This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The OpenBSC GSM Base Station Controller (+MSC/HLR/SGSN)".

The branch, master has been updated via 8ee53ed9ec5e5f045778ab8b30f10cb86ec55c4a (commit) via 694d98042f1adfad0e54f97d0e4c8787c5fccbac (commit) via e2ac6b77feecc5b7194a308bbd11e206c4a41fcb (commit) via 9705671025eba34b70d73e9d4e78813e4f2d31da (commit) via fce6971fe3673e8269414188fda0ce3b28b5cf03 (commit) via 8a8df80772a4bac0f3cb4d384f45a5d4c463fe11 (commit) via 0363d1bb97663e83aa0dc3a1e6b425b1870dd271 (commit) via aa0cecd9b7986254983af6b6cbef291183709ca0 (commit) via 2dd18bdd87a130a3536b12af874e331d93593e9b (commit) from 57ee78078905c7499bd4e6857f8981d22badfcac (commit)

Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below.

- Log ----------------------------------------------------------------- http://cgit.osmocom.org/openbsc/commit/?id=8ee53ed9ec5e5f045778ab8b30f10cb86...

commit 8ee53ed9ec5e5f045778ab8b30f10cb86ec55c4a Merge: 57ee780 694d980 Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Wed Jul 1 08:19:51 2015 +0200

Merge branch 'zecke/features/auth'

Introduce another authentication scheme using MILENAGE. In the future reading from /dev/urandom will be replaced with libcrypto.

http://cgit.osmocom.org/openbsc/commit/?id=694d98042f1adfad0e54f97d0e4c8787c...

commit 694d98042f1adfad0e54f97d0e4c8787c5fccbac Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 18:33:28 2015 +0200

nat: After we identified the bsc check the key

We are using the token to find the right bsc_config and then we can use the last_rand of the bsc_connection to calculate the expected result and try to compare it with a time constant(???) memcmp.

http://cgit.osmocom.org/openbsc/commit/?id=e2ac6b77feecc5b7194a308bbd11e206c...

commit e2ac6b77feecc5b7194a308bbd11e206c4a41fcb Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 18:02:10 2015 +0200

bsc: Check for the rand and then generate a res

Check if the NAT has sent 16 bytes of RAND and if a key has been configured in the system and then generate a result using milenage. The milenage res will be sent and noth the four byte GSM SRES derivation.

http://cgit.osmocom.org/openbsc/commit/?id=9705671025eba34b70d73e9d4e78813e4...

commit 9705671025eba34b70d73e9d4e78813e4f2d31da Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 16:28:15 2015 +0200

nat: Send 16 bytes of rand to the BSC and remember it

Generate 16 byte of random data to be used for A3A8 by the BSC in the response. We can't know which BSC it is at this point and I don't want to send another message once the token has been received so always send the data with an undefined code. The old BSCs don't parse the message and will happily ignore the RAND.

/dev/urandom can give short reads on Linux so loop around it until the bytes have been read from the kernel.

http://cgit.osmocom.org/openbsc/commit/?id=fce6971fe3673e8269414188fda0ce3b2...

commit fce6971fe3673e8269414188fda0ce3b28b5cf03 Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 11:56:59 2015 +0200

nat: Provide access to /dev/urandom for the code

Instead of doing open/read/close all the time, open the FD in the beginning and keep it open. To scare me even more I have seen /dev/urandom actually providing a short read and then blocking but it seems to be the best way to get the random byes we need for authentication.

So one should/could run the cheap random generator on the system (e.g. haveged) or deal with the NAT process to block.

http://cgit.osmocom.org/openbsc/commit/?id=8a8df80772a4bac0f3cb4d384f45a5d4c...

commit 8a8df80772a4bac0f3cb4d384f45a5d4c463fe11 Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Wed Jun 10 11:51:16 2015 +0200

bsc/nat: Fix the structure of the identity request message

Unfortunately the basic structure of the response is broken. There is a two byte length followed by data. The concept of a 'tag' happens to be the first byte of the data.

This means we want to write strlen of the token, then we want to write the NUL and then we need to account for the tag in front.

Introduce a flag if the new or old format should be used. This will allow to have new BSCs talk to old NATs without an additional change. In the long run we can clean that up.

http://cgit.osmocom.org/openbsc/commit/?id=0363d1bb97663e83aa0dc3a1e6b425b18...

commit 0363d1bb97663e83aa0dc3a1e6b425b1870dd271 Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 11:55:02 2015 +0200

nat: Close the connection after we couldn't find the user

In case the token was not correct, just close the connection. It is not clear that forcing a new TCP connection is going to give us any extra security here. But with the upcoming auth handling it does make sense to have both case look similar.

http://cgit.osmocom.org/openbsc/commit/?id=aa0cecd9b7986254983af6b6cbef29118...

commit aa0cecd9b7986254983af6b6cbef291183709ca0 Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 09:54:45 2015 +0200

nat: Factor out the config by token search

In the upcoming authentication improvements it is nice to separate the finding of the config from the post-allow handling of it.

http://cgit.osmocom.org/openbsc/commit/?id=2dd18bdd87a130a3536b12af874e331d9...

commit 2dd18bdd87a130a3536b12af874e331d93593e9b Author: Holger Hans Peter Freyther holger@moiji-mobile.com Date: Mon Jun 8 18:31:02 2015 +0200

nat: Add size check for the payload

The msgb will always have these bytes but it is better practice to verify that the message really has space for the two bytes.

-----------------------------------------------------------------------

Summary of changes: openbsc/include/openbsc/bsc_msc.h | 2 +- openbsc/include/openbsc/bsc_nat.h | 7 ++ openbsc/include/openbsc/osmo_msc_data.h | 3 + openbsc/src/libbsc/bsc_msc.c | 22 ++++- openbsc/src/osmo-bsc/osmo_bsc_msc.c | 58 +++++++++++- openbsc/src/osmo-bsc/osmo_bsc_vty.c | 29 ++++++ openbsc/src/osmo-bsc_nat/bsc_nat.c | 156 +++++++++++++++++++++++++------ openbsc/src/osmo-bsc_nat/bsc_nat_utils.c | 18 ++++ openbsc/src/osmo-bsc_nat/bsc_nat_vty.c | 32 ++++++- 9 files changed, 291 insertions(+), 36 deletions(-)

hooks/post-receive