This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The OpenBSC GSM Base Station Controller (+MSC/HLR/SGSN)". The branch, jerlbeck/wip/gprs-patching has been updated discards 320360e2a5f79585c86b5b4260c8266b3ee18d31 (commit) discards bfe6df93178cc46c317edb4aa53cd5643a30896b (commit) discards 2d193dc608e8cd15482ca477f04fa24762136707 (commit) discards a1f9bd765cda631ddcd7c0f6700b6ad013f5c31a (commit) discards 3edce24bbad14d2c205678df1373e23d639eaf65 (commit) discards d63d2bbe52d4cd789559cd18fa4d01548b8a6e3f (commit) discards 642884c2d5e9563b108a4c75e44174941bdc405f (commit) discards 6b9660f3d8e480f3fd245a1c449f1f65e0a95c99 (commit) discards 645c3beddb25f94ef4172a112645df07613a75ff (commit) discards ed7938ffd98223b708c1e03b8501e4e42821bc41 (commit) discards f00eb01918336841a2ff6ee42f58c9da70ae5794 (commit) discards 3490aaa13707d9455093cc208a227cdc578bd259 (commit) discards 228463cbbfdfc4ea25f16a24cafebaebbe94a2c5 (commit) discards 88090b017cc3b21ec1c8a3a4dfce603b7179b14f (commit) discards 885f30b7491332f83a6fee9ea68347e355f7e5bc (commit) discards 055477327eee5077628c0f6d08d79ec8f7a075c1 (commit) discards 597027dec1f1d40c0060f522c4aa21c1c8c41504 (commit) discards 2697b17b2a2a8911380f84bb2023178a417e4657 (commit) discards e09e74115dcc16dd65d3c24b12ba8ab81ea43a6d (commit) discards 0f3a27a5838097f1c919f25a6fe96dea408ee7fa (commit) discards 6b28501dd45819354f76861e3920b9de72a9db95 (commit) via 798f3c247984a53ab8e5c68beff106b45a40b7ae (commit) via 41bfd4bc8731b7f6ce16f4b4097afb29b92e20bb (commit) via fab825a4637c1210187f05a93392be7072a87575 (commit) via f9947e70d3a0f6bc70a9d9767b988ceb15fa6266 (commit) via 9e80019b7c3389843ba2020c3ae0e64e6d83e8c9 (commit) via ec75ba6ffa901c81ab936f95a8b887fe2174019b (commit) via e444e3bb8a48bf751cb9286d80ddcdf7b101011b (commit) via c16741bf78ba1ac4586cefbff0f4c2508a2d8fed (commit) via 825eae2fa138e92d98d3b0d58cbf7c807c1ea491 (commit) via 194943609b16f88539edadd11a15d56080d06b29 (commit) via e2c08577a8c0ceae7c2c6f82c328d04d9086175c (commit) via b1751e0b0cb2b153d98d951fb46745d24d06b53d (commit) via b44a1895051b222c1aa0d1f1bce268a84a8c6116 (commit) via fd0b34a3fa0485eef7a8b7745d452ac7904a8111 (commit) via 7f416f4799814d179b5cbf9c272b8df45e646754 (commit) via b62b4af85781e2e17b4cee35ac129451bb8036b7 (commit) via f462d2ebbc68c36a511ae9ab7088e5ae0bd1dec1 (commit) via 843caa4a7f2a0d27378fe97f405c65b5899c61ca (commit) via d6964dc0113acd2ccc9b792d846dbd7e7aa24a14 (commit) via 9d0fb1e97adbf5d241b46d374c2aa9c3af6c1e6b (commit) via de74e721b213c41a3b1837fabdd377deeeed9378 (commit) via 14ae58206406b6cb78113f3460de44376bcd765d (commit) via 70671421007faa0e7c94d237e53186379990e3f0 (commit) This update added new revisions after undoing existing revisions. That is to say, the old revision is not a strict subset of the new revision. This situation occurs when you --force push a change and generate a repository containing something like this: * -- * -- B -- O -- O -- O (320360e2a5f79585c86b5b4260c8266b3ee18d31) \ N -- N -- N (798f3c247984a53ab8e5c68beff106b45a40b7ae) When this happens we assume that you've already had alert emails for all of the O revisions, and so we here report only the revisions in the N branch from the common base, B. Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- http://cgit.osmocom.org/openbsc/commit/?id=798f3c247984a53ab8e5c68beff106b4… commit 798f3c247984a53ab8e5c68beff106b45a40b7ae Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Thu Nov 6 15:43:10 2014 +0100 sgsn: Don't assign a new P-TMSI if one is pending (TODO) Currently every time a RA Update Req or an Attach Req is processed, a new P-TMSI is alocated. When an MS issues another of these messages before it has completed the first procedure, old_ptmsi is replaced by ptmsi (and thus lost) and ptmsi is replaced by the newly allocated P-TMSI. This can confuse the gbproxy, which can loose track of the logical link then. At least a blackberry emits a double set of RA Upd Req messages from time to time which may be just 20ms apart. This patch adds a check whether mm->ptmsi or mm->old_ptmsi are not both set. If both are set, the P-TMSI is not re-allocated. This is only the case, if the Complete message has not been received since that resets old_ptmsi. TODO: - Test case Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=41bfd4bc8731b7f6ce16f4b4097afb29… commit 41bfd4bc8731b7f6ce16f4b4097afb29b92e20bb Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Thu Nov 6 13:43:41 2014 +0100 sgsn: Cleanup after RA Update Reject (TODO) Currently, the LLME is not cleanup up after sending an RA Update Reject. This happens after entering a routing area from outside, since in that case the SGSN sends an RA Update Reject (implicitly detached) which causes the MS to restart the attach procedure. This patch changes gsm48_rx_gmm_ra_upd_req to unassign the LLME or free the MM context (if available) after a Reject message has been sent. TODO: - test cases Ticket: OW#1324 Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=fab825a4637c1210187f05a93392be70… commit fab825a4637c1210187f05a93392be7072a87575 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Sep 30 13:53:26 2014 +0200 sgsn: Added TODOs (TODO) TODO: - fix and remove TODOs - add test cases for Detach(reattach) - add test cases for PDP context deletion (OW#1311) - add test cases for Cancel pending timer in sgsn_mm_ctx_free - remove this commit Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=f9947e70d3a0f6bc70a9d9767b988ceb… commit f9947e70d3a0f6bc70a9d9767b988ceb15fa6266 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Fri Oct 17 10:08:02 2014 +0200 sgsn: Do not die in _bssgp_tx_dl_ud on TLLI mismatch (TODO) Currently an OSMO_ASSERT fails, if the message's and the mmctx's TLLIs do not match. This commit turns the assertion into an ERROR log message and uses the default values for IMSI, DRX, and RA CAP instead of the MM context values in this case. TODO: - find the real source for the problem - add test cases derived from what is being described in the ticket Ticket: OW#1322 Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=9e80019b7c3389843ba2020c3ae0e64e… commit 9e80019b7c3389843ba2020c3ae0e64e6d83e8c9 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Nov 4 12:44:15 2014 +0100 sgsn: Notify an affected MM context if an ACL rule is removed Currently if an ACL access rule is removed, MS already attached are not affected until they try to reattach to the SGSN. This patch extends sgsn_acl_del to re-authenticate an MM context if it matches the IMSI. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=ec75ba6ffa901c81ab936f95a8b887fe… commit ec75ba6ffa901c81ab936f95a8b887fe2174019b Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Nov 4 10:08:37 2014 +0100 sgsn: Add 'acl-only' authentication policy Currently the VTY 'auth-policy' command results in setting or clearing the acl_enabled flag. This also enables the matching of the MCC/MNC prefix of the IMSI. This patch adds an additional policy 'acl-only' which disables the MCC/MNC matching and relies on the ACL only. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=e444e3bb8a48bf751cb9286d80ddcdf7… commit e444e3bb8a48bf751cb9286d80ddcdf7b101011b Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Nov 4 11:15:01 2014 +0100 sgsn/test: Add VTY tests for the SGSN This patch adds some basic SGSN tests to vty_test_runner.py: - check for config tree nodes - check specific show commands Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=c16741bf78ba1ac4586cefbff0f4c250… commit c16741bf78ba1ac4586cefbff0f4c2508a2d8fed Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Fri Oct 24 18:09:54 2014 +0200 sgsn: Make authorization asynchronous Currently the authorization of an IMSI is done by checking ACLs synchronously which is not feasible when the subscriber data has to be retrieved from an external source. This patch changes this by using a callback when the information is available. This is also done when only ACL are checked, in this case the callback is invoked from within sgsn_auth_request(). The callback function sgsn_update_subscriber_data calls sgsn_auth_update which in turn calls either gsm0408_gprs_access_granted or gsm0408_gprs_access_denied. gsm48_gmm_authorize is extended by a call to sgsn_auth_request when IMSI and IMEI are available but the auth_state is unknown. The change has been successfully tested with single phones (E71 and IPhone 5c). Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=825eae2fa138e92d98d3b0d58cbf7c80… commit 825eae2fa138e92d98d3b0d58cbf7c807c1ea491 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Mon Nov 3 12:48:43 2014 +0100 bsc: Fix use-after-free on OML NM messages from the BTS Currently the sign_link pointer is dereferenced after a call to osmo_signal_dispatch, which can indirectly call e1inp_sign_link_destroy. If that happens, accessing *sign_link is illegal and can lead to a segmentation violation. Since only the bts pointer is needed from sign_link after the call to osmo_signal_dispatch, this patch changes abis_nm_rcvmsg_fom to save that pointer to a local variable earlier. Addresses: <0019> input/ipa.c:250 accept()ed new link from 192.168.1.101 to port 3002 SET ATTR NACK CAUSE=Message cannot be performed <0005> bsc_init.c:52 Got a NACK going to drop the OML links. <001b> bsc_init.c:319 Lost some E1 TEI link: 1 0xb351a830 ================================================================= ==13198== ERROR: AddressSanitizer: heap-use-after-free on address 0xb5d1bc70 at pc 0x80a6e3d bp 0xbfbb33d8 sp 0xbfbb33cc Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=194943609b16f88539edadd11a15d560… commit 194943609b16f88539edadd11a15d56080d06b29 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Wed Oct 29 22:12:20 2014 +0100 sgsn: Move IMSI authorization to gsm48_gmm_authorize Currently the IMSI is only checked immediately when an Attach Request is received that contains an IMSI IE. If it contains a P-TMSI instead, access is always granted. This commit moves the IMSI check to gsm48_gmm_authorize where it is applied when IMSI and IMEI have been acquired. This fixes the authorization when the Attach Accept doesn't contain an IMSI. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=e2c08577a8c0ceae7c2c6f82c328d04d… commit e2c08577a8c0ceae7c2c6f82c328d04d9086175c Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Fri Oct 31 12:27:11 2014 +0100 sgsn: Fix LLME leak when forcing a reattach Currently when forceing a reattach by sending a Detach Request (reattach), the SGSN waits for the Detach Accept until it frees the MM context (if present) and the LLME. If that message gets lost or isn't sent by the MS, the LLME is never freed if it isn't bound to an MM context. This patch adds code to free the MM context/LLME when forcing a reattachment. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=b1751e0b0cb2b153d98d951fb46745d2… commit b1751e0b0cb2b153d98d951fb46745d24d06b53d Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Fri Oct 31 12:20:49 2014 +0100 sgsn: Split gsm0408_gprs_force_reattach into 2 functions This patch replaces gsm0408_gprs_force_reattach(msg, mmctx) by two functions - gsm0408_gprs_force_reattach(mmctx) - gsm0408_gprs_force_reattach_oldmsg(msg) The old function basically consists of the code of the two new functions, where the code patch selected depends on mmctx == NULL, which is harder to maintain, less obvious to use, and not consistent with many other SGSN functions. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=b44a1895051b222c1aa0d1f1bce268a8… commit b44a1895051b222c1aa0d1f1bce268a84a8c6116 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Mon Nov 3 10:12:52 2014 +0100 sgsn: Call mm_ctx_cleanup_free to deregister MM context Currently the MM context isn't always removed when it is de-registered (mmctx_timer_cb), mm_state is set to GMM_DEREGISTERED instead. This can lead to left-over MM contexts which are only cleaned up if the MS reattaches. This patch replaces all of these assignments by a call to mm_ctx_cleanup_free. Ticket: OW#1324 Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=fd0b34a3fa0485eef7a8b7745d452ac7… commit fd0b34a3fa0485eef7a8b7745d452ac7904a8111 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Oct 28 16:23:46 2014 +0100 sgsn: Cleanup GMM state transitions Currently the GMM state is set to GMM-REGISTERED when an Attach Accept or a RA Update Accept message is sent, even if a new P-TMSI is included. In this case 04.08 requires (see 4.7.3.1.3 and 4.7.5.1.3), that the state is set to GMM-COMMON-PROCEDURE-INITIATED when the Accept is sent. When the Complete is received, the SGSN shall set the state to GMM-REGISTERED. This patch modifies the state updates accordingly. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=7f416f4799814d179b5cbf9c272b8df4… commit 7f416f4799814d179b5cbf9c272b8df45e646754 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Wed Oct 29 12:11:58 2014 +0100 sgsn/test: Add test_gmm_attach This test checks the attach procedure until the Attach Complete is received. Note that authorization and GMM state updates are not working properly yet. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=b62b4af85781e2e17b4cee35ac129451… commit b62b4af85781e2e17b4cee35ac129451bb8036b7 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Wed Oct 29 10:31:18 2014 +0100 sgsn/test: Move message sending to send_0408_message This replaces serveral occurences of duplicated code for message creation and sending (passing to gsm0408_gprs_rcvmsg) into a single function. In addition, the sgsn_tx_counter is always reset within send_0408_message to simplify the code that checks for the number of messages sent. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=f462d2ebbc68c36a511ae9ab7088e5ae… commit f462d2ebbc68c36a511ae9ab7088e5ae0bd1dec1 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Tue Oct 28 12:23:29 2014 +0100 sgsn: Reorganize and fix gsm48_gmm_authorize Currently the order of the 'if' clauses in gsm48_gmm_authorize doesn't match the order in which the conditional parts are entered. This makes it difficult to maintain. In addition the t3350_mode is not stored in every path, so that this information is lost when the identification procedure is started. Since the default value coincidentally is GMM_T3350_MODE_ATT, this doesn't hurt for Attach Requests which are the only messages that initially trigger the authentication yet. This patch changes the order of the 'if' clause to match the processing order, it removes the t3350_mode parameter entirely and introduces a mm->pending_req field. The latter must be set when the request that causes the authorization before calling gsm48_gmm_authorize. The gprs_t3350_mode enum is extended by GMM_T3350_MODE_NONE (value 0, which is the default) to make it possible to detect related initialisation errors or race conditions. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=843caa4a7f2a0d27378fe97f405c65b5… commit 843caa4a7f2a0d27378fe97f405c65b5899c61ca Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Fri Oct 31 10:47:29 2014 +0100 gbproxy: Honour the BSS TLLI type when creating an SGSN TLLI Currently gbproxy_make_sgsn_tlli always returns a foreign TLLI when it uses the (SGSN) P-TMSI to generate one. This patch changes the implementation to return a SGSN TLLI of the same type like the BSS TLLI in that case. Sponsored-by: On-Waves ehf http://cgit.osmocom.org/openbsc/commit/?id=d6964dc0113acd2ccc9b792d846dbd7e… commit d6964dc0113acd2ccc9b792d846dbd7e7aa24a14 Author: Jacob Erlbeck &lt;jerlbeck(a)sysmocom.de&gt; Date: Thu Oct 30 17:15:43 2014 +0100 gbproxy: Reset TLLIs when the link_info is found by IMSI/P-TMSI Currently when the MS does a re-attach without doing a proper detach first, the gbproxy uses the old local TLLI if patching and the keep mode are enabled. This leads to a failing attachment procedure when TLLI patching is also enabled. This patch changes gbproxy_get_link_info_ul to reset all TLLIs within the link_info if the message contains an unknown TLLI and an MI. This is generally the case with Attach Request messages. Ticket: OW#1324 Sponsored-by: On-Waves ehf ----------------------------------------------------------------------- Summary of changes: openbsc/src/gprs/gprs_gmm.c | 38 +++++++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 7 deletions(-) hooks/post-receive -- The OpenBSC GSM Base Station Controller (+MSC/HLR/SGSN)