nat: Check the authentication bit later...
When moving it up here the code started to reject
the identity responses of the bsc and we would
never authenticate. Move it back down.
diff --git a/openbsc/src/nat/bsc_nat.c b/openbsc/src/nat/bsc_nat.c
index e8a6b19..2ca28cc 100644
--- a/openbsc/src/nat/bsc_nat.c
+++ b/openbsc/src/nat/bsc_nat.c
@@ -385,12 +385,6 @@
struct sccp_connections *con;
struct bsc_nat_parsed *parsed;
- if (!bsc->authenticated) {
- LOGP(DNAT, LOGL_ERROR, "BSC is not authenticated.\n");
- msgb_free(msg);
- return -1;
- }
-
/* Parse and filter messages */
parsed = bsc_nat_parse(msg);
if (!parsed) {
@@ -402,6 +396,18 @@
if (bsc_nat_filter_ipa(DIR_MSC, msg, parsed))
goto exit;
+ /*
+ * check authentication after filtering to not reject auth
+ * responses coming from the BSC. We have to make sure that
+ * nothing from the exit path will forward things to the MSC
+ */
+ if (!bsc->authenticated) {
+ LOGP(DNAT, LOGL_ERROR, "BSC is not authenticated.\n");
+ msgb_free(msg);
+ return -1;
+ }
+
+
/* modify the SCCP entries */
if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
switch (parsed->sccp_type) {