_RAU_E_UE_RAU_COMPLETE),
+ OSMO_VALUE_STRING(GMM_RAU_E_VLR_TERM_FAIL),
+ OSMO_VALUE_STRING(GMM_RAU_E_VLR_TERM_SUCCESS),
+ { 0, NULL }
+};
+
+struct osmo_tdef_state_timeout gmm_rau_tdef_states[32] = {
+};
+
+struct osmo_tdef gmm_rau_tdefs[] = {
+ // { .T = 3350, .default_val = 6, .desc = "Attach/RAU Complete Reallocation procedure" },
+ { /* terminator */ }
+};
+
+/* Terminate reason, used by osmo_fsm_term as data */
+char *fsm_term_rau_att_req = "Attach Req Rx while in RAU";
+char *fsm_term_att_req_chg = "Attach Req Changed";
+char *fsm_term_att_rej = "Attach Rej";
+char *fsm_term_att_success = "Attach Success";
+char *fsm_term_rau_req_chg = "RAU Req Changed";
+char *fsm_term_rau_rej = "RAU Rej";
+char *fsm_term_rau_success = "RAU Success";
+
+static inline struct sgsn_mm_ctx *gmm_rau_fsm_priv(struct osmo_fsm_inst *fi)
+{
+ return (struct sgsn_mm_ctx *) fi->priv;
+}
+
+
+static void gmm_rau_fsm_s_init(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
+
+ switch (event) {
+ case GMM_RAU_E_UE_RAU_REQUEST:
+ mmctx->vsub->lu_fsm = vlr_ra_update(
+ mmctx->attach_rau.rau_fsm, GMM_RAU_E_VLR_TERM_SUCCESS, GMM_RAU_E_VLR_TERM_FAIL, NULL,
+ sgsn->vlr,
+ mmctx,
+ mmctx->attach_rau.rau_type,
+ mmctx->p_tmsi,
+ mmctx->imsi,
+ &mmctx->attach_rau.old_rai,
+ &mmctx->ra,
+ sgsn->cfg.auth_policy == SGSN_AUTH_POLICY_REMOTE,
+ mmctx->ciph_algo != GPRS_ALGO_GEA0,
+ mmctx->ciph_algo != GPRS_ALGO_GEA0,
+ mmctx->attach_rau.cksq,
+ sgsn_mm_ctx_is_r99(mmctx),
+ mmctx->ran_type == MM_CTX_T_UTRAN_Iu,
+ true);
+
+ osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_VLR_ANSWER, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_COMMON_PROC_INIT_REQ, NULL);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+static void transmit_rau_accept(struct sgsn_mm_ctx *mmctx)
+{
+ switch (mmctx->attach_rau.rau_type) {
+ case VLR_LU_TYPE_PERIODIC:
+ case VLR_LU_TYPE_REGULAR:
+ gsm48_tx_gmm_ra_upd_ack(mmctx);
+ break;
+ case VLR_LU_TYPE_IMSI_ATTACH:
+ gsm48_tx_gmm_att_ack(mmctx);
+ break;
+ }
+
+}
+
+static void transmit_rau_reject(struct sgsn_mm_ctx *mmctx, uint8_t gmm_cause)
+{
+ if (gmm_cause == 0)
+ gmm_cause = GMM_CAUSE_PROTO_ERR_UNSPEC;
+
+ switch (mmctx->attach_rau.rau_type) {
+ case VLR_LU_TYPE_PERIODIC:
+ case VLR_LU_TYPE_REGULAR:
+ gsm48_tx_gmm_ra_upd_rej(mmctx, gmm_cause);
+ break;
+ case VLR_LU_TYPE_IMSI_ATTACH:
+ gsm48_tx_gmm_att_rej(mmctx, gmm_cause);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ }
+}
+
+static void gmm_rau_fsm_s_wait_vlr(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
+ uint8_t gmm_cause;
+
+ switch (event) {
+ case GMM_RAU_E_UE_RAU_REQUEST:
+ /* same RAU, a different RAU would terminate this FSM */
+ break;
+ case GMM_RAU_E_VLR_RAU_ACCEPT:
+ transmit_rau_accept(mmctx);
+ osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_UE_RAU_COMPLETE, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ break;
+ case GMM_RAU_E_VLR_RAU_REJECT:
+ gmm_cause = (uint8_t) ((long) data & 0xff);
+ transmit_rau_reject(mmctx, gmm_cause);
+ break;
+ case GMM_RAU_E_VLR_TERM_FAIL:
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, data);
+ break;
+ case GMM_RAU_E_VLR_TERM_SUCCESS:
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
+static void gmm_rau_fsm_s_wait_ue_rau_compl(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
+ uint8_t cause;
+
+ switch (event) {
+ case GMM_RAU_E_UE_RAU_COMPLETE:
+ /* inform the VLR */
+ if (mmctx->vsub)
+ vlr_subscr_rx_rau_complete(mmctx->vsub);
+
+ /* We need to wait for the VLR/LU FSM to terminate */
+ break;
+ case GMM_RAU_E_VLR_TERM_SUCCESS:
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_REGULAR, NULL);
+ break;
+ case GMM_RAU_E_VLR_TERM_FAIL:
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, NULL);
+ break;
+ case GMM_RAU_E_VLR_RAU_REJECT:
+ /* VLR timed out */
+ cause = ((long) data) & 0xff;
+ transmit_rau_reject(mmctx, cause);
+ osmo_fsm_inst_term(fi, OSMO_FSM_TERM_ERROR, data);
+ break;
+ case GMM_RAU_E_VLR_RAU_ACCEPT:
+ case GMM_RAU_E_UE_RAU_REQUEST:
+ transmit_rau_accept(mmctx);
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+static void gmm_attach_success(struct sgsn_mm_ctx *mmctx)
+{
+ struct sgsn_signal_data sig_data;
+
+ switch(mmctx->ran_type) {
+ case MM_CTX_T_UTRAN_Iu:
+ osmo_fsm_inst_dispatch(mmctx->iu.mm_state_fsm, E_PMM_PS_ATTACH, NULL);
+ break;
+ case MM_CTX_T_GERAN_Gb:
+ /* Unassign the old TLLI */
+ mmctx->gb.tlli = mmctx->gb.tlli_new;
+ gprs_llme_copy_key(mmctx, mmctx->gb.llme);
+ gprs_llgmm_assign(mmctx->gb.llme, TLLI_UNASSIGNED,
+ mmctx->gb.tlli_new);
+ osmo_fsm_inst_dispatch(mmctx->gb.mm_state_fsm, E_MM_GPRS_ATTACH, NULL);
+ break;
+ }
+
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_ATTACH_SUCCESS, NULL);
+
+ memset(&sig_data, 0, sizeof(sig_data));
+ sig_data.mm = mmctx;
+ osmo_signal_dispatch(SS_SGSN, S_SGSN_ATTACH, &sig_data);
+}
+
+static void gmm_rau_success(struct sgsn_mm_ctx *mmctx)
+{
+ struct sgsn_signal_data sig_data;
+
+ switch(mmctx->ran_type) {
+ case MM_CTX_T_UTRAN_Iu:
+ osmo_fsm_inst_dispatch(mmctx->iu.mm_state_fsm, E_PMM_RA_UPDATE, NULL);
+ break;
+ case MM_CTX_T_GERAN_Gb:
+ /* Unassign the old TLLI */
+ mmctx->gb.tlli = mmctx->gb.tlli_new;
+ gprs_llgmm_assign(mmctx->gb.llme, TLLI_UNASSIGNED, mmctx->gb.tlli_new);
+ osmo_fsm_inst_dispatch(mmctx->gb.mm_state_fsm, E_MM_RA_UPDATE, NULL);
+ break;
+ }
+
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, E_GMM_RAU_SUCCESS, NULL);
+
+ memset(&sig_data, 0, sizeof(sig_data));
+ sig_data.mm = mmctx;
+ osmo_signal_dispatch(SS_SGSN, S_SGSN_UPDATE, &sig_data);
+}
+
+static void gmm_rau_fsm_cleanup(struct osmo_fsm_inst *fi, enum osmo_fsm_term_cause cause)
+{
+ struct sgsn_mm_ctx *mmctx;
+ uint32_t event;
+
+ /* deregister ourselfs from MMCtx */
+ if (!fi->priv)
+ return;
+
+ mmctx = gmm_rau_fsm_priv(fi);
+ mmctx->attach_rau.rau_fsm = NULL;
+ fi->priv = NULL;
+
+ switch (cause) {
+ case OSMO_FSM_TERM_REGULAR:
+ /* Successful Attach or RAU */
+ switch (mmctx->attach_rau.rau_type) {
+ case VLR_LU_TYPE_IMSI_ATTACH:
+ gmm_attach_success(mmctx);
+ break;
+ case VLR_LU_TYPE_REGULAR:
+ case VLR_LU_TYPE_PERIODIC:
+ gmm_rau_success(mmctx);
+ break;
+ }
+
+ break;
+ case OSMO_FSM_TERM_ERROR:
+ case OSMO_FSM_TERM_TIMEOUT:
+ event = E_GMM_COMMON_PROC_FAILED;
+ if (mmctx->attach_rau.rau_type == VLR_LU_TYPE_IMSI_ATTACH)
+ event = E_GMM_ATTACH_FAILED;
+
+ osmo_fsm_inst_dispatch(mmctx->gmm_fsm, event, NULL);
+ break;
+ case OSMO_FSM_TERM_REQUEST:
+ /* Called when another Att/Rau Request received with different context, silenty terminate and wait for re-creation */
+ break;
+ default:
+ break;
+ }
+
+ TALLOC_FREE(mmctx->attach_rau.req);
+ memset(&mmctx->attach_rau, 0, sizeof(mmctx->attach_rau));
+}
+
+static const struct osmo_fsm_state gmm_rau_fsm_states[] = {
+ [GMM_RAU_S_INIT] = {
+ .in_event_mask = S(GMM_RAU_E_UE_RAU_REQUEST),
+ .out_state_mask = S(GMM_RAU_S_WAIT_VLR_ANSWER),
+ .name = OSMO_STRINGIFY(GMM_RAU_S_INIT),
+ .action = gmm_rau_fsm_s_init,
+ },
+ [GMM_RAU_S_WAIT_VLR_ANSWER] = {
+ .in_event_mask = S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
+ .out_state_mask = S(GMM_RAU_S_WAIT_UE_RAU_COMPLETE),
+ .name = OSMO_STRINGIFY(GMM_RAU_S_WAIT_VLR_ANSWER),
+ .action = gmm_rau_fsm_s_wait_vlr,
+ },
+ [GMM_RAU_S_WAIT_UE_RAU_COMPLETE] = {
+ .in_event_mask = S(GMM_RAU_E_UE_RAU_COMPLETE) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
+ .out_state_mask = 0,
+ .name = OSMO_STRINGIFY(GMM_RAU_S_WAIT_UE_RAU_COMPLETE),
+ .action = gmm_rau_fsm_s_wait_ue_rau_compl,
+ },
+};
+
+static struct osmo_fsm gmm_rau_fsm = {
+ .name = "gmm_rau_fsm",
+ .states = gmm_rau_fsm_states,
+ .num_states = ARRAY_SIZE(gmm_rau_fsm_states),
+ .allstate_event_mask = 0,
+ .allstate_action = NULL,
+ .log_subsys = DLGLOBAL,
+ .event_names = gmm_rau_event_names,
+ .cleanup = gmm_rau_fsm_cleanup,
+ .pre_term = NULL,
+ .timer_cb = NULL,
+};
+
+void gmm_rau_fsm_req(struct sgsn_mm_ctx *mmctx)
+{
+ OSMO_ASSERT(!mmctx->attach_rau.rau_fsm);
+
+ mmctx->attach_rau.rau_fsm = osmo_fsm_inst_alloc(&gmm_rau_fsm, mmctx, mmctx, LOGL_INFO, NULL);
+
+ osmo_fsm_inst_dispatch(mmctx->attach_rau.rau_fsm, GMM_RAU_E_UE_RAU_REQUEST, NULL);
+}
+
+static __attribute__((constructor)) void gmm_rau_fsm_init()
+{
+ OSMO_ASSERT(osmo_fsm_register(&gmm_rau_fsm) == 0);
+}
diff --git a/src/sgsn/gprs_subscriber.c b/src/sgsn/gprs_subscriber.c
index 07ea4c2..e69de29 100644
--- a/src/sgsn/gprs_subscriber.c
+++ b/src/sgsn/gprs_subscriber.c
@@ -1,966 +0,0 @@
-/* MS subscriber data handling */
-
-/* (C) 2014 by sysmocom s.f.m.c. GmbH
- * (C) 2015 by Holger Hans Peter Freyther
- *
- * All Rights Reserved
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as published by
- * the Free Software Foundation; either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
-#include <osmocom/gsm/gsup.h>
-#include <osmocom/gsm/apn.h>
-#include <osmocom/gsm/ipa.h>
-#include <osmocom/core/utils.h>
-#include <osmocom/core/logging.h>
-#include <osmocom/sgsn/gprs_subscriber.h>
-#include <osmocom/gsupclient/gsup_client.h>
-
-#include <osmocom/sgsn/sgsn.h>
-#include <osmocom/sgsn/mmctx.h>
-#include <osmocom/sgsn/gprs_gmm.h>
-#include <osmocom/sgsn/gprs_utils.h>
-
-#include <osmocom/sgsn/debug.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <limits.h>
-
-#define SGSN_SUBSCR_MAX_RETRIES 3
-#define SGSN_SUBSCR_RETRY_INTERVAL 10
-
-#define LOGGSUPP(level, gsup, fmt, args...) \
- LOGP(DGPRS, level, "GSUP(%s) " fmt, \
- (gsup)->imsi, \
- ## args)
-
-LLIST_HEAD(_gprs_subscribers);
-struct llist_head * const gprs_subscribers = &_gprs_subscribers;
-
-static int gsup_read_cb(struct osmo_gsup_client *gsupc, struct msgb *msg);
-
-/* TODO: Some functions are specific to the SGSN, but this file is more general
- * (it has gprs_* name). Either move these functions elsewhere, split them and
- * move a part, or replace the gprs_ prefix by sgsn_. The applies to
- * gprs_subscr_init, gsup_read_cb, and gprs_subscr_tx_gsup_message.
- */
-
-int gprs_subscr_init(struct sgsn_instance *sgi)
-{
- const char *addr_str;
- struct ipaccess_unit *ipa_dev;
-
- if (!sgi->cfg.gsup_server_addr.sin_addr.s_addr)
- return 0;
-
- addr_str = inet_ntoa(sgi->cfg.gsup_server_addr.sin_addr);
-
- ipa_dev = talloc_zero(sgi, struct ipaccess_unit);
- ipa_dev->unit_name = "SGSN";
- ipa_dev->serno = sgi->cfg.sgsn_ipa_name; /* NULL unless configured via VTY */
-
- sgi->gsup_client = osmo_gsup_client_create2(
- sgi,
- ipa_dev,
- addr_str, sgi->cfg.gsup_server_port,
- &gsup_read_cb,
- &sgi->cfg.oap);
-
- if (!sgi->gsup_client)
- return -1;
-
- return 1;
-}
-
-static int gsup_read_cb(struct osmo_gsup_client *gsupc, struct msgb *msg)
-{
- int rc;
-
- rc = gprs_subscr_rx_gsup_message(msg);
- msgb_free(msg);
- if (rc < 0)
- return -1;
-
- return rc;
-}
-
-int gprs_subscr_purge(struct gprs_subscr *subscr);
-
-static struct sgsn_subscriber_data *sgsn_subscriber_data_alloc(void *ctx)
-{
- struct sgsn_subscriber_data *sdata;
- int idx;
-
- sdata = talloc_zero(ctx, struct sgsn_subscriber_data);
-
- sdata->error_cause = SGSN_ERROR_CAUSE_NONE;
-
- for (idx = 0; idx < ARRAY_SIZE(sdata->auth_triplets); idx++)
- sdata->auth_triplets[idx].key_seq = GSM_KEY_SEQ_INVAL;
-
- INIT_LLIST_HEAD(&sdata->pdp_list);
-
- return sdata;
-}
-
-struct sgsn_subscriber_pdp_data* sgsn_subscriber_pdp_data_alloc(
- struct sgsn_subscriber_data *sdata)
-{
- struct sgsn_subscriber_pdp_data* pdata;
-
- pdata = talloc_zero(sdata, struct sgsn_subscriber_pdp_data);
-
- llist_add_tail(&pdata->list, &sdata->pdp_list);
-
- return pdata;
-}
-
-struct gprs_subscr *gprs_subscr_get_by_imsi(const char *imsi)
-{
- struct gprs_subscr *gsub;
-
- if (!imsi || !*imsi)
- return NULL;
-
- llist_for_each_entry(gsub, gprs_subscribers, entry) {
- if (!strcmp(gsub->imsi, imsi))
- return gprs_subscr_get(gsub);
- }
- return NULL;
-}
-
-static struct gprs_subscr *gprs_subscr_alloc(void)
-{
- struct gprs_subscr *gsub;
- gsub = talloc_zero(tall_sgsn_ctx, struct gprs_subscr);
- if (!gsub)
- return NULL;
- llist_add_tail(&gsub->entry, gprs_subscribers);
- gsub->use_count = 1;
- gsub->tmsi = GSM_RESERVED_TMSI;
- return gsub;
-}
-
-struct gprs_subscr *gprs_subscr_get_or_create(const char *imsi)
-{
- struct gprs_subscr *gsub;
-
- gsub = gprs_subscr_get_by_imsi(imsi);
- if (!gsub) {
- gsub = gprs_subscr_alloc();
- if (!gsub)
- return NULL;
- osmo_strlcpy(gsub->imsi, imsi, sizeof(gsub->imsi));
- }
-
- if (!gsub->sgsn_data)
- gsub->sgsn_data = sgsn_subscriber_data_alloc(gsub);
- return gsub;
-}
-
-void gprs_subscr_cleanup(struct gprs_subscr *subscr)
-{
- if (subscr->sgsn_data->mm) {
- gprs_subscr_put(subscr->sgsn_data->mm->subscr);
- subscr->sgsn_data->mm->subscr = NULL;
- subscr->sgsn_data->mm = NULL;
- }
-
- if (subscr->flags & GPRS_SUBSCRIBER_ENABLE_PURGE) {
- gprs_subscr_purge(subscr);
- subscr->flags &= ~GPRS_SUBSCRIBER_ENABLE_PURGE;
- }
-}
-
-void gprs_subscr_cancel(struct gprs_subscr *subscr)
-{
- subscr->authorized = 0;
- subscr->flags |= GPRS_SUBSCRIBER_CANCELLED;
- subscr->flags &= ~GPRS_SUBSCRIBER_ENABLE_PURGE;
-
- gprs_subscr_update(subscr);
- gprs_subscr_cleanup(subscr);
-}
-
-static int gprs_subscr_tx_gsup_message(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- struct msgb *msg = osmo_gsup_client_msgb_alloc();
-
- if (strlen(gsup_msg->imsi) == 0 && subscr)
- osmo_strlcpy(gsup_msg->imsi, subscr->imsi,
- sizeof(gsup_msg->imsi));
- gsup_msg->cn_domain = OSMO_GSUP_CN_DOMAIN_PS;
- osmo_gsup_encode(msg, gsup_msg);
-
- LOGGSUBSCRP(LOGL_INFO, subscr,
- "Sending GSUP, will send: %s\n", msgb_hexdump(msg));
-
- if (!sgsn->gsup_client) {
- msgb_free(msg);
- return -ENOTSUP;
- }
-
- return osmo_gsup_client_send(sgsn->gsup_client, msg);
-}
-
-static int gprs_subscr_tx_gsup_error_reply(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_orig,
- enum gsm48_gmm_cause cause)
-{
- struct osmo_gsup_message gsup_reply = {0};
-
- osmo_strlcpy(gsup_reply.imsi, gsup_orig->imsi,
- sizeof(gsup_reply.imsi));
- gsup_reply.cause = cause;
- gsup_reply.message_type =
- OSMO_GSUP_TO_MSGT_ERROR(gsup_orig->message_type);
-
- return gprs_subscr_tx_gsup_message(subscr, &gsup_reply);
-}
-
-static int gprs_subscr_handle_gsup_auth_res(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- unsigned idx;
- struct sgsn_subscriber_data *sdata = subscr->sgsn_data;
-
- LOGGSUBSCRP(LOGL_INFO, subscr,
- "Got SendAuthenticationInfoResult, num_auth_vectors = %zu\n",
- gsup_msg->num_auth_vectors);
-
- if (gsup_msg->num_auth_vectors > 0) {
- memset(sdata->auth_triplets, 0, sizeof(sdata->auth_triplets));
-
- for (idx = 0; idx < ARRAY_SIZE(sdata->auth_triplets); idx++)
- sdata->auth_triplets[idx].key_seq = GSM_KEY_SEQ_INVAL;
- }
-
- for (idx = 0; idx < gsup_msg->num_auth_vectors; idx++) {
- size_t key_seq = idx;
- LOGGSUBSCRP(LOGL_DEBUG, subscr,
- "Adding auth tuple, cksn = %zu\n", key_seq);
- if (key_seq >= ARRAY_SIZE(sdata->auth_triplets)) {
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "Skipping auth triplet with invalid cksn %zu\n",
- key_seq);
- continue;
- }
- sdata->auth_triplets[key_seq].vec = gsup_msg->auth_vectors[idx];
- sdata->auth_triplets[key_seq].key_seq = key_seq;
- }
-
- sdata->auth_triplets_updated = 1;
- sdata->error_cause = SGSN_ERROR_CAUSE_NONE;
-
- gprs_subscr_update_auth_info(subscr);
-
- return 0;
-}
-
-static int gprs_subscr_pdp_data_clear(struct gprs_subscr *subscr)
-{
- struct sgsn_subscriber_pdp_data *pdp, *pdp2;
- int count = 0;
-
- llist_for_each_entry_safe(pdp, pdp2, &subscr->sgsn_data->pdp_list, list) {
- llist_del(&pdp->list);
- talloc_free(pdp);
- count += 1;
- }
-
- return count;
-}
-
-static struct sgsn_subscriber_pdp_data *gprs_subscr_pdp_data_get_by_id(
- struct gprs_subscr *subscr, unsigned context_id)
-{
- struct sgsn_subscriber_pdp_data *pdp;
-
- llist_for_each_entry(pdp, &subscr->sgsn_data->pdp_list, list) {
- if (pdp->context_id == context_id)
- return pdp;
- }
-
- return NULL;
-}
-
-
-static void gprs_subscr_gsup_insert_data(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- struct sgsn_subscriber_data *sdata = subscr->sgsn_data;
- unsigned idx;
- int rc;
-
- if (gsup_msg->msisdn_enc) {
- if (gsup_msg->msisdn_enc_len > sizeof(sdata->msisdn)) {
- LOGP(DGPRS, LOGL_ERROR, "MSISDN too long (%zu)\n",
- gsup_msg->msisdn_enc_len);
- sdata->msisdn_len = 0;
- } else {
- memcpy(sdata->msisdn, gsup_msg->msisdn_enc,
- gsup_msg->msisdn_enc_len);
- sdata->msisdn_len = gsup_msg->msisdn_enc_len;
- }
- }
-
- if (gsup_msg->hlr_enc) {
- if (gsup_msg->hlr_enc_len > sizeof(sdata->hlr)) {
- LOGP(DGPRS, LOGL_ERROR, "HLR-Number too long (%zu)\n",
- gsup_msg->hlr_enc_len);
- sdata->hlr_len = 0;
- } else {
- memcpy(sdata->hlr, gsup_msg->hlr_enc,
- gsup_msg->hlr_enc_len);
- sdata->hlr_len = gsup_msg->hlr_enc_len;
- }
- }
-
- if (gsup_msg->pdp_charg_enc && gsup_msg->pdp_charg_enc_len >= sizeof(sdata->pdp_charg)) {
- memcpy(&sdata->pdp_charg, gsup_msg->pdp_charg_enc, sizeof(sdata->pdp_charg));
- sdata->has_pdp_charg = 1;
- } else {
- sdata->has_pdp_charg = 0;
- }
-
- if (gsup_msg->pdp_info_compl) {
- rc = gprs_subscr_pdp_data_clear(subscr);
- if (rc > 0)
- LOGP(DGPRS, LOGL_INFO, "Cleared existing PDP info\n");
- }
-
- for (idx = 0; idx < gsup_msg->num_pdp_infos; idx++) {
- struct osmo_gsup_pdp_info *pdp_info = &gsup_msg->pdp_infos[idx];
- size_t ctx_id = pdp_info->context_id;
- struct sgsn_subscriber_pdp_data *pdp_data;
-
- if (pdp_info->apn_enc_len >= sizeof(pdp_data->apn_str)-1) {
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "APN too long, context id = %zu, APN = %s\n",
- ctx_id, osmo_hexdump(pdp_info->apn_enc,
- pdp_info->apn_enc_len));
- continue;
- }
-
- if (pdp_info->qos_enc_len > sizeof(pdp_data->qos_subscribed)) {
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "QoS info too long (%zu)\n",
- pdp_info->qos_enc_len);
- continue;
- }
-
- LOGGSUBSCRP(LOGL_INFO, subscr,
- "Will set PDP info, context id = %zu, APN = %s\n",
- ctx_id, osmo_hexdump(pdp_info->apn_enc, pdp_info->apn_enc_len));
-
- /* Set PDP info [ctx_id] */
- pdp_data = gprs_subscr_pdp_data_get_by_id(subscr, ctx_id);
- if (!pdp_data) {
- pdp_data = sgsn_subscriber_pdp_data_alloc(subscr->sgsn_data);
- pdp_data->context_id = ctx_id;
- }
-
- OSMO_ASSERT(pdp_data != NULL);
- pdp_data->pdp_type_org = pdp_info->pdp_type_org;
- pdp_data->pdp_type_nr = pdp_info->pdp_type_nr;
- osmo_apn_to_str(pdp_data->apn_str,
- pdp_info->apn_enc, pdp_info->apn_enc_len);
-
- if (pdp_info->qos_enc) {
- memcpy(&pdp_data->qos_subscribed[0], pdp_info->qos_enc,
- pdp_info->qos_enc_len);
- }
- pdp_data->qos_subscribed_len = pdp_info->qos_enc_len;
-
- if (pdp_info->pdp_charg_enc && pdp_info->pdp_charg_enc_len >= sizeof(pdp_data->pdp_charg)) {
- memcpy(&pdp_data->pdp_charg, pdp_info->pdp_charg_enc, sizeof(pdp_data->pdp_charg));
- pdp_data->has_pdp_charg = 1;
- } else {
- pdp_data->has_pdp_charg = 0;
- }
- }
-}
-
-static int gprs_subscr_handle_gsup_upd_loc_res(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- /* contrary to MAP, we allow piggy-backing subscriber data onto
- * the UPDATE LOCATION RESULT, and don't mandate the use of a
- * separate nested INSERT SUBSCRIBER DATA transaction */
- gprs_subscr_gsup_insert_data(subscr, gsup_msg);
-
- subscr->authorized = 1;
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
-
- subscr->flags |= GPRS_SUBSCRIBER_ENABLE_PURGE;
-
- gprs_subscr_update(subscr);
- return 0;
-}
-
-static int gprs_subscr_handle_gsup_dsd_req(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- struct osmo_gsup_message gsup_reply = {0};
-
- if (gsup_msg->cn_domain != OSMO_GSUP_CN_DOMAIN_PS) {
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "Rx GSUP message %s not supported for CS\n",
- osmo_gsup_message_type_name(gsup_msg->message_type));
- gsup_reply.cause = GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL;
- gsup_reply.message_type = OSMO_GSUP_MSGT_DELETE_DATA_ERROR;
- } else {
- gsm0408_gprs_access_cancelled(subscr->sgsn_data->mm,
- GMM_CAUSE_GPRS_NOTALLOWED);
- gsup_reply.message_type = OSMO_GSUP_MSGT_DELETE_DATA_RESULT;
- }
-
- return gprs_subscr_tx_gsup_message(subscr, &gsup_reply);
-}
-
-static int gprs_subscr_handle_gsup_isd_req(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- struct osmo_gsup_message gsup_reply = {0};
-
- gprs_subscr_gsup_insert_data(subscr, gsup_msg);
-
- subscr->authorized = 1;
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- subscr->flags |= GPRS_SUBSCRIBER_ENABLE_PURGE;
- gprs_subscr_update(subscr);
-
- gsup_reply.message_type = OSMO_GSUP_MSGT_INSERT_DATA_RESULT;
- return gprs_subscr_tx_gsup_message(subscr, &gsup_reply);
-}
-
-static int check_cause(int cause)
-{
- switch (cause) {
- case GMM_CAUSE_IMSI_UNKNOWN ... GMM_CAUSE_ILLEGAL_ME:
- case GMM_CAUSE_GPRS_NOTALLOWED ... GMM_CAUSE_NO_GPRS_PLMN:
- return EACCES;
-
- case GMM_CAUSE_MSC_TEMP_NOTREACH ... GMM_CAUSE_CONGESTION:
- return EHOSTUNREACH;
-
- case GMM_CAUSE_SEM_INCORR_MSG ... GMM_CAUSE_PROTO_ERR_UNSPEC:
- default:
- return EINVAL;
- }
-}
-
-static int gprs_subscr_handle_gsup_auth_err(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- unsigned idx;
- struct sgsn_subscriber_data *sdata = subscr->sgsn_data;
- int cause_err;
-
- cause_err = check_cause(gsup_msg->cause);
-
- LOGGSUBSCRP(LOGL_DEBUG, subscr,
- "Send authentication info has failed with cause %d, "
- "handled as: %s\n",
- gsup_msg->cause, strerror(cause_err));
-
- switch (cause_err) {
- case EACCES:
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "GPRS send auth info req failed, access denied, "
- "GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
- /* Clear auth tuples */
- memset(sdata->auth_triplets, 0, sizeof(sdata->auth_triplets));
- for (idx = 0; idx < ARRAY_SIZE(sdata->auth_triplets); idx++)
- sdata->auth_triplets[idx].key_seq = GSM_KEY_SEQ_INVAL;
-
- subscr->authorized = 0;
- sdata->error_cause = gsup_msg->cause;
- gprs_subscr_update_auth_info(subscr);
- break;
-
- case EHOSTUNREACH:
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "GPRS send auth info req failed, GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
-
- sdata->error_cause = gsup_msg->cause;
- gprs_subscr_update_auth_info(subscr);
- break;
-
- default:
- case EINVAL:
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "GSUP protocol remote error, GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
- sdata->error_cause = gsup_msg->cause;
- break;
- }
-
- return -gsup_msg->cause;
-}
-
-static int gprs_subscr_handle_gsup_upd_loc_err(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- int cause_err;
-
- cause_err = check_cause(gsup_msg->cause);
-
- LOGGSUBSCRP(LOGL_DEBUG, subscr,
- "Update location has failed with cause %d, handled as: %s\n",
- gsup_msg->cause, strerror(cause_err));
-
- switch (cause_err) {
- case EACCES:
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "GPRS update location failed, access denied, "
- "GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
-
- subscr->authorized = 0;
- subscr->sgsn_data->error_cause = gsup_msg->cause;
- gprs_subscr_update_auth_info(subscr);
- break;
-
- case EHOSTUNREACH:
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "GPRS update location failed, GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
-
- subscr->sgsn_data->error_cause = gsup_msg->cause;
- gprs_subscr_update_auth_info(subscr);
- break;
-
- default:
- case EINVAL:
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "GSUP protocol remote error, GMM cause = '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
- break;
- }
-
- return -gsup_msg->cause;
-}
-
-static int gprs_subscr_handle_gsup_purge_no_subscr(
- struct osmo_gsup_message *gsup_msg)
-{
- if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
- LOGGSUPP(LOGL_NOTICE, gsup_msg,
- "Purge MS has failed with cause '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
- return -gsup_msg->cause;
- }
-
- LOGGSUPP(LOGL_INFO, gsup_msg, "Completing purge MS\n");
- return 0;
-}
-
-static int gprs_subscr_handle_gsup_purge_res(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- LOGGSUBSCRP(LOGL_INFO, subscr, "Completing purge MS\n");
-
- /* Force silent cancellation */
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- gprs_subscr_cancel(subscr);
-
- return 0;
-}
-
-static int gprs_subscr_handle_gsup_purge_err(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- LOGGSUBSCRP(LOGL_NOTICE, subscr,
- "Purge MS has failed with cause '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
-
- /* In GSM 09.02, 19.1.4.4, the text and the SDL diagram imply that
- * the subscriber data is not removed if the request has failed. On the
- * other hand, keeping the subscriber data in either error case
- * (subscriber unknown, syntactical message error, connection error)
- * doesn't seem to give any advantage, since the data will be restored
- * on the next Attach Request anyway.
- * This approach ensures, that the subscriber record will not stick if
- * an error happens.
- */
-
- /* TODO: Check whether this behaviour is acceptable and either just
- * remove this TODO-notice or change the implementation to not delete
- * the subscriber data (eventually resetting the ENABLE_PURGE flag and
- * restarting the expiry timer based on the cause).
- *
- * Subscriber Unknown: cancel subscr
- * Temporary network problems: do nothing (handled by timer based retry)
- * Message problems (syntax, nyi, ...): cancel subscr (retry won't help)
- */
-
- gprs_subscr_handle_gsup_purge_res(subscr, gsup_msg);
-
- return -gsup_msg->cause;
-}
-
-static int gprs_subscr_handle_loc_cancel_req(struct gprs_subscr *subscr,
- struct osmo_gsup_message *gsup_msg)
-{
- struct osmo_gsup_message gsup_reply = {0};
- int is_update_procedure = !gsup_msg->cancel_type ||
- gsup_msg->cancel_type == OSMO_GSUP_CANCEL_TYPE_UPDATE;
-
- LOGGSUBSCRP(LOGL_INFO, subscr, "Cancelling MS subscriber (%s)\n",
- is_update_procedure ?
- "update procedure" : "subscription withdraw");
-
- gsup_reply.message_type = OSMO_GSUP_MSGT_LOCATION_CANCEL_RESULT;
- gprs_subscr_tx_gsup_message(subscr, &gsup_reply);
-
- if (is_update_procedure)
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- else
- /* Since a withdraw cause is not specified, just abort the
- * current attachment. The following re-attachment should then
- * be rejected with a proper cause value.
- */
- subscr->sgsn_data->error_cause = GMM_CAUSE_IMPL_DETACHED;
-
- gprs_subscr_cancel(subscr);
-
- return 0;
-}
-
-static int gprs_subscr_handle_unknown_imsi(struct osmo_gsup_message *gsup_msg)
-{
- if (OSMO_GSUP_IS_MSGT_REQUEST(gsup_msg->message_type)) {
- gprs_subscr_tx_gsup_error_reply(NULL, gsup_msg,
- GMM_CAUSE_IMSI_UNKNOWN);
- LOGP(DGPRS, LOGL_NOTICE,
- "Unknown IMSI %s, discarding GSUP request "
- "of type 0x%02x\n",
- gsup_msg->imsi, gsup_msg->message_type);
- } else if (OSMO_GSUP_IS_MSGT_ERROR(gsup_msg->message_type)) {
- LOGP(DGPRS, LOGL_NOTICE,
- "Unknown IMSI %s, discarding GSUP error "
- "of type 0x%02x, cause '%s' (%d)\n",
- gsup_msg->imsi, gsup_msg->message_type,
- get_value_string(gsm48_gmm_cause_names, gsup_msg->cause),
- gsup_msg->cause);
- } else {
- LOGP(DGPRS, LOGL_NOTICE,
- "Unknown IMSI %s, discarding GSUP response "
- "of type 0x%02x\n",
- gsup_msg->imsi, gsup_msg->message_type);
- }
-
- return -GMM_CAUSE_IMSI_UNKNOWN;
-}
-
-int gprs_subscr_rx_gsup_message(struct msgb *msg)
-{
- uint8_t *data = msgb_l2(msg);
- size_t data_len = msgb_l2len(msg);
- int rc = 0;
-
- struct osmo_gsup_message gsup_msg = {0};
- struct gprs_subscr *subscr;
-
- rc = osmo_gsup_decode(data, data_len, &gsup_msg);
- if (rc < 0) {
- LOGP(DGPRS, LOGL_ERROR,
- "decoding GSUP message fails with error '%s' (%d)\n",
- get_value_string(gsm48_gmm_cause_names, -rc), -rc);
- return rc;
- }
-
- if (!gsup_msg.imsi[0]) {
- LOGP(DGPRS, LOGL_ERROR, "Missing IMSI in GSUP message\n");
-
- if (OSMO_GSUP_IS_MSGT_REQUEST(gsup_msg.message_type))
- gprs_subscr_tx_gsup_error_reply(NULL, &gsup_msg,
- GMM_CAUSE_INV_MAND_INFO);
- return -GMM_CAUSE_INV_MAND_INFO;
- }
-
- if (!gsup_msg.cause && OSMO_GSUP_IS_MSGT_ERROR(gsup_msg.message_type))
- gsup_msg.cause = GMM_CAUSE_NET_FAIL;
-
- subscr = gprs_subscr_get_by_imsi(gsup_msg.imsi);
-
- if (!subscr) {
- switch (gsup_msg.message_type) {
- case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
- case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
- return gprs_subscr_handle_gsup_purge_no_subscr(&gsup_msg);
- default:
- return gprs_subscr_handle_unknown_imsi(&gsup_msg);
- }
- }
-
- LOGGSUBSCRP(LOGL_INFO, subscr,
- "Received GSUP message %s\n",
- osmo_gsup_message_type_name(gsup_msg.message_type));
-
- switch (gsup_msg.message_type) {
- case OSMO_GSUP_MSGT_LOCATION_CANCEL_REQUEST:
- rc = gprs_subscr_handle_loc_cancel_req(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_SEND_AUTH_INFO_RESULT:
- rc = gprs_subscr_handle_gsup_auth_res(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_SEND_AUTH_INFO_ERROR:
- rc = gprs_subscr_handle_gsup_auth_err(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_UPDATE_LOCATION_RESULT:
- rc = gprs_subscr_handle_gsup_upd_loc_res(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_UPDATE_LOCATION_ERROR:
- rc = gprs_subscr_handle_gsup_upd_loc_err(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_PURGE_MS_ERROR:
- rc = gprs_subscr_handle_gsup_purge_err(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_PURGE_MS_RESULT:
- rc = gprs_subscr_handle_gsup_purge_res(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_INSERT_DATA_REQUEST:
- rc = gprs_subscr_handle_gsup_isd_req(subscr, &gsup_msg);
- break;
-
- case OSMO_GSUP_MSGT_DELETE_DATA_REQUEST:
- rc = gprs_subscr_handle_gsup_dsd_req(subscr, &gsup_msg);
- break;
-
- default:
- LOGGSUBSCRP(LOGL_ERROR, subscr,
- "Rx GSUP message %s not valid at SGSN\n",
- osmo_gsup_message_type_name(gsup_msg.message_type));
- if (OSMO_GSUP_IS_MSGT_REQUEST(gsup_msg.message_type))
- gprs_subscr_tx_gsup_error_reply(
- subscr, &gsup_msg, GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL);
- rc = -GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL;
- break;
- };
-
- gprs_subscr_put(subscr);
-
- return rc;
-}
-
-int gprs_subscr_purge(struct gprs_subscr *subscr)
-{
- struct sgsn_subscriber_data *sdata = subscr->sgsn_data;
- struct osmo_gsup_message gsup_msg = {0};
-
- LOGGSUBSCRP(LOGL_INFO, subscr, "purging MS subscriber\n");
-
- gsup_msg.message_type = OSMO_GSUP_MSGT_PURGE_MS_REQUEST;
-
- /* Provide the HLR number in case it is known */
- gsup_msg.hlr_enc_len = sdata->hlr_len;
- gsup_msg.hlr_enc = sdata->hlr;
-
- return gprs_subscr_tx_gsup_message(subscr, &gsup_msg);
-}
-
-static int gprs_subscr_query_auth_info(struct gprs_subscr *subscr,
- const uint8_t *auts,
- const uint8_t *auts_rand)
-{
- struct osmo_gsup_message gsup_msg = {0};
-
- /* Make sure we have a complete resync or clearly no resync. */
- OSMO_ASSERT((auts != NULL) == (auts_rand != NULL));
-
- LOGGSUBSCRP(LOGL_INFO, subscr, "requesting auth info%s\n",
- auts ? " with AUTS (UMTS Resynch)" : "");
-
- gsup_msg.message_type = OSMO_GSUP_MSGT_SEND_AUTH_INFO_REQUEST;
- gsup_msg.auts = auts;
- gsup_msg.rand = auts_rand;
- return gprs_subscr_tx_gsup_message(subscr, &gsup_msg);
-}
-
-int gprs_subscr_location_update(struct gprs_subscr *subscr, enum sgsn_ran_type ran_type)
-{
- struct osmo_gsup_message gsup_msg = {0};
-
- LOGGSUBSCRP(LOGL_INFO, subscr,
- "subscriber data is not available\n");
-
- gsup_msg.message_type = OSMO_GSUP_MSGT_UPDATE_LOCATION_REQUEST;
-
- switch (ran_type) {
- case MM_CTX_T_GERAN_Gb:
- gsup_msg.current_rat_type = OSMO_RAT_GERAN_A;
- break;
- case MM_CTX_T_UTRAN_Iu:
- gsup_msg.current_rat_type = OSMO_RAT_UTRAN_IU;
- break;
- default:
- break;
- }
-
- return gprs_subscr_tx_gsup_message(subscr, &gsup_msg);
-}
-
-void gprs_subscr_update(struct gprs_subscr *subscr)
-{
- LOGGSUBSCRP(LOGL_DEBUG, subscr, "Updating subscriber data\n");
-
- subscr->flags &= ~GPRS_SUBSCRIBER_UPDATE_LOCATION_PENDING;
- subscr->flags &= ~GPRS_SUBSCRIBER_FIRST_CONTACT;
-
- if (subscr->sgsn_data->mm)
- sgsn_update_subscriber_data(subscr->sgsn_data->mm);
-}
-
-void gprs_subscr_update_auth_info(struct gprs_subscr *subscr)
-{
- LOGGSUBSCRP(LOGL_DEBUG, subscr,
- "Updating subscriber authentication info\n");
-
- subscr->flags &= ~GPRS_SUBSCRIBER_UPDATE_AUTH_INFO_PENDING;
- subscr->flags &= ~GPRS_SUBSCRIBER_FIRST_CONTACT;
-
- if (subscr->sgsn_data->mm)
- sgsn_update_subscriber_data(subscr->sgsn_data->mm);
-}
-
-struct gprs_subscr *gprs_subscr_get_or_create_by_mmctx(struct sgsn_mm_ctx *mmctx)
-{
- struct gprs_subscr *subscr = NULL;
-
- if (mmctx->subscr)
- return gprs_subscr_get(mmctx->subscr);
-
- if (mmctx->imsi[0])
- subscr = gprs_subscr_get_by_imsi(mmctx->imsi);
-
- if (!subscr) {
- subscr = gprs_subscr_get_or_create(mmctx->imsi);
- if (!subscr)
- return NULL;
- subscr->flags |= GPRS_SUBSCRIBER_FIRST_CONTACT;
- subscr->flags &= ~GPRS_SUBSCRIBER_ENABLE_PURGE;
- }
-
- osmo_strlcpy(subscr->imei, mmctx->imei, sizeof(subscr->imei));
-
- if (subscr->lac != mmctx->ra.lac.lac)
- subscr->lac = mmctx->ra.lac.lac;
-
- subscr->sgsn_data->mm = mmctx;
- mmctx->subscr = gprs_subscr_get(subscr);
-
- return subscr;
-}
-
-int gprs_subscr_request_update_location(struct sgsn_mm_ctx *mmctx)
-{
- struct gprs_subscr *subscr = NULL;
- int rc;
-
- LOGMMCTXP(LOGL_DEBUG, mmctx, "Requesting subscriber data update\n");
-
- subscr = gprs_subscr_get_or_create_by_mmctx(mmctx);
- if (!subscr)
- return -ENOMEM;
-
- subscr->flags |= GPRS_SUBSCRIBER_UPDATE_LOCATION_PENDING;
-
- rc = gprs_subscr_location_update(subscr, mmctx->ran_type);
- gprs_subscr_put(subscr);
- return rc;
-}
-
-/*! \brief Send Update Auth Info request via GSUP, with or without resync.
- * \param[in] mmctx MM context to request authentication tuples for.
- * \param[in] auts 14 octet AUTS token for UMTS resync, or NULL.
- * \param[in] auts_rand 16 octet Random token for UMTS resync, or NULL.
- * In case of normal Authentication Info request, both \a auts and \a auts_rand
- * must be NULL. For resync, both must be non-NULL.
- */
-int gprs_subscr_request_auth_info(struct sgsn_mm_ctx *mmctx,
- const uint8_t *auts,
- const uint8_t *auts_rand)
-{
- struct gprs_subscr *subscr = NULL;
- int rc;
-
- LOGMMCTXP(LOGL_DEBUG, mmctx, "Requesting subscriber authentication info\n");
-
- subscr = gprs_subscr_get_or_create_by_mmctx(mmctx);
- if (!subscr)
- return -ENOMEM;
-
- subscr->flags |= GPRS_SUBSCRIBER_UPDATE_AUTH_INFO_PENDING;
-
- rc = gprs_subscr_query_auth_info(subscr, auts, auts_rand);
- gprs_subscr_put(subscr);
- return rc;
-}
-
-static void gprs_subscr_free(struct gprs_subscr *gsub)
-{
- llist_del(&gsub->entry);
- talloc_free(gsub);
-}
-
-struct gprs_subscr *_gprs_subscr_get(struct gprs_subscr *gsub,
- const char *file, int line)
-{
- OSMO_ASSERT(gsub->use_count < INT_MAX);
- gsub->use_count++;
- LOGPSRC(DREF, LOGL_DEBUG, file, line,
- "subscr %s usage increases to: %d\n",
- gsub->imsi, gsub->use_count);
- return gsub;
-}
-
-struct gprs_subscr *_gprs_subscr_put(struct gprs_subscr *gsub,
- const char *file, int line)
-{
- gsub->use_count--;
- LOGPSRC(DREF, gsub->use_count >= 0? LOGL_DEBUG : LOGL_ERROR,
- file, line,
- "subscr %s usage decreases to: %d%s\n",
- gsub->imsi, gsub->use_count,
- gsub->keep_in_ram? ", keep-in-ram flag is set" : "");
- if (gsub->use_count > 0)
- return gsub;
- if (gsub->keep_in_ram)
- return gsub;
- gprs_subscr_free(gsub);
- return NULL;
-}
diff --git a/src/sgsn/mmctx.c b/src/sgsn/mmctx.c
index 40f902b..f314425 100644
--- a/src/sgsn/mmctx.c
+++ b/src/sgsn/mmctx.c
@@ -56,6 +56,9 @@
#include <osmocom/sgsn/gtp.h>
#include <osmocom/sgsn/pdpctx.h>
+#include <osmocom/vlr/vlr.h>
+#include <osmocom/gsupclient/gsup_client_mux.h>
+
#include <time.h>
#include "../../config.h"
@@ -204,9 +207,6 @@
ctx->gmm_fsm = osmo_fsm_inst_alloc(&gmm_fsm, ctx, ctx, LOGL_DEBUG, "gmm_fsm");
if (!ctx->gmm_fsm)
goto out;
- ctx->gmm_att_req.fsm = osmo_fsm_inst_alloc(&gmm_attach_req_fsm, ctx, ctx, LOGL_DEBUG, "gb_gmm_req");
- if (!ctx->gmm_att_req.fsm)
- goto out;
ctx->gb.mm_state_fsm = osmo_fsm_inst_alloc(&mm_state_gb_fsm, ctx, ctx, LOGL_DEBUG, NULL);
if (!ctx->gb.mm_state_fsm)
goto out;
@@ -281,7 +281,6 @@
#endif
}
-
/* this is a hard _free_ function, it doesn't clean up the PDP contexts
* in libgtp! */
static void sgsn_mm_ctx_free(struct sgsn_mm_ctx *mm)
@@ -306,6 +305,12 @@
struct sgsn_pdp_ctx *pdp, *pdp2;
struct sgsn_signal_data sig_data;
+ if (mm->vsub) {
+ vlr_subscr_disconnected(mm->vsub);
+ vlr_subscr_put(mm->vsub, "mmctx");
+ mm->vsub = NULL;
+ }
+
if (mm->ran_type == MM_CTX_T_GERAN_Gb)
llme = mm->gb.llme;
else
@@ -334,23 +339,19 @@
memset(&sig_data, 0, sizeof(sig_data));
sig_data.mm = mm;
osmo_signal_dispatch(SS_SGSN, S_SGSN_MM_FREE, &sig_data);
-
-
- /* Detach from subscriber which is possibly freed then */
- if (mm->subscr) {
- struct gprs_subscr *subscr = gprs_subscr_get(mm->subscr);
- gprs_subscr_cleanup(subscr);
- gprs_subscr_put(subscr);
+ if (mm->vsub) {
+ vlr_subscr_expire(mm->vsub);
+ vlr_subscr_disconnected(mm->vsub);
+ vlr_subscr_put(mm->vsub, "mmctx");
+ mm->vsub = NULL;
}
- if (mm->gmm_att_req.fsm)
- gmm_att_req_free(mm);
if (mm->gb.mm_state_fsm)
osmo_fsm_inst_free(mm->gb.mm_state_fsm);
if (mm->iu.mm_state_fsm)
osmo_fsm_inst_free(mm->iu.mm_state_fsm);
if (mm->gmm_fsm)
- osmo_fsm_inst_free(mm->gmm_fsm);
+ osmo_fsm_inst_term(mm->gmm_fsm, OSMO_FSM_TERM_REGULAR, NULL);
sgsn_mm_ctx_free(mm);
mm = NULL;
@@ -439,14 +440,6 @@
return GSM_RESERVED_TMSI;
}
-void sgsn_update_subscriber_data(struct sgsn_mm_ctx *mmctx)
-{
- OSMO_ASSERT(mmctx != NULL);
- LOGMMCTXP(LOGL_INFO, mmctx, "Subscriber data update\n");
-
- sgsn_auth_update(mmctx);
-}
-
static void insert_extra(struct tlv_parsed *tp,
struct sgsn_subscriber_data *data,
struct sgsn_subscriber_pdp_data *pdp)
@@ -498,6 +491,7 @@
req_apn_str[0] = 0;
}
+ /* FIXME: why should the vsub ever be NULL? */
if (mmctx->subscr == NULL)
allow_any_apn = 1;
@@ -608,3 +602,23 @@
return true;
return false;
}
+
+int sgsn_mm_ctx_bind_vsub(struct sgsn_mm_ctx *mm, const char *imsi, uint32_t ptmsi)
+{
+ bool created = false;
+
+ if (imsi)
+ mm->vsub = vlr_subscr_find_or_create_by_imsi(sgsn->vlr, imsi, "mmctx", &created);
+ else
+ mm->vsub = vlr_subscr_find_or_create_by_tmsi(sgsn->vlr, ptmsi, "mmctx", &created);
+
+ if (!mm->vsub)
+ return -1;
+
+ /* FIXME: copy more stuff from vsub */
+ if (!strlen(mm->imsi) && strlen(mm->vsub->imsi)) {
+ OSMO_STRLCPY_ARRAY(mm->imsi, mm->vsub->imsi);
+ }
+
+ return 0;
+}
diff --git a/src/sgsn/sgsn.c b/src/sgsn/sgsn.c
index 4ebba26..fdc52be 100644
--- a/src/sgsn/sgsn.c
+++ b/src/sgsn/sgsn.c
@@ -59,6 +59,8 @@
#include <osmocom/sgsn/pdpctx.h>
#include <osmocom/sgsn/gprs_routing_area.h>
+#include <osmocom/vlr/vlr.h>
+
#include <time.h>
#define GPRS_LLME_CHECK_TICK 30
@@ -188,9 +190,9 @@
osmo_timer_setup(&inst->llme_timer, sgsn_llme_check_cb, NULL);
osmo_timer_schedule(&inst->llme_timer, GPRS_LLME_CHECK_TICK, 0);
/* These are mostly setting up stuff not related to VTY cfg, so they can be set up here: */
- sgsn_auth_init(inst);
sgsn_cdr_init(inst);
sgsn_ra_init(inst);
+ sgsn_auth_init(inst);
return inst;
}
@@ -213,10 +215,11 @@
return -EFAULT;
}
- rc = gprs_subscr_init(sgsn);
+ rc = gmm_vlr_init(sgsn);
if (rc < 0) {
- LOGP(DGPRS, LOGL_FATAL, "Cannot set up SGSN\n");
+ LOGP(DGPRS, LOGL_FATAL, "Cannot set up MM/VLR/GSUP\n");
return rc;
}
+
return 0;
}
diff --git a/src/sgsn/sgsn_auth.c b/src/sgsn/sgsn_auth.c
index 2f5bc8c..ab94857 100644
--- a/src/sgsn/sgsn_auth.c
+++ b/src/sgsn/sgsn_auth.c
@@ -84,229 +84,3 @@
return 0;
}
-enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mmctx)
-{
- char mccmnc[16];
- int check_net = 0;
- int check_acl = 0;
-
- OSMO_ASSERT(mmctx);
-
- switch (sgsn->cfg.auth_policy) {
- case SGSN_AUTH_POLICY_OPEN:
- return SGSN_AUTH_ACCEPTED;
-
- case SGSN_AUTH_POLICY_CLOSED:
- check_net = 1;
- check_acl = 1;
- break;
-
- case SGSN_AUTH_POLICY_ACL_ONLY:
- check_acl = 1;
- break;
-
- case SGSN_AUTH_POLICY_REMOTE:
- if (!mmctx->subscr)
- return mmctx->auth_state;
-
- if (mmctx->subscr->flags & GPRS_SUBSCRIBER_UPDATE_PENDING_MASK)
- return mmctx->auth_state;
-
- if (sgsn->cfg.require_authentication &&
- (!sgsn_mm_ctx_is_authenticated(mmctx) ||
- mmctx->subscr->sgsn_data->auth_triplets_updated))
- return SGSN_AUTH_AUTHENTICATE;
-
- if (mmctx->subscr->authorized)
- return SGSN_AUTH_ACCEPTED;
-
- return SGSN_AUTH_REJECTED;
- }
-
- if (!strlen(mmctx->imsi)) {
- LOGMMCTXP(LOGL_NOTICE, mmctx,
- "Missing IMSI, authorization state not known\n");
- return SGSN_AUTH_UNKNOWN;
- }
-
- if (check_net) {
- /* We simply assume that the IMSI exists, as long as it is part
- * of 'our' network */
- snprintf(mccmnc, sizeof(mccmnc), "%s%s",
- osmo_mcc_name(mmctx->ra.lac.plmn.mcc),
- osmo_mnc_name(mmctx->ra.lac.plmn.mnc, mmctx->ra.lac.plmn.mnc_3_digits));
- if (strncmp(mccmnc, mmctx->imsi, mmctx->ra.lac.plmn.mnc_3_digits ? 6 : 5) == 0)
- return SGSN_AUTH_ACCEPTED;
- }
-
- if (check_acl && sgsn_acl_lookup(mmctx->imsi, &sgsn->cfg))
- return SGSN_AUTH_ACCEPTED;
-
- return SGSN_AUTH_REJECTED;
-}
-
-/*
- * This function is directly called by e.g. the GMM layer. It returns either
- * after calling sgsn_auth_update directly or after triggering an asynchronous
- * procedure which will call sgsn_auth_update later on.
- */
-int sgsn_auth_request(struct sgsn_mm_ctx *mmctx)
-{
- struct gprs_subscr *subscr;
- struct gsm_auth_tuple *at;
- int need_update_location;
- int rc;
-
- LOGMMCTXP(LOGL_DEBUG, mmctx, "Requesting authorization\n");
-
- if (sgsn->cfg.auth_policy != SGSN_AUTH_POLICY_REMOTE) {
- sgsn_auth_update(mmctx);
- return 0;
- }
-
- need_update_location = sgsn->cfg.require_update_location &&
- (mmctx->subscr == NULL ||
- mmctx->pending_req == GSM48_MT_GMM_ATTACH_REQ);
-
- /* This has the side effect of registering the subscr with the mmctx */
- subscr = gprs_subscr_get_or_create_by_mmctx(mmctx);
- gprs_subscr_put(subscr);
-
- OSMO_ASSERT(mmctx->subscr != NULL);
-
- if (sgsn->cfg.require_authentication && !sgsn_mm_ctx_is_authenticated(mmctx)) {
- /* Find next tuple */
- at = sgsn_auth_get_tuple(mmctx, mmctx->auth_triplet.key_seq);
-
- if (!at) {
- /* No valid tuple found, request fresh ones */
- mmctx->auth_triplet.key_seq = GSM_KEY_SEQ_INVAL;
- LOGMMCTXP(LOGL_INFO, mmctx,
- "Requesting authentication tuples\n");
- rc = gprs_subscr_request_auth_info(mmctx, NULL, NULL);
- if (rc >= 0)
- return 0;
-
- return rc;
- }
-
- mmctx->auth_triplet = *at;
- } else if (need_update_location) {
- LOGMMCTXP(LOGL_INFO, mmctx,
- "Missing information, requesting subscriber data\n");
- rc = gprs_subscr_request_update_location(mmctx);
- if (rc >= 0)
- return 0;
-
- return rc;
- }
-
- sgsn_auth_update(mmctx);
- return 0;
-}
-
-void sgsn_auth_update(struct sgsn_mm_ctx *mmctx)
-{
- enum sgsn_auth_state auth_state;
- struct gprs_subscr *subscr = mmctx->subscr;
- struct gsm_auth_tuple *at;
- int gmm_cause;
-
- auth_state = sgsn_auth_state(mmctx);
-
- LOGMMCTXP(LOGL_DEBUG, mmctx, "Updating authorization (%s -> %s)\n",
- get_value_string(sgsn_auth_state_names, mmctx->auth_state),
- get_value_string(sgsn_auth_state_names, auth_state));
-
- if (auth_state == SGSN_AUTH_UNKNOWN && subscr &&
- !(subscr->flags & GPRS_SUBSCRIBER_UPDATE_PENDING_MASK)) {
- /* Reject requests if gprs_subscr_request_update_location fails */
- LOGMMCTXP(LOGL_ERROR, mmctx,
- "Missing information, authorization not possible\n");
- auth_state = SGSN_AUTH_REJECTED;
- }
-
- if (auth_state == SGSN_AUTH_AUTHENTICATE &&
- mmctx->auth_triplet.key_seq == GSM_KEY_SEQ_INVAL) {
- /* The current tuple is not valid, but we are possibly called
- * because new auth tuples have been received */
- at = sgsn_auth_get_tuple(mmctx, mmctx->auth_triplet.key_seq);
- if (!at) {
- LOGMMCTXP(LOGL_ERROR, mmctx,
- "Missing auth tuples, authorization not possible\n");
- auth_state = SGSN_AUTH_REJECTED;
- } else {
- mmctx->auth_triplet = *at;
- }
- }
-
- if (mmctx->auth_state == auth_state)
- return;
-
- LOGMMCTXP(LOGL_INFO, mmctx, "Got authorization update: state %s -> %s\n",
- get_value_string(sgsn_auth_state_names, mmctx->auth_state),
- get_value_string(sgsn_auth_state_names, auth_state));
-
- mmctx->auth_state = auth_state;
-
- switch (auth_state) {
- case SGSN_AUTH_AUTHENTICATE:
- if (subscr)
- subscr->sgsn_data->auth_triplets_updated = 0;
-
- gsm0408_gprs_authenticate(mmctx);
- break;
- case SGSN_AUTH_ACCEPTED:
- gsm0408_gprs_access_granted(mmctx);
- break;
- case SGSN_AUTH_REJECTED:
- gmm_cause =
- subscr ? subscr->sgsn_data->error_cause :
- SGSN_ERROR_CAUSE_NONE;
-
- if (subscr && (subscr->flags & GPRS_SUBSCRIBER_CANCELLED) != 0)
- gsm0408_gprs_access_cancelled(mmctx, gmm_cause);
- else
- gsm0408_gprs_access_denied(mmctx, gmm_cause);
- break;
- default:
- break;
- }
-}
-
-struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx,
- unsigned key_seq)
-{
- unsigned count;
- unsigned idx;
- struct gsm_auth_tuple *at = NULL;
-
- struct sgsn_subscriber_data *sdata;
-
- if (!mmctx->subscr)
- return NULL;
-
- if (key_seq == GSM_KEY_SEQ_INVAL)
- /* Start with 0 after increment module array size */
- idx = ARRAY_SIZE(sdata->auth_triplets) - 1;
- else
- idx = key_seq;
-
- sdata = mmctx->subscr->sgsn_data;
-
- /* Find next tuple */
- for (count = ARRAY_SIZE(sdata->auth_triplets); count > 0; count--) {
- idx = (idx + 1) % ARRAY_SIZE(sdata->auth_triplets);
-
- if (sdata->auth_triplets[idx].key_seq == GSM_KEY_SEQ_INVAL)
- continue;
-
- if (sdata->auth_triplets[idx].use_count == 0) {
- at = &sdata->auth_triplets[idx];
- at->use_count = 1;
- return at;
- }
- }
-
- return NULL;
-}
diff --git a/src/sgsn/sgsn_libgtp.c b/src/sgsn/sgsn_libgtp.c
index af64738..4650632 100644
--- a/src/sgsn/sgsn_libgtp.c
+++ b/src/sgsn/sgsn_libgtp.c
@@ -54,7 +54,6 @@
#include <osmocom/sgsn/mmctx.h>
#include <osmocom/sgsn/gprs_gmm.h>
#include <osmocom/sgsn/gprs_sm.h>
-#include <osmocom/sgsn/gprs_subscriber.h>
#include <osmocom/sgsn/gprs_sndcp.h>
#include <osmocom/sgsn/gprs_ranap.h>
#include <osmocom/sgsn/gprs_gmm_fsm.h>
@@ -65,6 +64,9 @@
#include <osmocom/sgsn/sgsn_rim.h>
#include <osmocom/sgsn/gprs_bssgp.h>
#include <osmocom/sgsn/pdpctx.h>
+#include <osmocom/sgsn/gprs_rau_fsm.h>
+
+#include <osmocom/vlr/vlr.h>
/* TS 23.003: The MSISDN shall take the dummy MSISDN value composed of
* 15 digits set to 0 (encoded as an E.164 international number) when
@@ -186,9 +188,9 @@
LOGPDPCTXP(LOGL_NOTICE, pctx, "Create PDP Context\n");
/* Put the MSISDN in case we have it */
- if (mmctx->subscr && mmctx->subscr->sgsn_data->msisdn_len) {
- pdp->msisdn.l = OSMO_MIN(mmctx->subscr->sgsn_data->msisdn_len, sizeof(pdp->msisdn.v));
- memcpy(pdp->msisdn.v, mmctx->subscr->sgsn_data->msisdn,
+ if (mmctx->vsub && strlen(mmctx->vsub->msisdn)) {
+ pdp->msisdn.l = OSMO_MIN(strlen(mmctx->vsub->msisdn), sizeof(pdp->msisdn.v));
+ memcpy(pdp->msisdn.v, mmctx->vsub->msisdn,
pdp->msisdn.l);
} else {
/* use the dummy 15-digits-zero MSISDN value */
@@ -532,8 +534,9 @@
* "If the SGSN receives an Update PDP Context Response with
* a Cause value "Non-existent", it shall delete the PDP Context."
*/
- if (cause != GTPCAUSE_NON_EXIST)
- return 0; /* Nothing to do */
+ if (cause != GTPCAUSE_NON_EXIST) {
+ return 0; /* Nothing to do */
+ }
LOGPDPCTXP(LOGL_INFO, pctx, "PDP CTX we tried to update doesn't exist in "
"the GGSN anymore, deleting it locally.\n");
diff --git a/src/sgsn/sgsn_main.c b/src/sgsn/sgsn_main.c
index 320842d..ca4e925 100644
--- a/src/sgsn/sgsn_main.c
+++ b/src/sgsn/sgsn_main.c
@@ -70,6 +70,8 @@
#include <osmocom/sgsn/gprs_subscriber.h>
#include <osmocom/sgsn/gtp.h>
+#include <osmocom/vlr/vlr.h>
+
#include <osmocom/sgsn/sgsn_rim.h>
#include "../../config.h"
@@ -355,6 +357,11 @@
.description = "Routing Area",
.enabled = 1, .loglevel = LOGL_NOTICE,
},
+ [DVLR] = {
+ .name = "VLR",
+ .description = "VLR",
+ .enabled = 1, .loglevel = LOGL_NOTICE,
+ },
};
static const struct log_info gprs_log_info = {
@@ -376,6 +383,8 @@
struct osmo_sccp_instance *sccp;
#endif
+ osmo_fsm_term_safely(true);
+
srand(time(NULL));
tall_sgsn_ctx = talloc_named_const(NULL, 0, "osmo_sgsn");
sgsn = sgsn_instance_alloc(tall_sgsn_ctx);
diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c
index 7279167..9e71afd 100644
--- a/src/sgsn/sgsn_vty.c
+++ b/src/sgsn/sgsn_vty.c
@@ -752,7 +752,6 @@
return CMD_SUCCESS;
}
-
DEFUN(imsi_acl, cfg_imsi_acl_cmd,
"imsi-acl (add|del) IMSI",
"Access Control List of foreign IMSIs\n"
@@ -779,6 +778,7 @@
osmo_strlcpy(imsi_sanitized + GSM23003_IMSI_MAX_DIGITS - len, argv[1],
sizeof(imsi_sanitized) - (GSM23003_IMSI_MAX_DIGITS - len));
+ /* FIXME: do we still have ACLs? */
if (!strcmp(op, "add"))
rc = sgsn_acl_add(imsi, g_cfg);
else
@@ -939,113 +939,6 @@
}
/* Subscriber */
-#include <osmocom/sgsn/gprs_subscriber.h>
-
-static void subscr_dump_full_vty(struct vty *vty, struct gprs_subscr *gsub, int pending)
-{
-#if 0
- char expire_time[200];
-#endif
- struct gsm_auth_tuple *at;
- int at_idx;
- struct sgsn_subscriber_pdp_data *pdp;
-
- vty_out(vty, " Authorized: %d%s",
- gsub->authorized, VTY_NEWLINE);
- vty_out(vty, " LAC: %d/0x%x%s",
- gsub->lac, gsub->lac, VTY_NEWLINE);
- vty_out(vty, " IMSI: %s%s", gsub->imsi, VTY_NEWLINE);
- if (gsub->tmsi != GSM_RESERVED_TMSI)
- vty_out(vty, " TMSI: %08X%s", gsub->tmsi,
- VTY_NEWLINE);
- if (gsub->sgsn_data->msisdn_len > 0)
- vty_out(vty, " MSISDN (BCD): %s%s",
- osmo_hexdump(gsub->sgsn_data->msisdn,
- gsub->sgsn_data->msisdn_len),
- VTY_NEWLINE);
-
- if (strlen(gsub->imei) > 0)
- vty_out(vty, " IMEI: %s%s", gsub->imei, VTY_NEWLINE);
-
- for (at_idx = 0; at_idx < ARRAY_SIZE(gsub->sgsn_data->auth_triplets);
- at_idx++) {
- at = &gsub->sgsn_data->auth_triplets[at_idx];
- if (at->key_seq == GSM_KEY_SEQ_INVAL)
- continue;
-
- vty_out(vty, " A3A8 tuple (used %d times): ",
- at->use_count);
- vty_out(vty, " CKSN: %d, ",
- at->key_seq);
- if (at->vec.auth_types & OSMO_AUTH_TYPE_GSM) {
- vty_out(vty, "RAND: %s, ",
- osmo_hexdump_nospc(at->vec.rand,
- sizeof(at->vec.rand)));
- vty_out(vty, "SRES: %s, ",
- osmo_hexdump_nospc(at->vec.sres,
- sizeof(at->vec.sres)));
- vty_out(vty, "Kc: %s%s",
- osmo_hexdump_nospc(at->vec.kc,
- sizeof(at->vec.kc)), VTY_NEWLINE);
- }
- if (at->vec.auth_types & OSMO_AUTH_TYPE_UMTS) {
- vty_out(vty, " AUTN: %s, ",
- osmo_hexdump(at->vec.autn,
- sizeof(at->vec.autn)));
- vty_out(vty, "RES: %s, ",
- osmo_hexdump_nospc(at->vec.res, at->vec.res_len));
- vty_out(vty, "IK: %s, ",
- osmo_hexdump_nospc(at->vec.ik, sizeof(at->vec.ik)));
- vty_out(vty, "CK: %s, ",
- osmo_hexdump_nospc(at->vec.ck, sizeof(at->vec.ck)));
- }
- }
-
- llist_for_each_entry(pdp, &gsub->sgsn_data->pdp_list, list) {
- char ip_str[INET6_ADDRSTRLEN] = { 0 };
-
- vty_out(vty, " PDP info: Id: %d, Addr(Org: 0x%02x Type: 0x%02x",
- pdp->context_id, pdp->pdp_type_org, pdp->pdp_type_nr);
-
- if (pdp->pdp_address[0].u.sa.sa_family != AF_UNSPEC)
- vty_out(vty, " Addr[0]: %s", osmo_sockaddr_ntop(&pdp->pdp_address[0].u.sa, ip_str));
- if (pdp->pdp_address[0].u.sa.sa_family != AF_UNSPEC)
- vty_out(vty, " Addr[1]: %s", osmo_sockaddr_ntop(&pdp->pdp_address[1].u.sa, ip_str));
-
- vty_out(vty, ") APN: '%s'", pdp->apn_str);
-
- if (pdp->qos_subscribed_len)
- vty_out(vty, " QoS: %s", osmo_hexdump(pdp->qos_subscribed, pdp->qos_subscribed_len));
-
- vty_out(vty, "%s", VTY_NEWLINE);
- }
-
-#if 0
- /* print the expiration time of a subscriber */
- if (gsub->expire_lu) {
- strftime(expire_time, sizeof(expire_time),
- "%a, %d %b %Y %T %z", localtime(&gsub->expire_lu));
- expire_time[sizeof(expire_time) - 1] = '\0';
- vty_out(vty, " Expiration Time: %s%s", expire_time, VTY_NEWLINE);
- }
-#endif
-
- if (gsub->flags)
- vty_out(vty, " Flags: %s%s%s%s%s%s",
- gsub->flags & GPRS_SUBSCRIBER_FIRST_CONTACT ?
- "FIRST_CONTACT " : "",
- gsub->flags & GPRS_SUBSCRIBER_CANCELLED ?
- "CANCELLED " : "",
- gsub->flags & GPRS_SUBSCRIBER_UPDATE_LOCATION_PENDING ?
- "UPDATE_LOCATION_PENDING " : "",
- gsub->flags & GPRS_SUBSCRIBER_UPDATE_AUTH_INFO_PENDING ?
- "AUTH_INFO_PENDING " : "",
- gsub->flags & GPRS_SUBSCRIBER_ENABLE_PURGE ?
- "ENABLE_PURGE " : "",
- VTY_NEWLINE);
-
- vty_out(vty, " Use count: %u%s", gsub->use_count, VTY_NEWLINE);
-}
#define RESET_SGSN_STATE_STR \
"Remove all known subscribers, MM contexts and flush BSSGP queues." \
@@ -1056,7 +949,6 @@
"reset sgsn state",
RESET_SGSN_STATE_STR RESET_SGSN_STATE_STR RESET_SGSN_STATE_STR)
{
- struct gprs_subscr *subscr, *tmp_subscr;
struct sgsn_mm_ctx *mm, *tmp_mm;
llist_for_each_entry_safe(mm, tmp_mm, &sgsn->mm_list, list)
@@ -1065,12 +957,7 @@
}
vty_out(vty, "Cancelled MM Ctx. %s", VTY_NEWLINE);
- llist_for_each_entry_safe(subscr, tmp_subscr, gprs_subscribers, entry) {
- gprs_subscr_get(subscr);
- gprs_subscr_cancel(subscr);
- gprs_subscr_put(subscr);
- }
- vty_out(vty, "Removed all gprs subscribers.%s", VTY_NEWLINE);
+ /* FIXME: reset VLR */
bssgp_flush_all_queues();
vty_out(vty, "Flushed all BSSGPs queues.%s", VTY_NEWLINE);
@@ -1088,160 +975,7 @@
SHOW_STR "Show information about subscribers\n"
"Display contents of subscriber cache\n")
{
- struct gprs_subscr *subscr;
-
- llist_for_each_entry(subscr, gprs_subscribers, entry) {
- vty_out(vty, " Subscriber:%s", VTY_NEWLINE);
- subscr_dump_full_vty(vty, subscr, 0);
- }
-
- return CMD_SUCCESS;
-}
-
-#define UPDATE_SUBSCR_STR "update-subscriber imsi IMSI "
-#define UPDATE_SUBSCR_HELP "Update subscriber list\n" \
- "Use the IMSI to select the subscriber\n" \
- "The IMSI\n"
-
-#define UPDATE_SUBSCR_INSERT_HELP "Insert data into the subscriber record\n"
-
-DEFUN(update_subscr_insert_auth_triplet, update_subscr_insert_auth_triplet_cmd,
- UPDATE_SUBSCR_STR "insert auth-triplet <1-5> sres SRES rand RAND kc KC",
- UPDATE_SUBSCR_HELP
- UPDATE_SUBSCR_INSERT_HELP
- "Update authentication triplet\n"
- "Triplet index\n"
- "Set SRES value\nSRES value (4 byte) in hex\n"
- "Set RAND value\nRAND value (16 byte) in hex\n"
- "Set Kc value\nKc value (8 byte) in hex\n")
-{
- const char *imsi = argv[0];
- const int cksn = atoi(argv[1]) - 1;
- const char *sres_str = argv[2];
- const char *rand_str = argv[3];
- const char *kc_str = argv[4];
- struct gsm_auth_tuple at = {0,};
-
- struct gprs_subscr *subscr;
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (!subscr) {
- vty_out(vty, "%% unable get subscriber record for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- OSMO_ASSERT(subscr->sgsn_data);
-
- if (osmo_hexparse(sres_str, &at.vec.sres[0], sizeof(at.vec.sres)) < 0) {
- vty_out(vty, "%% invalid SRES value '%s'%s",
- sres_str, VTY_NEWLINE);
- goto failed;
- }
- if (osmo_hexparse(rand_str, &at.vec.rand[0], sizeof(at.vec.rand)) < 0) {
- vty_out(vty, "%% invalid RAND value '%s'%s",
- rand_str, VTY_NEWLINE);
- goto failed;
- }
- if (osmo_hexparse(kc_str, &at.vec.kc[0], sizeof(at.vec.kc)) < 0) {
- vty_out(vty, "%% invalid Kc value '%s'%s",
- kc_str, VTY_NEWLINE);
- goto failed;
- }
- at.key_seq = cksn;
-
- subscr->sgsn_data->auth_triplets[cksn] = at;
- subscr->sgsn_data->auth_triplets_updated = 1;
-
- gprs_subscr_put(subscr);
-
- return CMD_SUCCESS;
-
-failed:
- gprs_subscr_put(subscr);
- return CMD_SUCCESS;
-}
-
-DEFUN(update_subscr_cancel, update_subscr_cancel_cmd,
- UPDATE_SUBSCR_STR "cancel (update-procedure|subscription-withdraw)",
- UPDATE_SUBSCR_HELP
- "Cancel (remove) subscriber record\n"
- "The MS moved to another SGSN\n"
- "The subscription is no longer valid\n")
-{
- const char *imsi = argv[0];
- const char *cancel_type = argv[1];
-
- struct gprs_subscr *subscr;
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (!subscr) {
- vty_out(vty, "%% no subscriber record for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- if (strcmp(cancel_type, "update-procedure") == 0)
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- else
- subscr->sgsn_data->error_cause = GMM_CAUSE_IMPL_DETACHED;
-
- gprs_subscr_cancel(subscr);
- gprs_subscr_put(subscr);
-
- return CMD_SUCCESS;
-}
-
-DEFUN(update_subscr_create, update_subscr_create_cmd,
- UPDATE_SUBSCR_STR "create",
- UPDATE_SUBSCR_HELP
- "Create a subscriber entry\n")
-{
- const char *imsi = argv[0];
-
- struct gprs_subscr *subscr;
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (subscr) {
- vty_out(vty, "%% subscriber record already exists for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- subscr = gprs_subscr_get_or_create(imsi);
- if (!subscr) {
- vty_out(vty, "Can not create subscriber. Out of memory.%s", imsi);
- return CMD_WARNING;
- }
- subscr->keep_in_ram = 1;
- gprs_subscr_put(subscr);
-
- return CMD_SUCCESS;
-}
-
-DEFUN(update_subscr_destroy, update_subscr_destroy_cmd,
- UPDATE_SUBSCR_STR "destroy",
- UPDATE_SUBSCR_HELP
- "Destroy a subscriber entry\n")
-{
- const char *imsi = argv[0];
-
- struct gprs_subscr *subscr;
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (!subscr) {
- vty_out(vty, "%% subscriber record does not exist for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- subscr->keep_in_ram = 0;
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- gprs_subscr_cancel(subscr);
- if (subscr->use_count > 1)
- vty_out(vty, "%% subscriber is still in use%s",
- VTY_NEWLINE);
- gprs_subscr_put(subscr);
+ /* FIXME list VLR or MMctx */
return CMD_SUCCESS;
}
@@ -1256,73 +990,6 @@
"Force error code UnknownSubscriber\n" \
"Force error code RoamingNotAllowed\n"
-DEFUN(update_subscr_update_location_result, update_subscr_update_location_result_cmd,
- UPDATE_SUBSCR_STR "update-location-result (ok|" UL_ERR_STR ")",
- UPDATE_SUBSCR_HELP
- "Complete the update location procedure\n"
- "The update location request succeeded\n"
- UL_ERR_HELP)
-{
- const char *imsi = argv[0];
- const char *ret_code_str = argv[1];
-
- struct gprs_subscr *subscr;
-
- const struct value_string cause_mapping[] = {
- { GMM_CAUSE_NET_FAIL, "system-failure" },
- { GMM_CAUSE_INV_MAND_INFO, "data-missing" },
- { GMM_CAUSE_PROTO_ERR_UNSPEC, "unexpected-data-value" },
- { GMM_CAUSE_IMSI_UNKNOWN, "unknown-subscriber" },
- { GMM_CAUSE_GPRS_NOTALLOWED, "roaming-not-allowed" },
- { 0, NULL }
- };
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (!subscr) {
- vty_out(vty, "%% unable to get subscriber record for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- if (strcmp(ret_code_str, "ok") == 0) {
- subscr->sgsn_data->error_cause = SGSN_ERROR_CAUSE_NONE;
- subscr->authorized = 1;
- } else {
- subscr->sgsn_data->error_cause =
- get_string_value(cause_mapping, ret_code_str);
- subscr->authorized = 0;
- }
-
- gprs_subscr_update(subscr);
-
- gprs_subscr_put(subscr);
-
- return CMD_SUCCESS;
-}
-
-DEFUN(update_subscr_update_auth_info, update_subscr_update_auth_info_cmd,
- UPDATE_SUBSCR_STR "update-auth-info",
- UPDATE_SUBSCR_HELP
- "Complete the send authentication info procedure\n")
-{
- const char *imsi = argv[0];
-
- struct gprs_subscr *subscr;
-
- subscr = gprs_subscr_get_by_imsi(imsi);
- if (!subscr) {
- vty_out(vty, "%% unable to get subscriber record for %s%s",
- imsi, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- gprs_subscr_update_auth_info(subscr);
-
- gprs_subscr_put(subscr);
-
- return CMD_SUCCESS;
-}
-
DEFUN(page_subscr, page_subscr_info_cmd,
"page imsi IMSI",
"Send a PS paging request to subscriber\n"
@@ -1838,12 +1505,6 @@
install_element_ve(&show_timer_cmd);
install_element_ve(&show_timer_gtp_cmd);
- install_element(ENABLE_NODE, &update_subscr_insert_auth_triplet_cmd);
- install_element(ENABLE_NODE, &update_subscr_create_cmd);
- install_element(ENABLE_NODE, &update_subscr_destroy_cmd);
- install_element(ENABLE_NODE, &update_subscr_cancel_cmd);
- install_element(ENABLE_NODE, &update_subscr_update_location_result_cmd);
- install_element(ENABLE_NODE, &update_subscr_update_auth_info_cmd);
install_element(ENABLE_NODE, &page_subscr_info_cmd);
install_element(ENABLE_NODE, &reset_sgsn_state_cmd);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9d429d7..a613c5c 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -2,7 +2,6 @@
gprs \
gtphub \
gprs_routing_area \
- sgsn \
xid \
sndcp_xid \
slhc \
diff --git a/tests/gprs_routing_area/Makefile.am b/tests/gprs_routing_area/Makefile.am
index e15769d..897b9f8 100644
--- a/tests/gprs_routing_area/Makefile.am
+++ b/tests/gprs_routing_area/Makefile.am
@@ -44,6 +44,7 @@
$(top_builddir)/src/sgsn/gprs_sndcp.o \
$(top_builddir)/src/sgsn/gprs_gmm_attach.o \
$(top_builddir)/src/sgsn/gprs_gmm.o \
+ $(top_builddir)/src/sgsn/gprs_rau_fsm.o \
$(top_builddir)/src/sgsn/gprs_gmm_fsm.o \
$(top_builddir)/src/sgsn/gprs_gmm_util.o \
$(top_builddir)/src/sgsn/gprs_mm_state_gb_fsm.o \
diff --git a/tests/sgsn/sgsn_test.c b/tests/sgsn/sgsn_test.c
index 6dcda84..6604c86 100644
--- a/tests/sgsn/sgsn_test.c
+++ b/tests/sgsn/sgsn_test.c
@@ -438,13 +438,17 @@
static int rx_gsup_message(const uint8_t *data, size_t data_len)
{
struct msgb *msg;
+ struct osmo_gsup_message gsup_msg = {};
int rc;
msg = msgb_alloc(1024, __func__);
msg->l2h = msgb_put(msg, data_len);
OSMO_ASSERT(msg->l2h != NULL);
memcpy(msg->l2h, data, data_len);
- rc = gprs_subscr_rx_gsup_message(msg);
+ rc = osmo_gsup_decode(data, data_len, &gsup_msg);
+ OSMO_ASSERT(!rc);
+
+ rc = gprs_subscr_rx_gsup_message(&gsup_msg);
msgb_free(msg);
return rc;
@@ -1040,7 +1044,6 @@
{
struct osmo_gsup_message to_peer = {0};
struct osmo_gsup_message from_peer = {0};
- struct msgb *reply_msg;
int rc;
/* Simulate the GSUP peer */
@@ -1078,11 +1081,7 @@
return 0;
}
- reply_msg = osmo_gsup_client_msgb_alloc();
- reply_msg->l2h = reply_msg->data;
- osmo_gsup_encode(reply_msg, &from_peer);
- gprs_subscr_rx_gsup_message(reply_msg);
- msgb_free(reply_msg);
+ gprs_subscr_rx_gsup_message(&from_peer);
return 0;
};
diff --git a/tests/testsuite.at b/tests/testsuite.at
index 242ab26..9079c84 100644
--- a/tests/testsuite.at
+++ b/tests/testsuite.at
@@ -7,13 +7,6 @@
AT_CHECK([$abs_top_builddir/tests/gprs/gprs_test], [], [expout], [ignore])
AT_CLEANUP
-AT_SETUP([sgsn])
-AT_KEYWORDS([sgsn])
-AT_CHECK([test "$enable_sgsn_test" != no || exit 77])
-cat $abs_srcdir/sgsn/sgsn_test.ok > expout
-AT_CHECK([$abs_top_builddir/tests/sgsn/sgsn_test], [], [expout], [ignore])
-AT_CLEANUP
-
AT_SETUP([gprs_routing_area])
AT_KEYWORDS([gprs_routing_area])
AT_CHECK([test "$enable_gprs_routing_area_test" != no || exit 77])
diff --git a/tests/vty_test_runner.py b/tests/vty_test_runner.py
index aaa76ed..8141948 100755
--- a/tests/vty_test_runner.py
+++ b/tests/vty_test_runner.py
@@ -130,25 +130,6 @@
res = self.vty.command("show running-config")
self.assertTrue(res.find('auth-policy remote') > 0)
- def testVtySubscriber(self):
- self.vty.enable()
- res = self.vty.command('show subscriber cache')
- self.assertTrue(res.find('1234567890') < 0)
- self.assertTrue(self.vty.verify('update-subscriber imsi 1234567890 create', ['']))
- res = self.vty.command('show subscriber cache')
- self.assertTrue(res.find('1234567890') >= 0)
- self.assertTrue(res.find('Authorized: 0') >= 0)
- self.assertTrue(self.vty.verify('update-subscriber imsi 1234567890 update-location-result ok', ['']))
- res = self.vty.command('show subscriber cache')
- self.assertTrue(res.find('1234567890') >= 0)
- self.assertTrue(res.find('Authorized: 1') >= 0)
- self.assertTrue(self.vty.verify('update-subscriber imsi 1234567890 cancel update-procedure', ['']))
- res = self.vty.command('show subscriber cache')
- self.assertTrue(res.find('1234567890') >= 0)
- self.assertTrue(self.vty.verify('update-subscriber imsi 1234567890 destroy', ['']))
- res = self.vty.command('show subscriber cache')
- self.assertTrue(res.find('1234567890') < 0)
-
def testVtyGgsn(self):
self.vty.enable()
self.assertTrue(self.vty.verify('configure terminal', ['']))
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39562?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I9c5b4ec1b337c35e85c2d1a3d09b318380ae6ef8
Gerrit-Change-Number: 39562
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
1
0
[XS] Change in osmo-sgsn[master]: mm_state_gb_fsm: Allow Idle -> Ready transition for RA Update
by lynxis lazus 16 Feb '25
by lynxis lazus 16 Feb '25
16 Feb '25
lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39564?usp=email )
Change subject: mm_state_gb_fsm: Allow Idle -> Ready transition for RA Update
......................................................................
mm_state_gb_fsm: Allow Idle -> Ready transition for RA Update
Change-Id: Ic26d237976f51a061ac394cee1daef20db048517
---
M src/sgsn/gprs_mm_state_gb_fsm.c
1 file changed, 2 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/64/39564/1
diff --git a/src/sgsn/gprs_mm_state_gb_fsm.c b/src/sgsn/gprs_mm_state_gb_fsm.c
index dde7b77..762fda8 100644
--- a/src/sgsn/gprs_mm_state_gb_fsm.c
+++ b/src/sgsn/gprs_mm_state_gb_fsm.c
@@ -57,6 +57,7 @@
{
switch(event) {
case E_MM_GPRS_ATTACH:
+ case E_MM_RA_UPDATE:
mm_state_gb_fsm_state_chg(fi, ST_MM_READY);
break;
case E_MM_PDU_RECEPTION:
@@ -99,7 +100,7 @@
static struct osmo_fsm_state mm_state_gb_fsm_states[] = {
[ST_MM_IDLE] = {
- .in_event_mask = X(E_MM_GPRS_ATTACH) | X(E_MM_PDU_RECEPTION),
+ .in_event_mask = X(E_MM_GPRS_ATTACH) | X(E_MM_PDU_RECEPTION) | X(E_MM_RA_UPDATE),
.out_state_mask = X(ST_MM_READY),
.onenter = st_mm_idle_on_enter,
.name = "Idle",
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39564?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: Ic26d237976f51a061ac394cee1daef20db048517
Gerrit-Change-Number: 39564
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-CC: daniel <dwillmann(a)sysmocom.de>
1
0
[L] Change in osmo-sgsn[master]: Add Gn support to allow MME->SGSN, SGSN->MME cell reselection
by lynxis lazus 16 Feb '25
by lynxis lazus 16 Feb '25
16 Feb '25
lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39563?usp=email )
Change subject: Add Gn support to allow MME->SGSN, SGSN->MME cell reselection
......................................................................
Add Gn support to allow MME->SGSN, SGSN->MME cell reselection
The Gn interface allow to transfer the state of MS/UE between
SGSNs and SGSN to MME and vice versa.
The code won't use the old key material from the old core network component.
Instead it will ask the HLR for new material.
Change-Id: Iffe83b31db2b6e6869fedf2351375184096cff6f
---
M include/osmocom/sgsn/gprs_rau_fsm.h
M include/osmocom/sgsn/gtp.h
M include/osmocom/sgsn/mmctx.h
M include/osmocom/sgsn/pdpctx.h
M src/sgsn/gprs_gmm.c
M src/sgsn/gprs_rau_fsm.c
M src/sgsn/mmctx.c
M src/sgsn/pdpctx.c
M src/sgsn/sgsn_libgtp.c
9 files changed, 927 insertions(+), 11 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/63/39563/1
diff --git a/include/osmocom/sgsn/gprs_rau_fsm.h b/include/osmocom/sgsn/gprs_rau_fsm.h
index 8cf47f4..7eae057 100644
--- a/include/osmocom/sgsn/gprs_rau_fsm.h
+++ b/include/osmocom/sgsn/gprs_rau_fsm.h
@@ -27,6 +27,7 @@
enum gmm_rau_state {
GMM_RAU_S_INIT,
GMM_RAU_S_WAIT_VLR_ANSWER,
+ GMM_RAU_S_WAIT_GGSN_UPDATE,
GMM_RAU_S_WAIT_UE_RAU_COMPLETE,
};
@@ -37,6 +38,7 @@
GMM_RAU_E_VLR_RAU_REJECT, /* Request to transmit Att/RAU Reject */
GMM_RAU_E_VLR_TERM_SUCCESS, /* VLR Lu FSM terminates. Inform GMM about Att/RAU Success (including Att/RAU complete) */
GMM_RAU_E_VLR_TERM_FAIL, /* VLR Lu FSM terminates. Inform GMM about Att/RAU fail */
+ GMM_RAU_E_GGSN_UPD_RESP,
};
/* To be used as data when terminating the fsm */
diff --git a/include/osmocom/sgsn/gtp.h b/include/osmocom/sgsn/gtp.h
index ed6cbf5..8cbad40 100644
--- a/include/osmocom/sgsn/gtp.h
+++ b/include/osmocom/sgsn/gtp.h
@@ -12,6 +12,7 @@
struct sgsn_pdp_ctx;
struct sgsn_mm_ctx;
struct sgsn_mme_ctx;
+struct gsn_t;
int sgsn_gtp_init(struct sgsn_instance *sgi);
@@ -27,3 +28,5 @@
struct msgb *msg, uint32_t npdu_len, uint8_t *npdu);
int sgsn_delete_pdp_ctx(struct sgsn_pdp_ctx *pctx);
int send_act_pdp_cont_acc(struct sgsn_pdp_ctx *pctx);
+
+int sgsn_context_ack(struct gsn_t *gsn, struct sgsn_mm_ctx *mmctx, uint8_t cause);
diff --git a/include/osmocom/sgsn/mmctx.h b/include/osmocom/sgsn/mmctx.h
index 1f1559e..d09212d 100644
--- a/include/osmocom/sgsn/mmctx.h
+++ b/include/osmocom/sgsn/mmctx.h
@@ -232,6 +232,15 @@
/* the current GGSN look-up operation */
struct sgsn_ggsn_lookup *ggsn_lookup;
+ /* When a GSN requests a SGSN Context, we need to keep a reference */
+ uint32_t gtp_local_ref;
+ bool gtp_local_ref_valid;
+
+ /* GUTI will be used when a inter RAT from EUTRAN happens */
+ struct osmo_guti guti;
+ uint8_t eutran_nri;
+ bool guti_valid;
+
struct gprs_subscr *subscr;
struct vlr_subscr *vsub;
/* to know if subscriber is doing an attach or location update */
@@ -280,6 +289,7 @@
const struct osmo_routing_area_id *raid);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_ptmsi(uint32_t tmsi);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_imsi(const char *imsi);
+struct sgsn_mm_ctx *sgsn_mm_ctx_by_gtp_local_ref(uint32_t local_ref);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_ue_ctx(const void *uectx);
struct sgsn_mm_ctx *sgsn_mm_ctx_by_llme(const struct gprs_llc_llme *llme);
diff --git a/include/osmocom/sgsn/pdpctx.h b/include/osmocom/sgsn/pdpctx.h
index 39d744a..b61e643 100644
--- a/include/osmocom/sgsn/pdpctx.h
+++ b/include/osmocom/sgsn/pdpctx.h
@@ -31,6 +31,10 @@
PDP_STATE_CR_REQ,
PDP_STATE_CR_CONF,
+ /* when received via SGSN Context Req from another SGSN/MME,
+ * the PDP context needs to be updated with our own address */
+ PDP_STATE_NEED_UPDATE_GSN,
+
/* 04.08 / Figure 6.2 / 6.1.2.2 */
PDP_STATE_INACT_PEND,
PDP_STATE_INACTIVE = PDP_STATE_NONE,
@@ -93,6 +97,7 @@
uint8_t nsapi);
void sgsn_pdp_ctx_terminate(struct sgsn_pdp_ctx *pdp);
void sgsn_pdp_ctx_free(struct sgsn_pdp_ctx *pdp);
+int sgsn_pdp_ctx_gn_update(struct sgsn_pdp_ctx *pctx);
char *gprs_pdpaddr2str(uint8_t *pdpa, uint8_t len, bool return_ipv6);
diff --git a/src/sgsn/gprs_gmm.c b/src/sgsn/gprs_gmm.c
index 83497d2..9f4343f 100644
--- a/src/sgsn/gprs_gmm.c
+++ b/src/sgsn/gprs_gmm.c
@@ -752,6 +752,10 @@
if (ctx->ran_type == MM_CTX_T_UTRAN_Iu)
ctx->iu.new_key = 1;
+ /* Gn: SGSN Context Req/Resp/Ack procedure */
+ if (ctx->gtp_local_ref_valid)
+ sgsn_context_ack(sgsn->gsn, ctx, GTPCAUSE_ACC_REQ);
+
/* FIXME: enable LLC cipheirng */
/* FIXME: This should _not_ trigger a FSM success */
osmo_fsm_inst_dispatch(ctx->gmm_fsm, E_GMM_COMMON_PROC_SUCCESS, NULL);
@@ -1472,6 +1476,41 @@
return gsm48_gmm_sendmsg(msg, 0, NULL, false);
}
+/*! Calculate the GUTI from a Routing Area Update Request, P-TMSI, P-TMSI signature
+ *
+ * \param[in] msg
+ * \param[in] req
+ * \param[in] new_ra_id
+ * \param[out] guti
+ * \param[out] nas_token
+ * \return 0 on success
+ */
+static int get_guti(struct msgb *msg, struct gprs_gmm_ra_upd_req *req, uint32_t ptmsi, struct osmo_guti *guti, uint16_t *nas_token)
+{
+ /* uint16_t nas_token; */
+ uint8_t ptmsi_mtmsi;
+
+ OSMO_ASSERT(guti);
+
+ if (!TLVP_PRES_LEN(&req->tlv, GSM48_IE_GMM_PTMSI_SIG, 3))
+ return GMM_CAUSE_IE_NOTEXIST_NOTIMPL;
+
+ ptmsi_mtmsi = tlvp_val8(&req->tlv, GSM48_IE_GMM_PTMSI_SIG, 0);
+ /* nas_token only valid for UTRAN */
+ *nas_token = osmo_load16be(TLVP_VAL(&req->tlv, GSM48_IE_GMM_PTMSI_SIG) + 1);
+
+ guti->gummei.plmn = req->old_rai.lac.plmn;
+ guti->gummei.mme.group_id = req->old_rai.lac.lac;
+ guti->gummei.mme.code = req->old_rai.rac;
+ /* bits 31 to 30 are always 11; P-TMSI bits29 to 24, 15 to 0 */
+ guti->mtmsi |= (1 << 31) | (1 << 30) | (ptmsi & 0x3f00ffff);
+ guti->mtmsi |= (ptmsi_mtmsi << 16);
+ /* bits 23 to 16 is the NRI */
+ /* eutran_nri = (ptmsi >> 16) & 0xff; */
+
+ return 0;
+}
+
/* Chapter 9.4.14: Routing area update request */
static int gsm48_rx_gmm_ra_upd_req(struct sgsn_mm_ctx *mmctx, struct msgb *msg,
struct gprs_llc_llme *llme)
@@ -1482,12 +1521,15 @@
enum gsm48_gmm_cause reject_cause = GMM_CAUSE_PROTO_ERR_UNSPEC;
struct gprs_gmm_ra_upd_req req;
struct osmo_routing_area_id new_ra_id = {};
+ struct osmo_guti guti = {};
enum vlr_lu_type vlr_rau_type = VLR_LU_TYPE_REGULAR;
bool foreign_ra = false;
enum gsm48_ptsmi_type ptmsi_type = PTMSI_TYPE_NATIVE;
int rc;
+ uint16_t nas_token;
uint32_t ptmsi = 0xffffffff;
uint32_t tlli = 0xffffffff;
+ struct sgsn_mme_ctx *mme;
rc = gprs_gmm_parse_ra_upd_req(msg, &req);
if (rc) {
@@ -1580,16 +1622,46 @@
/* the UE is transitioning from EUTRAN to GERAN/UTRAN */
foreign_ra = true;
- reject_cause = GMM_CAUSE_IMPL_DETACHED;
- LOGP(DGPRS, LOGL_ERROR, "UE has a mapped P-TMSI. MME-to-SGSN mobility not implemented. Rejecting\n");
- goto rejected;
+ rc = get_guti(msg, &req, ptmsi, &guti, &nas_token);
+ if (rc) {
+ reject_cause = GMM_CAUSE_IMPL_DETACHED;
+ LOGP(DGPRS, LOGL_ERROR, "Can't decode guti\n");
+ goto rejected;
+ }
+
+ mme = sgsn_mme_ctx_by_gummei(sgsn, &guti.gummei);
+ if (!mme) {
+ reject_cause = GMM_CAUSE_IMPL_DETACHED;
+ LOGP(DGPRS, LOGL_ERROR, "No MME found for Gummei %s", osmo_gummei_name(&guti.gummei));
+ /* FIXME: check for additional RAI + PTMSI */
+ goto rejected;
+ }
+
+ if (!mmctx) {
+ /* create a new MMCtx and ask for the context */
+ if (msgb_bcid(msg)) {
+ mmctx = sgsn_mm_ctx_alloc_gb(tlli, &req.old_rai);
+ if (mmctx)
+ mmctx->gb.llme = llme;
+ } else {
+ mmctx = sgsn_mm_ctx_alloc_iu(MSG_IU_UE_CTX(msg));
+ }
+
+ if (!mmctx)
+ goto rejected;
+
+ mmctx->p_tmsi = ptmsi;
+ }
+ mmctx->guti = guti;
+ mmctx->guti_valid = true;
} else { /* (ptmsi_type == PTMSI_TYPE_NATIVE) - 2G/3G PTMSI */
/* Check if this a local RA or a foreign */
struct sgsn_ra *ra;
ra = sgsn_ra_get_ra(&req.old_rai);
if (!ra) {
- LOGP(DGPRS, LOGL_ERROR, "Can't find RA for native PTMSI. SGSN-to-SGSN mobility not implemented. Rejecting\n");
+ LOGP(DGPRS, LOGL_ERROR, "Can't find RA for native PTMSI. No SGSN-to-SGSN mobility implemented. Rejecting\n");
+ /* FIXME: implement SGSN to SGSN routing */
foreign_ra = true;
reject_cause = GMM_CAUSE_IMPL_DETACHED;
goto rejected;
@@ -2491,12 +2563,73 @@
/* decide if the location/routing area id is within the VLR or not */
static bool vlr_location_served_cb(struct vlr_subscr *vsub, const struct osmo_routing_area_id *rai)
{
+ struct sgsn_mm_ctx *mmctx = vsub->msc_conn_ref;
+
+ if (mmctx) {
+ return !mmctx->attach_rau.foreign;
+ }
+
+ /* FIXME: check if rai is valid */
+
return false;
}
+/* VLR request the SGSN to ask the old SGSN/MME for more information */
int vlr_pvlr_request_cb(void *ref, const struct osmo_routing_area_id *old_rai)
{
- return 1;
+ struct sgsn_mm_ctx *ctx = ref;
+ int rc;
+ uint32_t local_ref;
+ struct sgsn_mme_ctx *mme = NULL;
+ struct sockaddr_in remote = {};
+
+ union gtpie_member *ie[GTPIE_SIZE] = {};
+ union gtpie_member ie_elem[3] = {};
+ unsigned int i = 0;
+
+ if (!ctx)
+ return -EINVAL;
+
+ if (!ctx->guti_valid)
+ return -EINVAL;
+
+ mme = sgsn_mme_ctx_by_gummei(sgsn, &ctx->guti.gummei);
+ if (!mme) {
+ return -EINVAL;
+ }
+
+ remote.sin_family = AF_INET;
+ remote.sin_addr = mme->remote_addr;
+
+ if (ctx->p_tmsi != 0x0 && ctx->p_tmsi != 0xffffffff) {
+ ie_elem[i].tv4.t = GTPIE_P_TMSI;
+ ie_elem[i].tv4.v = osmo_htonl(ctx->p_tmsi);
+ ie[GTPIE_P_TMSI] = &ie_elem[i];
+ i++;
+ }
+
+ if (ctx->attach_rau.p_tmsi_sig_valid) {
+ ie_elem[i].tv0.t = GTPIE_P_TMSI_S;
+ memcpy(ie_elem[i].tv0.v, ctx->attach_rau.p_tmsi_sig, sizeof(ctx->attach_rau.p_tmsi_sig));
+ ie[GTPIE_P_TMSI_S] = &ie_elem[i];
+ i++;
+ }
+
+ ie_elem[i].tv0.t = GTPIE_RAI;
+ osmo_routing_area_id_encode_buf(ie_elem[i].tv0.v, 6, &ctx->attach_rau.old_rai);
+ ie[GTPIE_RAI] = &ie_elem[i];
+ i++;
+
+ rc = gtp_sgsn_context_req(sgsn->gsn, &local_ref, &remote, ie, GTPIE_SIZE);
+ if (!rc) {
+ /* FIXME: reject with impl. */
+ return -1;
+ } else {
+ ctx->gtp_local_ref = local_ref;
+ ctx->gtp_local_ref_valid = true;
+ }
+
+ return 0;
}
diff --git a/src/sgsn/gprs_rau_fsm.c b/src/sgsn/gprs_rau_fsm.c
index 60ca6be..a9a79e6 100644
--- a/src/sgsn/gprs_rau_fsm.c
+++ b/src/sgsn/gprs_rau_fsm.c
@@ -44,6 +44,7 @@
OSMO_VALUE_STRING(GMM_RAU_E_UE_RAU_REQUEST),
OSMO_VALUE_STRING(GMM_RAU_E_VLR_RAU_ACCEPT),
OSMO_VALUE_STRING(GMM_RAU_E_VLR_RAU_REJECT),
+ OSMO_VALUE_STRING(GMM_RAU_E_GGSN_UPD_RESP),
OSMO_VALUE_STRING(GMM_RAU_E_UE_RAU_COMPLETE),
OSMO_VALUE_STRING(GMM_RAU_E_VLR_TERM_FAIL),
OSMO_VALUE_STRING(GMM_RAU_E_VLR_TERM_SUCCESS),
@@ -147,8 +148,13 @@
/* same RAU, a different RAU would terminate this FSM */
break;
case GMM_RAU_E_VLR_RAU_ACCEPT:
- transmit_rau_accept(mmctx);
- osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_UE_RAU_COMPLETE, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ /* delay forwarding it */
+ if (mmctx->attach_rau.foreign) {
+ osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_GGSN_UPDATE, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ } else {
+ transmit_rau_accept(mmctx);
+ osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_UE_RAU_COMPLETE, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ }
break;
case GMM_RAU_E_VLR_RAU_REJECT:
gmm_cause = (uint8_t) ((long) data & 0xff);
@@ -165,6 +171,54 @@
}
}
+static void transmit_update_pdp_req(struct sgsn_mm_ctx *mmctx)
+{
+ struct sgsn_pdp_ctx *pctx;
+
+ /* When receiving PDP context via Gn, all PDP context must taken cared off:
+ * if the UE still knows about them, update the GTP path
+ * or termiante the PDP context, when the UE states this has been dropped. */
+ llist_for_each_entry(pctx, &mmctx->pdp_list, list) {
+ if (pctx->ue_pdp_active)
+ sgsn_pdp_ctx_gn_update(pctx);
+ else
+ sgsn_pdp_ctx_terminate(pctx);
+ }
+}
+
+void gmm_rau_fsm_s_wait_ggsn_onenter(struct osmo_fsm_inst *fi, uint32_t prev_state)
+{
+ struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
+ /* transmit Update PDP Request when doing a Inter-SGSN handover (or 4G->2G/4G) */
+
+ /* FIXME: move Gn into a FSM and wait for a response before sending out the RAU Accept */
+ /* update the PDP Request should be done now */
+ transmit_update_pdp_req(mmctx);
+}
+
+static void gmm_rau_fsm_s_wait_ggsn(struct osmo_fsm_inst *fi, uint32_t event, void *data)
+{
+ struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
+
+ switch (event) {
+ case GMM_RAU_E_GGSN_UPD_RESP:
+ transmit_rau_accept(mmctx);
+ // FIXME: transmit Routing Area Update Accpet OR inform the VLR to continue ULA */
+ /* FIXME: check for *all* pdp before going to next state */
+ osmo_tdef_fsm_inst_state_chg(fi, GMM_RAU_S_WAIT_UE_RAU_COMPLETE, gmm_rau_tdef_states, gmm_rau_tdefs, 0);
+ break;
+ case GMM_RAU_E_VLR_RAU_REJECT:
+ /* FIXME */
+ break;
+ case GMM_RAU_E_UE_RAU_REQUEST:
+ /* same RAU, a different RAU would terminate this FSM */
+ break;
+ default:
+ OSMO_ASSERT(0);
+ break;
+ }
+}
+
static void gmm_rau_fsm_s_wait_ue_rau_compl(struct osmo_fsm_inst *fi, uint32_t event, void *data)
{
struct sgsn_mm_ctx *mmctx = gmm_rau_fsm_priv(fi);
@@ -302,10 +356,19 @@
},
[GMM_RAU_S_WAIT_VLR_ANSWER] = {
.in_event_mask = S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
- .out_state_mask = S(GMM_RAU_S_WAIT_UE_RAU_COMPLETE),
+ .out_state_mask = S(GMM_RAU_S_WAIT_GGSN_UPDATE) |
+ S(GMM_RAU_S_WAIT_UE_RAU_COMPLETE),
.name = OSMO_STRINGIFY(GMM_RAU_S_WAIT_VLR_ANSWER),
.action = gmm_rau_fsm_s_wait_vlr,
},
+ [GMM_RAU_S_WAIT_GGSN_UPDATE] = {
+ .in_event_mask = S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_GGSN_UPD_RESP) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
+ .out_state_mask = S(GMM_RAU_S_WAIT_UE_RAU_COMPLETE),
+ .name = OSMO_STRINGIFY(GMM_RAU_S_WAIT_GGSN_UPDATE),
+ .action = gmm_rau_fsm_s_wait_ggsn,
+ .onenter = gmm_rau_fsm_s_wait_ggsn_onenter,
+ },
+ /* FIXME: add PVLR step here as well? */
[GMM_RAU_S_WAIT_UE_RAU_COMPLETE] = {
.in_event_mask = S(GMM_RAU_E_UE_RAU_COMPLETE) | S(GMM_RAU_E_VLR_RAU_REJECT) | S(GMM_RAU_E_VLR_RAU_ACCEPT) | S(GMM_RAU_E_UE_RAU_REQUEST) | S(GMM_RAU_E_VLR_TERM_SUCCESS)| S(GMM_RAU_E_VLR_TERM_FAIL),
.out_state_mask = 0,
diff --git a/src/sgsn/mmctx.c b/src/sgsn/mmctx.c
index f314425..4891826 100644
--- a/src/sgsn/mmctx.c
+++ b/src/sgsn/mmctx.c
@@ -187,6 +187,20 @@
}
+struct sgsn_mm_ctx *sgsn_mm_ctx_by_gtp_local_ref(uint32_t local_ref)
+{
+ struct sgsn_mm_ctx *ctx;
+
+ llist_for_each_entry(ctx, &sgsn->mm_list, list) {
+ if (!ctx->gtp_local_ref_valid)
+ continue;
+
+ if (ctx->gtp_local_ref == local_ref)
+ return ctx;
+ }
+ return NULL;
+}
+
/* Allocate a new SGSN MM context, generic part */
struct sgsn_mm_ctx *sgsn_mm_ctx_alloc(uint32_t rate_ctr_id)
{
diff --git a/src/sgsn/pdpctx.c b/src/sgsn/pdpctx.c
index e779420..e45db95 100644
--- a/src/sgsn/pdpctx.c
+++ b/src/sgsn/pdpctx.c
@@ -33,10 +33,11 @@
#include <osmocom/sgsn/debug.h>
#include <osmocom/sgsn/signal.h>
#include <osmocom/sgsn/gtp_ggsn.h>
-#include <osmocom/sgsn/gprs_llc_xid.h>
-#include <osmocom/sgsn/gprs_sndcp.h>
#include <osmocom/sgsn/gprs_llc.h>
+#include <osmocom/sgsn/gprs_llc_xid.h>
+#include <osmocom/sgsn/gprs_ranap.h>
#include <osmocom/sgsn/gprs_sm.h>
+#include <osmocom/sgsn/gprs_sndcp.h>
#include <osmocom/sgsn/gtp.h>
static const struct rate_ctr_desc pdpctx_ctr_description[] = {
@@ -79,12 +80,39 @@
return NULL;
}
llist_add(&pdp->list, &mm->pdp_list);
- sgsn_ggsn_ctx_add_pdp(pdp->ggsn, pdp);
+ if (pdp->ggsn)
+ sgsn_ggsn_ctx_add_pdp(pdp->ggsn, pdp);
llist_add(&pdp->g_list, &sgsn->pdp_list);
return pdp;
}
+int sgsn_pdp_ctx_gn_update(struct sgsn_pdp_ctx *pctx)
+{
+ int rc = 0;
+
+ if (pctx->state == PDP_STATE_NEED_UPDATE_GSN) {
+ pctx->state = PDP_STATE_CR_CONF;
+ rc = gtp_update_context(pctx->ggsn->gsn, pctx->lib, pctx, &pctx->ggsn->remote_addr);
+ }
+
+ if (pctx->mm->ran_type == MM_CTX_T_GERAN_Gb) {
+ /* Activate the SNDCP layer */
+ sndcp_sm_activate_ind(&pctx->mm->gb.llme->lle[pctx->sapi], pctx->nsapi);
+ } else if (pctx->mm->ran_type == MM_CTX_T_UTRAN_Iu) {
+#ifdef BUILD_IU
+ /* Activate a radio bearer */
+ iu_rab_act_ps(pctx->lib->nsapi, pctx);
+ return 0;
+#else
+ return -ENOTSUP;
+#endif
+ }
+
+
+ return rc;
+}
+
/*
* This function will not trigger any GSM DEACT PDP ACK messages, so you
* probably want to call sgsn_delete_pdp_ctx() instead if the connection
diff --git a/src/sgsn/sgsn_libgtp.c b/src/sgsn/sgsn_libgtp.c
index 4650632..182e898 100644
--- a/src/sgsn/sgsn_libgtp.c
+++ b/src/sgsn/sgsn_libgtp.c
@@ -36,13 +36,23 @@
#include "config.h"
+#include <osmocom/core/byteswap.h>
+#include <osmocom/core/linuxlist.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/crypt/auth.h>
+#include <osmocom/gsm/gsm23003.h>
+#include <osmocom/gsm/gsm48.h>
+
#include <osmocom/core/talloc.h>
#include <osmocom/core/select.h>
#include <osmocom/core/rate_ctr.h>
#include <osmocom/gprs/gprs_bssgp.h>
#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
+#include <osmocom/gtp/gsn.h>
#include <osmocom/gtp/gtp.h>
+#include <osmocom/gtp/gtpie.h>
#include <osmocom/gtp/pdp.h>
#include <osmocom/sgsn/signal.h>
@@ -139,6 +149,91 @@
return imsi64;
}
+/* Import PDP Context which sent to the SGSN via SGSN Context Response */
+struct sgsn_pdp_ctx *sgsn_import_pdp_ctx(
+ struct sgsn_mm_ctx *mmctx,
+ uint16_t sapi,
+ struct pdp_t *pdp)
+{
+ struct sgsn_pdp_ctx *pctx;
+ struct pdp_t *lib_pdp;
+ uint64_t imsi_ui64;
+ int rc;
+ struct sgsn_ggsn_ctx *ggsn = NULL;
+ bool ggsn_created = false;
+ struct osmo_sockaddr addr = {};
+
+ rc = osmo_sockaddr_from_octets(&addr, pdp->gsnrc.v, pdp->gsnrc.l);
+ if (rc < 0 || rc != pdp->gsnrc.l) {
+ LOGP(DGPRS, LOGL_ERROR, "Invalid GSN address\n");
+ return NULL;
+ }
+
+ if (addr.u.sin.sin_family != AF_INET) {
+ LOGP(DGPRS, LOGL_ERROR, "SGSN only supports IPv4 towards GGSN\n");
+ return NULL;
+ }
+
+ ggsn = sgsn_ggsn_ctx_by_addr(sgsn, &addr.u.sin.sin_addr);
+ if (!ggsn) {
+ /* the ares code is also using UINT32_MAX, which results into multiple GGSN have uint max */
+ ggsn = sgsn_ggsn_ctx_alloc(sgsn, UINT32_MAX);
+ if (!ggsn) {
+ LOGP(DGPRS, LOGL_ERROR, "Couldn't allocate GGSN Ctx\n");
+ return NULL;
+ }
+ ggsn_created = true;
+ ggsn->remote_addr = addr.u.sin.sin_addr;
+ }
+
+ /* FIXME: why can this NULL for an via vty configured GGSN? */
+ if (!ggsn->gsn) {
+ ggsn->gsn = sgsn->gsn;
+ }
+
+ pctx = sgsn_pdp_ctx_alloc(mmctx, ggsn, pdp->nsapi);
+ if (!pctx) {
+ LOGP(DGPRS, LOGL_ERROR, "Couldn't allocate PDP Ctx\n");
+ goto out;
+ }
+
+ imsi_ui64 = imsi_str2gtp(mmctx->imsi);
+ rc = gtp_pdp_newpdp(ggsn->gsn, &lib_pdp, imsi_ui64, pdp->nsapi, pdp);
+ if (rc) {
+ LOGP(DGPRS, LOGL_ERROR, "Out of libgtp PDP Contexts\n");
+ return NULL;
+ }
+ pdp->priv = pctx;
+ pctx->nsapi = pdp->nsapi;
+ pctx->sapi = sapi;
+ pctx->lib = lib_pdp;
+ /* FIXME: should the ue pdp active here or not? */
+ pctx->ue_pdp_active = true;
+ pctx->ti = pdp->ti;
+ lib_pdp->priv = pctx;
+
+ /* SGSN address for control plane */
+ lib_pdp->gsnlc.l = sizeof(sgsn->cfg.gtp_listenaddr.sin_addr);
+ memcpy(lib_pdp->gsnlc.v, &sgsn->cfg.gtp_listenaddr.sin_addr,
+ sizeof(sgsn->cfg.gtp_listenaddr.sin_addr));
+
+ /* SGSN address for user plane */
+ lib_pdp->gsnlu.l = sizeof(sgsn->cfg.gtp_listenaddr.sin_addr);
+ memcpy(lib_pdp->gsnlu.v, &sgsn->cfg.gtp_listenaddr.sin_addr,
+ sizeof(sgsn->cfg.gtp_listenaddr.sin_addr));
+
+
+
+ pctx->state = PDP_STATE_NEED_UPDATE_GSN;
+
+ return pctx;
+out:
+ if (ggsn && ggsn_created)
+ sgsn_ggsn_ctx_free(ggsn);
+
+ return NULL;
+}
+
/* generate a PDP context based on the IE's from the 04.08 message,
* and send the GTP create pdp context request to the GGSN */
struct sgsn_pdp_ctx *sgsn_create_pdp_ctx(struct sgsn_ggsn_ctx *ggsn,
@@ -535,6 +630,8 @@
* a Cause value "Non-existent", it shall delete the PDP Context."
*/
if (cause != GTPCAUSE_NON_EXIST) {
+ if (pctx->mm->attach_rau.rau_fsm)
+ osmo_fsm_inst_dispatch(pctx->mm->attach_rau.rau_fsm, GMM_RAU_E_GGSN_UPD_RESP, pctx);
return 0; /* Nothing to do */
}
@@ -542,6 +639,7 @@
"the GGSN anymore, deleting it locally.\n");
rc = gtp_freepdp(pctx->ggsn->gsn, pctx->lib);
+ osmo_fsm_inst_dispatch(pctx->mm->attach_rau.rau_fsm, GMM_RAU_E_GGSN_UPD_RESP, NULL);
/* related mmctx is torn down in cb_delete_context called by gtp_freepdp() */
return rc;
}
@@ -804,6 +902,562 @@
return -EINVAL;
}
+/* TS 29.060: Encode the MM Ctx TLV (7.7.28) of a SGSN Context Response (7.5.4) */
+static int gtp_mm_ctx(uint8_t *buf, unsigned int size, const struct sgsn_mm_ctx *mmctx)
+{
+ uint8_t sec_mode = 0, no_vecs = 0;
+ uint16_t *len_ptr;
+ uint8_t *ptr = buf;
+ uint32_t required_auth_type;
+
+#define CHECK_SPACE_ERR(bytes) \
+ if (ptr - buf + (bytes) > size) { \
+ LOGP(DGPRS, LOGL_ERROR, "Ran out of space encoding mm ctx: %lu, %lu\n", (ptr - buf), (unsigned long) bytes); \
+ return -1; \
+ }
+#define MEMCPY_CHK(dst, src, len) \
+ CHECK_SPACE_ERR((len)) \
+ memcpy((dst), (uint8_t *)(src), (len)); \
+ (dst) += (len);
+
+ // CKSN
+ if (mmctx->ran_type != MM_CTX_T_GERAN_Gb) {
+ LOGP(DGPRS, LOGL_ERROR, "SGSN Context Request: MM ctx doesn't support Iu/3G yet!"); \
+ return -1;
+ }
+
+ // FIXME: KSI/CKSN for Iu?;
+ *ptr++ = 0xf8 | (mmctx->auth_triplet.key_seq & 0x07);
+
+ // Sec Mode | No Vecs | Used Cipher
+ if (mmctx->auth_triplet.vec.auth_types & OSMO_AUTH_TYPE_UMTS) {
+ sec_mode = 0;
+ required_auth_type = OSMO_AUTH_TYPE_UMTS;
+ } else if (mmctx->auth_triplet.vec.auth_types & OSMO_AUTH_TYPE_GSM) {
+ sec_mode = 1;
+ required_auth_type = OSMO_AUTH_TYPE_GSM;
+ } else {
+ return -1;
+ }
+
+ if (mmctx->vsub) {
+ for (int i = 0; i < 5; i++) {
+ const struct vlr_auth_tuple *auth = &mmctx->vsub->auth_tuples[i];
+ if (auth->use_count == 0 && auth->vec.auth_types & required_auth_type)
+ no_vecs++;
+ }
+ }
+
+ *ptr++ = (sec_mode << 6) | (no_vecs << 3) | (mmctx->ciph_algo & 0x7);
+ // Kc or CK/IK
+ switch (sec_mode & 0x01) {
+ case 0:
+ /* UMTS keys */
+ MEMCPY_CHK(ptr, mmctx->auth_triplet.vec.ck, sizeof(mmctx->auth_triplet.vec.ck));
+ MEMCPY_CHK(ptr, mmctx->auth_triplet.vec.ik, sizeof(mmctx->auth_triplet.vec.ik));
+ break;
+ case 1:
+ /* GSM keys */
+ MEMCPY_CHK(ptr, mmctx->auth_triplet.vec.kc, sizeof(mmctx->auth_triplet.vec.kc));
+ }
+
+ /* 7.7.35 Authentication Triplet/Quintuplet */
+ if (mmctx->vsub) {
+ if ((sec_mode & 1) == 1) {
+ /* Triplets */
+ for (int i = 0; i < 5; i++) {
+ const struct vlr_auth_tuple *auth = &mmctx->vsub->auth_tuples[i];
+ if (!(auth->use_count == 0 && auth->vec.auth_types & required_auth_type))
+ continue;
+ MEMCPY_CHK(ptr, auth->vec.rand, sizeof(auth->vec.rand));
+ MEMCPY_CHK(ptr, auth->vec.sres, 4);
+ MEMCPY_CHK(ptr, auth->vec.kc, 8);
+ }
+ } else {
+ /* Quintuplets */
+ CHECK_SPACE_ERR(2);
+ len_ptr = (uint16_t *)ptr; /* size will be filled later */
+ ptr += 2;
+
+ for (int i = 0; i < 5; i++) {
+ const struct vlr_auth_tuple *auth = &mmctx->vsub->auth_tuples[i];
+ if (!(auth->use_count == 0 && auth->vec.auth_types & required_auth_type))
+ continue;
+ MEMCPY_CHK(ptr, auth->vec.rand, sizeof(auth->vec.rand));
+ *ptr++ = auth->vec.res_len;
+ MEMCPY_CHK(ptr, auth->vec.res, (unsigned long) auth->vec.res_len);
+
+ MEMCPY_CHK(ptr, auth->vec.ck, sizeof(auth->vec.ck));
+ MEMCPY_CHK(ptr, auth->vec.ik, sizeof(auth->vec.ik));
+
+ *ptr++ = sizeof(auth->vec.autn);
+ MEMCPY_CHK(ptr, auth->vec.autn, sizeof(auth->vec.autn));
+ }
+ *len_ptr = htobe16(ptr - (((uint8_t *)len_ptr) + 2));
+ }
+ }
+
+
+ // DRX
+ MEMCPY_CHK(ptr, &mmctx->drx_parms, sizeof(mmctx->drx_parms));
+
+ // MS Network Cap Len
+ *ptr++ = mmctx->ms_network_capa.len;
+ // MS Network Cap
+ MEMCPY_CHK(ptr, mmctx->ms_network_capa.buf, (unsigned long) mmctx->ms_network_capa.len);
+
+ // Container Len
+ *ptr++ = 0;
+ *ptr++ = 0;
+ // Container
+ // FIXME: Container
+
+ // Access Restriction Data Len
+ *ptr++ = 0;
+ // FIXME: NRSRA
+
+ return ptr - buf;
+#undef CHECK_SPACE_ERR
+#undef MEMCPY_CHK
+}
+
+#define GSM_MI_TYPE_TLLI 126
+#define RESP_MAX_IES 10
+
+static int cb_gtp_sgsn_context_request_ind(struct gsn_t *gsn, struct sockaddr_in *peer, uint32_t local_ref, union gtpie_member **ie, unsigned int ie_size)
+{
+ struct sgsn_mm_ctx *mmctx = NULL;
+ struct sgsn_pdp_ctx *pdp;
+ struct osmo_mobile_identity mi = {};
+ struct osmo_routing_area_id rai = {};
+ uint8_t raiv[6];
+ uint8_t buf[512];
+ int buf_len;
+
+ char mi_str[40];
+ char rai_str[40];
+ uint64_t imsi;
+ union gtpie_member *resp_ie[GTPIE_SIZE] = {};
+ union gtpie_member resp_ie_elem[RESP_MAX_IES] = {};
+ unsigned resp_it = 0;
+
+ if (gtpie_gettv0(ie, GTPIE_RAI, 0, &raiv, 6)) {
+ //goto missing_ie;
+ return -1;
+ }
+
+ if (osmo_routing_area_id_decode(&rai, raiv, 6) < 0) {
+ rate_ctr_inc2(gsn->ctrg, GSN_CTR_PKT_INVALID);
+ //GTP_LOGPKG(LOGL_ERROR, peer, pack, len,
+ // "Invalid RAI\n");
+ }
+
+ /* parse get the TMSI, IMSI, TMSI_SIG */
+ if (!gtpie_gettv4(ie, GTPIE_P_TMSI, 0, &mi.tmsi)) {
+ mi.type = GSM_MI_TYPE_TMSI;
+ } else if (!gtpie_gettv8(ie, GTPIE_IMSI, 0, &imsi)) {
+ mi.type = GSM_MI_TYPE_IMSI;
+ /* NOTE: gtpie_gettv8 already converts to host byte order, but imsi_gtp2str seems to prefer big endian */
+ imsi = ntoh64(imsi);
+ const char *imsi_str = imsi_gtp2str(&imsi);
+ memcpy(mi.imsi, imsi_str, sizeof(mi.imsi));
+ } else if (!gtpie_gettv4(ie, GTPIE_TLLI, 0, &mi.tmsi)) {
+ mi.type = GSM_MI_TYPE_TLLI;
+ }
+
+ osmo_mobile_identity_to_str_buf(mi_str, sizeof(mi_str), &mi);
+ osmo_rai_name2_buf(rai_str, sizeof(rai_str), &rai);
+
+ /* check if the subscribe is known to us */
+ LOGP(DGPRS, LOGL_NOTICE, "RAI: %s MI: %s\n", rai_str, mi_str);
+ if (mi.type == GSM_MI_TYPE_IMSI)
+ mmctx = sgsn_mm_ctx_by_imsi(mi.imsi);
+ else if (mi.type == GSM_MI_TYPE_TMSI)
+ mmctx = sgsn_mm_ctx_by_ptmsi(mi.tmsi);
+ else if (mi.type == GSM_MI_TYPE_TLLI)
+ mmctx = sgsn_mm_ctx_by_tlli(mi.tmsi, &rai);
+
+ if (!mmctx) {
+ LOGP(DGPRS, LOGL_NOTICE, "No context found\n");
+ return gtp_sgsn_context_resp_error(gsn, local_ref, GTPCAUSE_IMSI_NOT_KNOWN);
+ }
+
+ LOGMMCTXP(LOGL_INFO, mmctx, "Ctx will be transfered to another SGSN/MME\n");
+
+ mmctx->gtp_local_ref = local_ref;
+ mmctx->gtp_local_ref_valid = true;
+
+ /* 7.7.1: Cause Code */
+ resp_ie_elem[resp_it].tv1.t = GTPIE_CAUSE;
+ resp_ie_elem[resp_it].tv1.v = GTPCAUSE_ACC_REQ;
+ resp_ie[GTPIE_CAUSE] = &resp_ie_elem[resp_it];
+ resp_it++;
+
+ /* 7.7.2: IMSI */
+ imsi = imsi_str2gtp(mmctx->imsi);
+ resp_ie_elem[resp_it].tv8.t = GTPIE_IMSI;
+ resp_ie_elem[resp_it].tv8.v = imsi;
+ resp_ie[GTPIE_IMSI] = &resp_ie_elem[resp_it];
+ resp_it++;
+
+ /* 7.7.28: MM Context */
+ buf_len = gtp_mm_ctx(buf, sizeof(buf), mmctx);
+ if (buf_len <= 0)
+ return gtp_sgsn_context_resp_error(gsn, local_ref, GTPCAUSE_SYS_FAIL);
+
+ resp_ie_elem[resp_it].tlv.t = GTPIE_MM_CONTEXT;
+ resp_ie_elem[resp_it].tlv.l = htons(buf_len);
+ memcpy(&resp_ie_elem[resp_it].tlv.v[0], buf, buf_len);
+ resp_ie[GTPIE_MM_CONTEXT] = &resp_ie_elem[resp_it];
+ resp_it++;
+
+ // /* 7.7.99: UE network capability */
+ // resp_ie_elem[resp_it].tlv.t = GTPIE_UE_NET_CAPA;
+ // resp_ie_elem[resp_it].tlv.l = htons(sizeof(mmctx->ms_network_capa.len));
+ // memcpy(&resp_ie_elem[resp_it].tlv.v[0], mmctx->ms_network_capa.buf, mmctx->ms_network_capa.len);
+ // resp_ie[resp_it] = &resp_ie_elem[resp_it];
+ // resp_it++;
+
+ /* 7.7.29: PDP Context */
+ llist_for_each_entry(pdp, &mmctx->pdp_list, list) {
+ // use talloc here?
+ buf_len = gtp_encode_pdp_ctx(buf, sizeof(buf), pdp->lib, pdp->sapi);
+ if (buf_len <= 0) {
+ return gtp_sgsn_context_resp_error(gsn, local_ref, GTPCAUSE_SYS_FAIL);
+ }
+
+ resp_ie_elem[resp_it].tlv.t = GTPIE_PDP_CONTEXT;
+ resp_ie_elem[resp_it].tlv.l = htons(buf_len);
+ resp_ie[GTPIE_PDP_CONTEXT] = &resp_ie_elem[resp_it];
+ memcpy(&resp_ie_elem[resp_it].tlv.v[0], buf, buf_len);
+
+ resp_it++;
+ /* TODO: fix the duplicated PDP Context */
+ break;
+
+ // if (resp_it >= RESP_MAX_IES)
+ // break;
+ }
+
+ return gtp_sgsn_context_resp(gsn, local_ref, resp_ie, GTPIE_SIZE);
+}
+
+#define GTP_SEC_MODE_GSM_TRIPLETS 1
+#define GTP_SEC_MODE_GSM_QUINTLETS 3
+#define GTP_SEC_MODE_UMTS_QUINTLETS 2
+#define GTP_SEC_MODE_CIPHER_UMTS_QUINTLETS 0
+
+/*! validate the length of the quintlets, because of the variable AUTS */
+static int validate_quintlets(uint8_t *buf, unsigned int buf_len)
+{
+ uint8_t xres_len, autn_len;
+ unsigned int i = 0;
+ /* buf = Rand, XRes length, XRes, CK, IK, AUTN length, AUTN */
+
+ /* RAND */
+ i += 16;
+
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ xres_len = buf[i];
+ i++;
+
+ /* XRES */
+ i += xres_len;
+
+ /* CK */
+ i += 16;
+
+ /* IK */
+ i += 16;
+
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ autn_len = buf[i];
+ i++;
+
+ /* AUTN */
+ i += autn_len;
+
+ if (i != buf_len)
+ return -EINVAL;
+
+ return 0;
+}
+
+/*! parse the GTP IE MM Context IE and save it into the local MM Ctx. TS 29.060 7.7.28
+ * @param[inout] mmctx The MM Context to save the GTP values into
+ * @param[in] buf A pointer to the GTP IE value octet 4 TS 29.060 7.7.28
+ * @param[in] buf_len The length of \a buf
+ * @return 0 on success, -ENOMEM when to short, -EINVAL for invalid encoding */
+static int gtp_mmctx_ie_to_mmctx(struct sgsn_mm_ctx *mmctx, uint8_t *buf, unsigned int buf_len)
+{
+ /* octet 4 */
+ uint8_t cksn_more;
+ /* octet 5 */
+ uint8_t sec_mode, no_vec;
+ /* octet 6.. */
+ uint8_t *kc = NULL, *ck = NULL, *ik = NULL;
+ uint8_t *quintlet = NULL;
+ uint16_t quintlet_len = 0;
+
+ uint8_t ms_net_cap_len = 0;
+
+ uint16_t container_len = 0;
+ unsigned int i;
+
+ if (buf_len <= 5)
+ return -ENOMEM;
+
+ /* validate length of mm ctx */
+ cksn_more = buf[0];
+ sec_mode = buf[1] >> 6;
+ no_vec = (buf[1] >> 3) & 0x7;
+ /* unsued: used_cipher = buf[1] & 0x7; */
+ i = 2;
+
+ if (no_vec > 5)
+ return -EINVAL;
+
+ switch (sec_mode) {
+ case GTP_SEC_MODE_GSM_TRIPLETS:
+ /* Kc */
+ kc = &buf[i];
+ i += 8;
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ /* triplet length is: 28 = 16 rand + 4 sres + 8 kc */
+ i += 28 * no_vec;
+ if (buf_len <= i)
+ return -ENOMEM;
+ break;
+ case GTP_SEC_MODE_GSM_QUINTLETS:
+ /* Kc */
+ kc = &buf[i];
+ i += 8;
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ quintlet_len = osmo_load16be(&buf[i]);
+ i += 2;
+ if (quintlet_len) {
+ quintlet = &buf[i];
+ i += quintlet_len;
+ }
+
+ if (buf_len <= i)
+ return -ENOMEM;
+ break;
+ case GTP_SEC_MODE_CIPHER_UMTS_QUINTLETS:
+ case GTP_SEC_MODE_UMTS_QUINTLETS:
+ /* CK, IK */
+ ck = &buf[i];
+ i += 16;
+ ik = &buf[i];
+ i += 16;
+
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ quintlet_len = osmo_load16be(&buf[i]);
+ i += 2;
+ if (quintlet_len) {
+ quintlet = &buf[i];
+ i += quintlet_len;
+ }
+
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ break;
+ }
+
+ /* DRX */
+ i += 2;
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ /* MS Network Capability */
+ ms_net_cap_len = buf[i];
+ i++;
+ i += ms_net_cap_len;
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ /* Container */
+ container_len = osmo_load16be(&buf[i]);
+ i += 2;
+
+ i += container_len;
+ if (buf_len <= i)
+ return -ENOMEM;
+
+ switch (sec_mode) {
+ case GTP_SEC_MODE_GSM_QUINTLETS:
+ case GTP_SEC_MODE_UMTS_QUINTLETS:
+ case GTP_SEC_MODE_CIPHER_UMTS_QUINTLETS:
+ if (validate_quintlets(quintlet, quintlet_len)) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: invalid quintlets length\n");
+ return -EINVAL;
+ }
+ break;
+ case GTP_SEC_MODE_GSM_TRIPLETS:
+ break;
+ }
+
+ /* TODO: parse Length of Access Restriction Data + following field */
+
+ /* Save data into the mmctx */
+ memset(&mmctx->auth_triplet, 0, sizeof(mmctx->auth_triplet));
+ mmctx->auth_triplet.key_seq = cksn_more & 0x7;
+ switch (sec_mode) {
+ case GTP_SEC_MODE_GSM_QUINTLETS:
+ case GTP_SEC_MODE_GSM_TRIPLETS:
+ memcpy(&mmctx->auth_triplet.vec.kc, kc, 8);
+ break;
+ case GTP_SEC_MODE_UMTS_QUINTLETS:
+ case GTP_SEC_MODE_CIPHER_UMTS_QUINTLETS:
+ memcpy(&mmctx->auth_triplet.vec.ck, ck, 16);
+ memcpy(&mmctx->auth_triplet.vec.ik, ik, 16);
+ break;
+ }
+
+ /* TODO: optional: pass triplets + quintlets to the VLR. Currently the SGSN will retrieve new quintlets from the HLR.
+ * This is still fine, but increases the time it takes to switch to 2G, but increases the security. */
+
+ return 0;
+}
+
+static int cb_gtp_sgsn_context_response_ind(struct gsn_t *gsn, struct sockaddr_in *peer, uint32_t local_ref, union gtpie_member **ie, unsigned int ie_size)
+{
+ struct sgsn_mm_ctx *mmctx = NULL;
+ uint64_t imsi;
+ uint8_t buf[512];
+ unsigned int buf_len;
+ uint8_t cause;
+ int rc;
+
+ mmctx = sgsn_mm_ctx_by_gtp_local_ref(local_ref);
+ if (!mmctx) {
+ /* How can we loose the local reference? Most likely only when we release the whole subscriber. */
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_NO_RESOURCES);
+ }
+
+ /* Check cause */
+ if (gtpie_gettv1(ie, GTPIE_CAUSE, 0, &cause)) {
+ mmctx->gtp_local_ref_valid = false;
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory Cause IE not found\n");
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_MAN_IE_MISSING);
+ }
+
+ if (!mmctx->vsub) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory Cause IE not found\n");
+ /* TODO: check if need to inform the other SGSN/MME with a different cause code */
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_MS_NOT_RESP);
+ }
+
+ if (cause != GTPCAUSE_ACC_REQ) {
+ mmctx->gtp_local_ref_valid = false;
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Cause %d\n", cause);
+ vlr_subscr_rx_pvlr_id_nack(mmctx->vsub);
+ /* FIXME: inform FSM */
+ return -1;
+ }
+
+ if (gtpie_gettv8(ie, GTPIE_IMSI, 0, &imsi)) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory IMSI IE not found\n");
+ vlr_subscr_rx_pvlr_id_nack(mmctx->vsub);
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_MAN_IE_MISSING);
+ }
+ imsi = ntoh64(imsi);
+ const char *imsi_str = imsi_gtp2str(&imsi);
+ /* move this into a different function? */
+ strncpy(mmctx->imsi, imsi_str, sizeof(mmctx->imsi));
+ if (mmctx->vsub)
+ vlr_subscr_set_imsi(mmctx->vsub, imsi_str);
+
+ if (gtpie_gettlv(ie, GTPIE_MM_CONTEXT, 0, &buf_len, buf, sizeof(buf))) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory MM context IE not found\n");
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_MAN_IE_MISSING);
+ }
+
+ rc = gtp_mmctx_ie_to_mmctx(mmctx, buf, buf_len);
+ if (rc) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory MM context parsing failed. Ignoring, try to use RAU information\n");
+ }
+
+ rc = gtpie_gettlv(ie, GTPIE_PDP_CONTEXT, 0, &buf_len, buf, sizeof(buf));
+ if (rc) {
+ LOGMMCTXP(LOGL_ERROR, mmctx, "SGSN Context resp: Mandatory PDP context IE not found\n");
+ return gtp_sgsn_context_ack_error(gsn, local_ref, GTPCAUSE_MAN_IE_MISSING);
+ }
+
+ uint16_t sapi;
+ struct pdp_t new_pdp;
+
+ rc = gtp_decode_pdp_ctx(buf, buf_len, &new_pdp, &sapi);
+ if (rc) {
+ /* Ignore the failure and continue to work without taken the PDP context over.
+ * This way we communicate an Ack towards the SGSN/MME. The remote is responsible to close the PDP context not
+ * mentioned in the ack */
+ }
+
+ /* we save the pdps into the mmctx and inform the GGSN after we authenticated the client */
+ struct sgsn_pdp_ctx *pctx = sgsn_import_pdp_ctx(mmctx, sapi, &new_pdp);
+ if (!pctx) {
+ /* Ignore the failure and continue to work without taken the PDP context over.
+ * This way we communicate an Ack towards the SGSN/MME. The remote is responsible to close the PDP context not
+ * mentioned in the ack */
+ }
+
+ vlr_subscr_rx_pvlr_id_ack(mmctx->vsub);
+
+ return 0;
+}
+
+int sgsn_context_ack(struct gsn_t *gsn, struct sgsn_mm_ctx *mmctx, uint8_t cause)
+{
+ int rc;
+
+ if (!mmctx->gtp_local_ref_valid)
+ return -EINVAL;
+
+ if (!mmctx->gtp_local_ref)
+ return -EINVAL;
+
+ rc = gtp_sgsn_context_ack_error(gsn, mmctx->gtp_local_ref, cause);
+ mmctx->gtp_local_ref_valid = false;
+
+ return rc;
+}
+
+static int cb_gtp_sgsn_context_ack_ind(struct gsn_t *gsn, struct sockaddr_in *peer, uint32_t local_ref, union gtpie_member **ie, unsigned int ie_size)
+{
+ /* The remote peer has verified/established a connection to the UE,
+ * Release local GGSN connection */
+
+ struct sgsn_mm_ctx *mmctx = NULL;
+ struct sgsn_pdp_ctx *pdp, *pdp2;
+
+ mmctx = sgsn_mm_ctx_by_gtp_local_ref(local_ref);
+ if (!mmctx) {
+ /* Can't do anything here. The Ack is the last message anyway. */
+ return 0;
+ }
+ mmctx->gtp_local_ref_valid = false;
+ /* FIXME: drop HLR relation? */
+ /* FIXME: drop local VLR relation? */
+ /* FIXME: Parse Tunnel Endpoint Identifier Data II IE */
+ llist_for_each_entry_safe(pdp, pdp2, &mmctx->pdp_list, list) {
+ sgsn_pdp_ctx_free(pdp);
+ }
+
+ return 0;
+}
+
/* Called whenever we receive a DATA packet */
static int cb_data_ind(struct pdp_t *lib, void *packet, unsigned int len)
{
@@ -896,6 +1550,7 @@
pdp->nsapi, mm);
}
+
/* Called by SNDCP when it has received/re-assembled a N-PDU */
int sgsn_gtp_data_req(struct osmo_routing_area_id *ra_id, int32_t tlli, uint8_t nsapi,
struct msgb *msg, uint32_t npdu_len, uint8_t *npdu)
@@ -1006,6 +1661,9 @@
gtp_set_cb_unsup_ind(gsn, cb_unsup_ind);
gtp_set_cb_extheader_ind(gsn, cb_extheader_ind);
gtp_set_cb_ran_info_relay_ind(gsn, cb_gtp_ran_info_relay_ind);
+ gtp_set_cb_sgsn_context_request_ind(gsn, cb_gtp_sgsn_context_request_ind);
+ gtp_set_cb_sgsn_context_response_ind(gsn, cb_gtp_sgsn_context_response_ind);
+ gtp_set_cb_sgsn_context_ack_ind(gsn, cb_gtp_sgsn_context_ack_ind);
return 0;
}
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39563?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: Iffe83b31db2b6e6869fedf2351375184096cff6f
Gerrit-Change-Number: 39563
Gerrit-PatchSet: 1
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
1
0
16 Feb '25
Attention is currently required from: lynxis lazus, pespin.
laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-iuh/+/38947?usp=email )
Change subject: iu_client: add a new event NEW_AREA
......................................................................
Patch Set 10: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/38947?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-iuh
Gerrit-Branch: master
Gerrit-Change-Id: I8b1b8c58bf72b00e2705ca87a89a91481bac3470
Gerrit-Change-Number: 38947
Gerrit-PatchSet: 10
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Sun, 16 Feb 2025 21:04:30 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
1
0
16 Feb '25
Attention is currently required from: lynxis lazus.
laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39425?usp=email )
Change subject: GMM: implement IMEI SV on auth/ciph response
......................................................................
Patch Set 2: Code-Review+1
(1 comment)
File src/sgsn/gprs_gmm.c:
https://gerrit.osmocom.org/c/osmo-sgsn/+/39425/comment/6ce1e9ee_80ed2a47?us… :
PS2, Line 683: has broken
super minor cosmetic spelling: phones (plural) ... have.
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39425?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: Ia8b428967a4ce3132a4a63ae10fe610de81c3a29
Gerrit-Change-Number: 39425
Gerrit-PatchSet: 2
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Sun, 16 Feb 2025 21:03:37 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
1
0
16 Feb '25
Attention is currently required from: fixeria, lynxis lazus.
laforge has posted comments on this change by lynxis lazus. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/39294?usp=email )
Change subject: Assign MME GroupId/Code to remote MMEs
......................................................................
Patch Set 3: Code-Review+1
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/39294?usp=email
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email
Gerrit-MessageType: comment
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I881aeba904fb6ca815842d36e466a2459ad81913
Gerrit-Change-Number: 39294
Gerrit-PatchSet: 3
Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-CC: pespin <pespin(a)sysmocom.de>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu>
Gerrit-Comment-Date: Sun, 16 Feb 2025 21:02:33 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
1
0