this patch will correct some callref behavior.
if a message with an unknown callref is received, a release is sent to
the other layer.
if a release with an unknown callref is received, it is ignored.
no message is sent, if the callref is already gone.
diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c
index d6e161a..3f12546 100644
--- a/openbsc/src/gsm_04_08.c
+++ b/openbsc/src/gsm_04_08.c
@@ -1705,6 +1705,10 @@ static int mncc_recvmsg(struct gsm_network *net,
struct gsm_trans *trans,
{
struct msgb *msg;
+ /* don't send message, if call is not associated anymore */
+ if (!mncc->callref)
+ return 0;
+
if (trans)
if (trans->lchan)
DEBUGP(DCC, "(bts %d trx %d ts %d ti %x sub %s)
"
@@ -3242,10 +3246,12 @@ int mncc_send(struct gsm_network *net, int
msg_type, void *arg)
if (!trans) {
struct gsm_subscriber *subscr;
+ if (msg_type == MNCC_REL_REQ)
+ return 0; /* drop */
if (msg_type != MNCC_SETUP_REQ) {
DEBUGP(DCC, "(bts - trx - ts - ti -- sub %s) "
"Received '%s' from MNCC with "
- "unknown callref %d\n",
data->called.number,
+ "unknown callref %x\n",
data->called.number,
get_mncc_name(msg_type), data->callref);
/* Invalid call reference */
return mncc_release_ind(net, NULL,
data->callref,
diff --git a/openbsc/src/mncc.c b/openbsc/src/mncc.c
index f62541c..1874750 100644
--- a/openbsc/src/mncc.c
+++ b/openbsc/src/mncc.c
@@ -301,8 +301,20 @@ int mncc_recv(struct gsm_network *net, int
msg_type, void *arg)
/* create callref, if setup is received */
if (!call) {
- if (msg_type != MNCC_SETUP_IND)
+ if (msg_type == MNCC_REL_IND)
return 0; /* drop */
+ if (msg_type != MNCC_SETUP_IND) {
+ struct gsm_mncc rel;
+
+ DEBUGP(DMNCC, "(call %x) Rejecting message %s
with unknown ref.\n",
+ callref, get_mncc_name(msg_type));
+ memset(&rel, 0, sizeof(struct gsm_mncc));
+ rel.callref = callref;
+ mncc_set_cause(&rel, GSM48_CAUSE_LOC_PRN_S_LU,
+ GSM48_CC_CAUSE_INVAL_TRANS_ID);
+ mncc_send(net, MNCC_REL_REQ, &rel);
+ return 0;
+ }
/* create call */
if (!(call = talloc_zero(tall_call_ctx, struct
gsm_call))) {
struct gsm_mncc rel;