| /* GSM Mobile Radio Interface Layer 3 messages on the A-bis interface |
| * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */ |
| |
| /* (C) 2008-2016 by Harald Welte <laforge@gnumonks.org> |
| * (C) 2008-2012 by Holger Hans Peter Freyther <zecke@selfish.org> |
| * |
| * All Rights Reserved |
| * |
| * This program is free software; you can redistribute it and/or modify |
| * it under the terms of the GNU Affero General Public License as published by |
| * the Free Software Foundation; either version 3 of the License, or |
| * (at your option) any later version. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU Affero General Public License for more details. |
| * |
| * You should have received a copy of the GNU Affero General Public License |
| * along with this program. If not, see <http://www.gnu.org/licenses/>. |
| * |
| */ |
| |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <stdbool.h> |
| #include <errno.h> |
| #include <time.h> |
| #include <netinet/in.h> |
| #include <sys/types.h> |
| |
| #include "config.h" |
| |
| #include <osmocom/msc/debug.h> |
| #include <osmocom/msc/gsm_data.h> |
| #include <osmocom/msc/gsm_04_08.h> |
| #include <osmocom/msc/signal.h> |
| #include <osmocom/msc/transaction.h> |
| #include <osmocom/msc/vlr.h> |
| #include <osmocom/msc/msc_a.h> |
| |
| #include <osmocom/gsm/gsm48.h> |
| #include <osmocom/gsm/gsm_utils.h> |
| #include <osmocom/gsm/protocol/gsm_04_08.h> |
| #include <osmocom/core/msgb.h> |
| #include <osmocom/core/talloc.h> |
| #include <osmocom/core/utils.h> |
| #include <osmocom/core/byteswap.h> |
| #include <osmocom/gsm/tlv.h> |
| #include <osmocom/crypt/auth.h> |
| |
| #include <osmocom/msc/msub.h> |
| #include <osmocom/msc/msc_roles.h> |
| |
| #include <assert.h> |
| |
| |
| void *tall_locop_ctx; |
| void *tall_authciphop_ctx; |
| |
| static int gsm0408_loc_upd_acc(struct msc_a *msc_a, uint32_t send_tmsi); |
| |
| /*! Send a simple GSM 04.08 message without any payload |
| * \param conn Active RAN connection |
| * \param[in] pdisc Protocol discriminator |
| * \param[in] msg_type Message type |
| * \return result of \ref gsm48_conn_sendmsg |
| */ |
| int gsm48_tx_simple(struct msc_a *msc_a, uint8_t pdisc, uint8_t msg_type) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 TX SIMPLE"); |
| struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| |
| gh->proto_discr = pdisc; |
| gh->msg_type = msg_type; |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* clear all transactions globally; used in case of MNCC socket disconnect */ |
| void gsm0408_clear_all_trans(struct gsm_network *net, enum trans_type type) |
| { |
| struct gsm_trans *trans, *temp; |
| |
| LOGP(DCC, LOGL_NOTICE, "Clearing all currently active transactions!!!\n"); |
| |
| llist_for_each_entry_safe(trans, temp, &net->trans_list, entry) { |
| if (trans->type == type) { |
| trans->callref = 0; |
| trans_free(trans); |
| } |
| } |
| } |
| |
| /* Chapter 9.2.14 : Send LOCATION UPDATING REJECT */ |
| static int gsm0408_loc_upd_rej(struct msc_a *msc_a, uint8_t cause) |
| { |
| struct msgb *msg; |
| |
| msg = gsm48_create_loc_upd_rej(cause); |
| if (!msg) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "Failed to create msg for LOCATION UPDATING REJECT.\n"); |
| return -1; |
| } |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, "LOCATION UPDATING REJECT\n"); |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* Chapter 9.2.13 : Send LOCATION UPDATE ACCEPT */ |
| static int gsm0408_loc_upd_acc(struct msc_a *msc_a, uint32_t send_tmsi) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD ACC"); |
| struct gsm48_hdr *gh; |
| struct gsm48_loc_area_id *lai; |
| uint8_t *mid; |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| struct osmo_location_area_id laid = { |
| .plmn = net->plmn, |
| .lac = vsub->cgi.lai.lac, |
| }; |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_LOC_UPD_ACCEPT; |
| |
| lai = (struct gsm48_loc_area_id *) msgb_put(msg, sizeof(*lai)); |
| gsm48_generate_lai2(lai, &laid); |
| |
| if (send_tmsi == GSM_RESERVED_TMSI) { |
| /* we did not allocate a TMSI to the MS, so we need to |
| * include the IMSI in order for the MS to delete any |
| * old TMSI that might still be allocated */ |
| uint8_t mi[10]; |
| int len; |
| len = gsm48_generate_mid_from_imsi(mi, vsub->imsi); |
| mid = msgb_put(msg, len); |
| memcpy(mid, mi, len); |
| DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT\n", |
| vlr_subscr_name(vsub)); |
| } else { |
| /* Include the TMSI, which means that the MS will send a |
| * TMSI REALLOCATION COMPLETE, and we should wait for |
| * that until T3250 expiration */ |
| mid = msgb_put(msg, GSM48_MID_TMSI_LEN); |
| gsm48_generate_mid_from_tmsi(mid, send_tmsi); |
| DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT (TMSI = 0x%08x)\n", |
| vlr_subscr_name(vsub), |
| send_tmsi); |
| } |
| /* TODO: Follow-on proceed */ |
| /* TODO: CTS permission */ |
| /* TODO: Equivalent PLMNs */ |
| /* TODO: Emergency Number List */ |
| /* TODO: Per-MS T3312 */ |
| |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* Transmit Chapter 9.2.10 Identity Request */ |
| static int mm_tx_identity_req(struct msc_a *msc_a, uint8_t id_type) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 ID REQ"); |
| struct gsm48_hdr *gh; |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_ID_REQ; |
| gh->data[0] = id_type; |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* Parse Chapter 9.2.11 Identity Response */ |
| static int mm_rx_id_resp(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| uint8_t *mi = gh->data+1; |
| uint8_t mi_len = gh->data[0]; |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| |
| if (!vsub) { |
| LOGP(DMM, LOGL_ERROR, |
| "Rx MM Identity Response: invalid: no subscriber\n"); |
| return -EINVAL; |
| } |
| |
| DEBUGP(DMM, "IDENTITY RESPONSE: MI=%s\n", osmo_mi_name(mi, mi_len)); |
| |
| osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, gh->data); |
| |
| return vlr_subscr_rx_id_resp(vsub, mi, mi_len); |
| } |
| |
| /* 9.2.5 CM service accept */ |
| static int msc_gsm48_tx_mm_serv_ack(struct msc_a *msc_a) |
| { |
| struct msgb *msg; |
| struct gsm48_hdr *gh; |
| |
| msg = gsm48_msgb_alloc_name("GSM 04.08 SERV ACC"); |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_CM_SERV_ACC; |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* 9.2.6 CM service reject */ |
| static int msc_gsm48_tx_mm_serv_rej(struct msc_a *msc_a, |
| enum gsm48_reject_value value) |
| { |
| struct msgb *msg; |
| |
| msg = gsm48_create_mm_serv_rej(value); |
| if (!msg) { |
| LOGP(DMM, LOGL_ERROR, "Failed to allocate CM Service Reject.\n"); |
| return -1; |
| } |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "-> CM SERVICE Reject cause: %d\n", value); |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| |
| /* Extract the R99 flag from various Complete Level 3 messages. Depending on the Message Type, extract R99 from the |
| * Classmark Type 1 or the Classmark Type 2. Return 1 for R99, 0 for pre-R99, negative if not a valid Complete Level 3 |
| * message. */ |
| int compl_l3_msg_is_r99(const struct msgb *msg) |
| { |
| const struct gsm48_hdr *gh = msgb_l3(msg); |
| uint8_t pdisc = gsm48_hdr_pdisc(gh); |
| const struct gsm48_loc_upd_req *lu; |
| const struct gsm48_imsi_detach_ind *idi; |
| uint8_t cm2_len; |
| const struct gsm48_classmark2 *cm2; |
| |
| switch (pdisc) { |
| case GSM48_PDISC_MM: |
| switch (gsm48_hdr_msg_type(gh)) { |
| case GSM48_MT_MM_LOC_UPD_REQUEST: |
| lu = (const struct gsm48_loc_upd_req *) gh->data; |
| return osmo_gsm48_classmark1_is_r99(&lu->classmark1) ? 1 : 0; |
| |
| case GSM48_MT_MM_CM_SERV_REQ: |
| case GSM48_MT_MM_CM_REEST_REQ: |
| break; |
| |
| case GSM48_MT_MM_IMSI_DETACH_IND: |
| idi = (const struct gsm48_imsi_detach_ind *) gh->data; |
| return osmo_gsm48_classmark1_is_r99(&idi->classmark1) ? 1 : 0; |
| |
| default: |
| return -1; |
| } |
| break; |
| |
| case GSM48_PDISC_RR: |
| switch (gsm48_hdr_msg_type(gh)) { |
| case GSM48_MT_RR_PAG_RESP: |
| break; |
| |
| default: |
| return -1; |
| } |
| break; |
| |
| default: |
| return -1; |
| } |
| |
| /* Both CM Service Request and Paging Response have Classmark Type 2 at the same location: */ |
| cm2_len = gh->data[1]; |
| cm2 = (void*)gh->data+2; |
| return osmo_gsm48_classmark2_is_r99(cm2, cm2_len) ? 1 : 0; |
| } |
| |
| /* Chapter 9.2.15: Receive Location Updating Request. |
| * Keep this function non-static for direct invocation by unit tests. */ |
| static int mm_rx_loc_upd_req(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| struct gsm48_loc_upd_req *lu; |
| uint8_t mi_type; |
| char mi_string[GSM48_MI_SIZE]; |
| enum vlr_lu_type vlr_lu_type = VLR_LU_TYPE_REGULAR; |
| uint32_t tmsi; |
| char *imsi; |
| struct osmo_location_area_id old_lai; |
| struct osmo_fsm_inst *lu_fsm; |
| bool is_utran; |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct vlr_subscr *vsub; |
| |
| lu = (struct gsm48_loc_upd_req *) gh->data; |
| |
| if (msc_a_is_establishing_auth_ciph(msc_a)) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| "Cannot accept another LU, conn already busy establishing authenticity;" |
| " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
| return -EINVAL; |
| } |
| |
| if (msc_a_is_accepted(msc_a)) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| "Cannot accept another LU, conn already established;" |
| " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
| return -EINVAL; |
| } |
| |
| msc_a->complete_layer3_type = COMPLETE_LAYER3_LU; |
| msub_update_id_from_mi(msc_a->c.msub, lu->mi, lu->mi_len); |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
| |
| osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, &lu->mi_len); |
| |
| switch (lu->type) { |
| case GSM48_LUPD_NORMAL: |
| rate_ctr_inc(&net->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_NORMAL]); |
| vlr_lu_type = VLR_LU_TYPE_REGULAR; |
| break; |
| case GSM48_LUPD_IMSI_ATT: |
| rate_ctr_inc(&net->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_ATTACH]); |
| vlr_lu_type = VLR_LU_TYPE_IMSI_ATTACH; |
| break; |
| case GSM48_LUPD_PERIODIC: |
| rate_ctr_inc(&net->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_PERIODIC]); |
| vlr_lu_type = VLR_LU_TYPE_PERIODIC; |
| break; |
| } |
| |
| /* TODO: 10.5.1.6 MS Classmark for UMTS / Classmark 2 */ |
| /* TODO: 10.5.3.14 Aditional update parameters (CS fallback calls) */ |
| /* TODO: 10.5.7.8 Device properties */ |
| /* TODO: 10.5.1.15 MS network feature support */ |
| |
| mi_type = lu->mi[0] & GSM_MI_TYPE_MASK; |
| gsm48_mi_to_string(mi_string, sizeof(mi_string), lu->mi, lu->mi_len); |
| switch (mi_type) { |
| case GSM_MI_TYPE_IMSI: |
| tmsi = GSM_RESERVED_TMSI; |
| imsi = mi_string; |
| break; |
| case GSM_MI_TYPE_TMSI: |
| tmsi = tmsi_from_string(mi_string); |
| imsi = NULL; |
| break; |
| default: |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "unknown mobile identity type\n"); |
| tmsi = GSM_RESERVED_TMSI; |
| imsi = NULL; |
| break; |
| } |
| |
| gsm48_decode_lai2(&lu->lai, &old_lai); |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "USIM: old LAI: %s\n", osmo_lai_name(&old_lai)); |
| |
| msc_a_get(msc_a, __func__); |
| msc_a_get(msc_a, MSC_A_USE_LOCATION_UPDATING); |
| |
| is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| lu_fsm = vlr_loc_update(msc_a->c.fi, |
| MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| net->vlr, msc_a, vlr_lu_type, tmsi, imsi, |
| &old_lai, &msc_a->via_cell.lai, |
| is_utran || net->authentication_required, |
| net->a5_encryption_mask > 0x01, |
| lu->key_seq, |
| osmo_gsm48_classmark1_is_r99(&lu->classmark1), |
| is_utran, |
| net->vlr->cfg.assign_tmsi); |
| if (!lu_fsm) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "Can't start LU FSM\n"); |
| msc_a_put(msc_a, MSC_A_USE_LOCATION_UPDATING); |
| msc_a_put(msc_a, __func__); |
| return 0; |
| } |
| |
| /* From vlr_loc_update() we expect an implicit dispatch of |
| * VLR_ULA_E_UPDATE_LA, and thus we expect msc_vlr_subscr_assoc() to |
| * already have been called and completed. Has an error occurred? */ |
| |
| vsub = msc_a_vsub(msc_a); |
| if (!vsub) { |
| msc_a_put(msc_a, __func__); |
| return 0; |
| } |
| |
| if (vsub->lu_fsm != lu_fsm) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "Internal Error during Location Updating attempt\n"); |
| msc_a_release_cn(msc_a); |
| msc_a_put(msc_a, __func__); |
| return -EIO; |
| } |
| |
| vsub->classmark.classmark1 = lu->classmark1; |
| vsub->classmark.classmark1_set = true; |
| msc_a_put(msc_a, __func__); |
| return 0; |
| } |
| |
| /* Turn int into semi-octet representation: 98 => 0x89 */ |
| /* FIXME: libosmocore/libosmogsm */ |
| static uint8_t bcdify(uint8_t value) |
| { |
| uint8_t ret; |
| |
| ret = value / 10; |
| ret |= (value % 10) << 4; |
| |
| return ret; |
| } |
| |
| /* Generate a message buffer that contains a valid MM info message, |
| * See also 3GPP TS 24.008, chapter 9.2.15a */ |
| struct msgb *gsm48_create_mm_info(struct gsm_network *net) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 MM INF"); |
| struct gsm48_hdr *gh; |
| uint8_t *ptr8; |
| int name_len, name_pad; |
| |
| time_t cur_t; |
| struct tm* gmt_time; |
| struct tm* local_time; |
| int tzunits; |
| int dst = 0; |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_INFO; |
| |
| if (net->name_long) { |
| #if 0 |
| name_len = strlen(net->name_long); |
| /* 10.5.3.5a */ |
| ptr8 = msgb_put(msg, 3); |
| ptr8[0] = GSM48_IE_NAME_LONG; |
| ptr8[1] = name_len*2 +1; |
| ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| |
| ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
| for (i = 0; i < name_len; i++) |
| ptr16[i] = htons(net->name_long[i]); |
| |
| /* FIXME: Use Cell Broadcast, not UCS-2, since |
| * UCS-2 is only supported by later revisions of the spec */ |
| #endif |
| name_len = (strlen(net->name_long)*7)/8; |
| name_pad = (8 - strlen(net->name_long)*7)%8; |
| if (name_pad > 0) |
| name_len++; |
| /* 10.5.3.5a */ |
| ptr8 = msgb_put(msg, 3); |
| ptr8[0] = GSM48_IE_NAME_LONG; |
| ptr8[1] = name_len +1; |
| ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| |
| ptr8 = msgb_put(msg, name_len); |
| gsm_7bit_encode_n(ptr8, name_len, net->name_long, NULL); |
| |
| } |
| |
| if (net->name_short) { |
| #if 0 |
| name_len = strlen(net->name_short); |
| /* 10.5.3.5a */ |
| ptr8 = (uint8_t *) msgb_put(msg, 3); |
| ptr8[0] = GSM48_IE_NAME_SHORT; |
| ptr8[1] = name_len*2 + 1; |
| ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| |
| ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
| for (i = 0; i < name_len; i++) |
| ptr16[i] = htons(net->name_short[i]); |
| #endif |
| name_len = (strlen(net->name_short)*7)/8; |
| name_pad = (8 - strlen(net->name_short)*7)%8; |
| if (name_pad > 0) |
| name_len++; |
| /* 10.5.3.5a */ |
| ptr8 = (uint8_t *) msgb_put(msg, 3); |
| ptr8[0] = GSM48_IE_NAME_SHORT; |
| ptr8[1] = name_len +1; |
| ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| |
| ptr8 = msgb_put(msg, name_len); |
| gsm_7bit_encode_n(ptr8, name_len, net->name_short, NULL); |
| |
| } |
| |
| /* Section 10.5.3.9 */ |
| cur_t = time(NULL); |
| gmt_time = gmtime(&cur_t); |
| |
| ptr8 = msgb_put(msg, 8); |
| ptr8[0] = GSM48_IE_NET_TIME_TZ; |
| ptr8[1] = bcdify(gmt_time->tm_year % 100); |
| ptr8[2] = bcdify(gmt_time->tm_mon + 1); |
| ptr8[3] = bcdify(gmt_time->tm_mday); |
| ptr8[4] = bcdify(gmt_time->tm_hour); |
| ptr8[5] = bcdify(gmt_time->tm_min); |
| ptr8[6] = bcdify(gmt_time->tm_sec); |
| |
| if (net->tz.override) { |
| /* Convert tz.hr and tz.mn to units */ |
| if (net->tz.hr < 0) { |
| tzunits = ((net->tz.hr/-1)*4); |
| tzunits = tzunits + (net->tz.mn/15); |
| ptr8[7] = bcdify(tzunits); |
| /* Set negative time */ |
| ptr8[7] |= 0x08; |
| } |
| else { |
| tzunits = net->tz.hr*4; |
| tzunits = tzunits + (net->tz.mn/15); |
| ptr8[7] = bcdify(tzunits); |
| } |
| /* Convert DST value */ |
| if (net->tz.dst >= 0 && net->tz.dst <= 2) |
| dst = net->tz.dst; |
| } |
| else { |
| /* Need to get GSM offset and convert into 15 min units */ |
| /* This probably breaks if gmtoff returns a value not evenly divisible by 15? */ |
| #ifdef HAVE_TM_GMTOFF_IN_TM |
| local_time = localtime(&cur_t); |
| tzunits = (local_time->tm_gmtoff/60)/15; |
| #else |
| /* find timezone offset */ |
| time_t utc; |
| double offsetFromUTC; |
| utc = mktime(gmt_time); |
| local_time = localtime(&cur_t); |
| offsetFromUTC = difftime(cur_t, utc); |
| if (local_time->tm_isdst) |
| offsetFromUTC += 3600.0; |
| tzunits = ((int)offsetFromUTC) / 60 / 15; |
| #endif |
| if (tzunits < 0) { |
| tzunits = tzunits/-1; |
| ptr8[7] = bcdify(tzunits); |
| /* Flip it to negative */ |
| ptr8[7] |= 0x08; |
| } |
| else |
| ptr8[7] = bcdify(tzunits); |
| |
| /* Does not support DST +2 */ |
| if (local_time->tm_isdst) |
| dst = 1; |
| } |
| |
| if (dst) { |
| ptr8 = msgb_put(msg, 3); |
| ptr8[0] = GSM48_IE_NET_DST; |
| ptr8[1] = 1; |
| ptr8[2] = dst; |
| } |
| |
| return msg; |
| } |
| |
| /* Section 9.2.15a */ |
| int gsm48_tx_mm_info(struct msc_a *msc_a) |
| { |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct msgb *msg; |
| |
| msg = gsm48_create_mm_info(net); |
| |
| LOG_MSC_A(msc_a, LOGL_DEBUG, "Tx MM INFO\n"); |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /*! Send an Authentication Request to MS on the given RAN connection |
| * according to 3GPP/ETSI TS 24.008, Section 9.2.2. |
| * \param[in] conn Subscriber connection to send on. |
| * \param[in] rand Random challenge token to send, must be 16 bytes long. |
| * \param[in] autn r99: In case of UMTS mutual authentication, AUTN token to |
| * send; must be 16 bytes long, or pass NULL for plain GSM auth. |
| * \param[in] key_seq auth tuple's sequence number. |
| */ |
| int gsm48_tx_mm_auth_req(struct msc_a *msc_a, uint8_t *rand, |
| uint8_t *autn, int key_seq) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 AUTH REQ"); |
| struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| struct gsm48_auth_req *ar = (struct gsm48_auth_req *) msgb_put(msg, sizeof(*ar)); |
| |
| DEBUGP(DMM, "Tx AUTH REQ (rand = %s)\n", osmo_hexdump_nospc(rand, 16)); |
| if (autn) |
| DEBUGP(DMM, " AUTH REQ (autn = %s)\n", osmo_hexdump_nospc(autn, 16)); |
| |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_AUTH_REQ; |
| |
| ar->key_seq = key_seq; |
| |
| /* 16 bytes RAND parameters */ |
| osmo_static_assert(sizeof(ar->rand) == 16, sizeof_auth_req_r99_rand); |
| if (rand) |
| memcpy(ar->rand, rand, 16); |
| |
| |
| /* 16 bytes AUTN */ |
| if (autn) |
| msgb_tlv_put(msg, GSM48_IE_AUTN, 16, autn); |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| /* Section 9.2.1 */ |
| int gsm48_tx_mm_auth_rej(struct msc_a *msc_a) |
| { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "-> AUTH REJECT\n"); |
| return gsm48_tx_simple(msc_a, GSM48_PDISC_MM, GSM48_MT_MM_AUTH_REJ); |
| } |
| |
| static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type, |
| enum gsm48_reject_value cause); |
| |
| static int cm_serv_reuse_conn(struct msc_a *msc_a, const uint8_t *mi_lv, enum osmo_cm_service_type cm_serv_type) |
| { |
| uint8_t mi_type; |
| char mi_string[GSM48_MI_SIZE]; |
| uint32_t tmsi; |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| |
| gsm48_mi_to_string(mi_string, sizeof(mi_string), mi_lv+1, mi_lv[0]); |
| mi_type = mi_lv[1] & GSM_MI_TYPE_MASK; |
| |
| switch (mi_type) { |
| case GSM_MI_TYPE_IMSI: |
| if (vlr_subscr_matches_imsi(vsub, mi_string)) |
| goto accept_reuse; |
| break; |
| case GSM_MI_TYPE_TMSI: |
| tmsi = osmo_load32be(mi_lv+2); |
| if (vlr_subscr_matches_tmsi(vsub, tmsi)) |
| goto accept_reuse; |
| break; |
| case GSM_MI_TYPE_IMEI: |
| if (vlr_subscr_matches_imei(vsub, mi_string)) |
| goto accept_reuse; |
| break; |
| default: |
| break; |
| } |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "CM Service Request with mismatching mobile identity: %s %s\n", |
| gsm48_mi_type_name(mi_type), mi_string); |
| msc_vlr_tx_cm_serv_rej(msc_a, cm_serv_type, GSM48_REJECT_ILLEGAL_MS); |
| return -EINVAL; |
| |
| accept_reuse: |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "re-using already accepted connection\n"); |
| |
| msc_a_get(msc_a, msc_a_cm_service_type_to_use(cm_serv_type)); |
| msub_update_id(msc_a->c.msub); |
| return net->vlr->ops.tx_cm_serv_acc(msc_a, cm_serv_type); |
| } |
| |
| /* |
| * Handle CM Service Requests |
| * a) Verify that the packet is long enough to contain the information |
| * we require otherwsie reject with INCORRECT_MESSAGE |
| * b) Try to parse the TMSI. If we do not have one reject |
| * c) Check that we know the subscriber with the TMSI otherwise reject |
| * with a HLR cause |
| * d) Set the subscriber on the conn and accept |
| * |
| * Keep this function non-static for direct invocation by unit tests. |
| */ |
| int gsm48_rx_mm_serv_req(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct gsm48_hdr *gh; |
| struct gsm48_service_request *req; |
| struct gsm48_classmark2 *cm2; |
| uint8_t *cm2_buf, cm2_len; |
| uint8_t *mi_buf, mi_len; |
| uint8_t *mi, mi_type; |
| bool is_utran; |
| struct vlr_subscr *vsub; |
| |
| /* Make sure that both header and CM Service Request fit into the buffer */ |
| if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*req)) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: wrong message size (%u < %zu)\n", |
| msgb_l3len(msg), sizeof(*gh) + sizeof(*req)); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| } |
| |
| gh = (struct gsm48_hdr *) msgb_l3(msg); |
| req = (struct gsm48_service_request *) gh->data; |
| |
| /* Unfortunately in Phase1 the Classmark2 length is variable, so we cannot |
| * just use gsm48_service_request struct, and need to parse it manually. */ |
| cm2_len = gh->data[1]; |
| cm2_buf = gh->data + 2; |
| cm2 = (struct gsm48_classmark2 *) cm2_buf; |
| |
| /* Prevent buffer overrun: check the length of Classmark2 */ |
| if (cm2_buf + cm2_len > msg->tail) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: Classmark2 " |
| "length=%u is too big\n", cm2_len); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| } |
| |
| /* MI (Mobile Identity) LV follows the Classmark2 */ |
| mi_buf = cm2_buf + cm2_len; |
| mi_len = mi_buf[0]; |
| mi = mi_buf + 1; |
| |
| /* Prevent buffer overrun: check the length of MI */ |
| if (mi_buf + mi_len > msg->tail) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: Mobile Identity " |
| "length=%u is too big\n", cm2_len); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| } |
| |
| if (msc_a_is_establishing_auth_ciph(msc_a)) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, |
| "Cannot accept CM Service Request, conn already busy establishing authenticity\n"); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_CONGESTION); |
| /* or should we accept and note down the service request anyway? */ |
| } |
| |
| msc_a->complete_layer3_type = COMPLETE_LAYER3_CM_SERVICE_REQ; |
| msub_update_id_from_mi(msc_a->c.msub, mi, mi_len); |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "Rx CM SERVICE REQUEST cm_service_type=%s\n", |
| osmo_cm_service_type_name(req->cm_service_type)); |
| |
| mi_type = (mi && mi_len) ? (mi[0] & GSM_MI_TYPE_MASK) : GSM_MI_TYPE_NONE; |
| switch (mi_type) { |
| case GSM_MI_TYPE_IMSI: |
| case GSM_MI_TYPE_TMSI: |
| /* continue below */ |
| break; |
| case GSM_MI_TYPE_IMEI: |
| if (req->cm_service_type == GSM48_CMSERV_EMERGENCY) { |
| /* We don't do emergency calls by IMEI */ |
| LOG_MSC_A(msc_a, LOGL_NOTICE, "Tx CM SERVICE REQUEST REJECT: " |
| "emergency services by IMEI are not supported\n"); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_IMEI_NOT_ACCEPTED); |
| } |
| /* fall-through for non-emergency setup */ |
| default: |
| LOG_MSC_A(msc_a, LOGL_ERROR, "MI type is not expected: %s\n", gsm48_mi_type_name(mi_type)); |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| } |
| |
| if (!msc_a_cm_service_type_to_use(req->cm_service_type)) |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_SRV_OPT_NOT_SUPPORTED); |
| |
| if (msc_a_is_accepted(msc_a)) |
| return cm_serv_reuse_conn(msc_a, mi_buf, req->cm_service_type); |
| |
| osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, mi_buf); |
| |
| msc_a_get(msc_a, msc_a_cm_service_type_to_use(req->cm_service_type)); |
| |
| is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| vlr_proc_acc_req(msc_a->c.fi, |
| MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| net->vlr, msc_a, |
| VLR_PR_ARQ_T_CM_SERV_REQ, |
| req->cm_service_type, |
| mi-1, &msc_a->via_cell.lai, |
| is_utran || net->authentication_required, |
| net->a5_encryption_mask > 0x01, |
| req->cipher_key_seq, |
| osmo_gsm48_classmark2_is_r99(cm2, cm2_len), |
| is_utran); |
| |
| /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
| * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occurred? */ |
| vsub = msc_a_vsub(msc_a); |
| if (!vsub) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "subscriber not allowed to do a CM Service Request\n"); |
| return -EIO; |
| } |
| |
| vsub->classmark.classmark2 = *cm2; |
| vsub->classmark.classmark2_len = cm2_len; |
| return 0; |
| } |
| |
| /* Receive a CM Re-establish Request */ |
| static int gsm48_rx_cm_reest_req(struct msc_a *msc_a, struct msgb *msg) |
| { |
| uint8_t mi_type; |
| char mi_string[GSM48_MI_SIZE]; |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| |
| uint8_t classmark2_len = gh->data[1]; |
| uint8_t *classmark2 = gh->data+2; |
| uint8_t mi_len = *(classmark2 + classmark2_len); |
| uint8_t *mi = (classmark2 + classmark2_len + 1); |
| |
| gsm48_mi_to_string(mi_string, sizeof(mi_string), mi, mi_len); |
| mi_type = mi[0] & GSM_MI_TYPE_MASK; |
| DEBUGP(DMM, "<- CM RE-ESTABLISH REQUEST MI(%s)=%s\n", gsm48_mi_type_name(mi_type), mi_string); |
| |
| /* we don't support CM call re-establishment */ |
| return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_SRV_OPT_NOT_SUPPORTED); |
| } |
| |
| static int gsm48_rx_mm_imsi_detach_ind(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| struct gsm48_imsi_detach_ind *idi = |
| (struct gsm48_imsi_detach_ind *) gh->data; |
| uint8_t mi_type = idi->mi[0] & GSM_MI_TYPE_MASK; |
| char mi_string[GSM48_MI_SIZE]; |
| struct vlr_subscr *vsub = NULL; |
| |
| gsm48_mi_to_string(mi_string, sizeof(mi_string), idi->mi, idi->mi_len); |
| DEBUGP(DMM, "IMSI DETACH INDICATION: MI(%s)=%s\n", |
| gsm48_mi_type_name(mi_type), mi_string); |
| |
| rate_ctr_inc(&net->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_DETACH]); |
| |
| switch (mi_type) { |
| case GSM_MI_TYPE_TMSI: |
| vsub = vlr_subscr_find_by_tmsi(net->vlr, |
| tmsi_from_string(mi_string), __func__); |
| break; |
| case GSM_MI_TYPE_IMSI: |
| vsub = vlr_subscr_find_by_imsi(net->vlr, mi_string, __func__); |
| break; |
| case GSM_MI_TYPE_IMEI: |
| case GSM_MI_TYPE_IMEISV: |
| /* no sim card... FIXME: what to do ? */ |
| LOGP(DMM, LOGL_ERROR, "MI(%s)=%s: unimplemented mobile identity type\n", |
| gsm48_mi_type_name(mi_type), mi_string); |
| break; |
| default: |
| LOGP(DMM, LOGL_ERROR, "MI(%s)=%s: unknown mobile identity type\n", |
| gsm48_mi_type_name(mi_type), mi_string); |
| break; |
| } |
| |
| if (!vsub) { |
| LOGP(DMM, LOGL_ERROR, "IMSI DETACH for unknown subscriber MI(%s)=%s\n", |
| gsm48_mi_type_name(mi_type), mi_string); |
| } else { |
| LOGP(DMM, LOGL_INFO, "IMSI DETACH for %s\n", vlr_subscr_name(vsub)); |
| msub_set_vsub(msc_a->c.msub, vsub); |
| |
| if (vsub->cs.is_paging) |
| paging_expired(vsub); |
| |
| vsub->classmark.classmark1 = idi->classmark1; |
| |
| vlr_subscr_rx_imsi_detach(vsub); |
| osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_DETACHED, vsub); |
| vlr_subscr_put(vsub, __func__); |
| } |
| |
| msc_a_release_cn(msc_a); |
| return 0; |
| } |
| |
| static int gsm48_rx_mm_status(struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| |
| DEBUGP(DMM, "MM STATUS (reject cause 0x%02x)\n", gh->data[0]); |
| |
| return 0; |
| } |
| |
| static int parse_gsm_auth_resp(uint8_t *res, uint8_t *res_len, |
| struct msc_a *msc_a, |
| struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| struct gsm48_auth_resp *ar = (struct gsm48_auth_resp*) gh->data; |
| |
| if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*ar)) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: l3 length invalid: %u\n", |
| msgb_l3len(msg)); |
| return -EINVAL; |
| } |
| |
| *res_len = sizeof(ar->sres); |
| memcpy(res, ar->sres, sizeof(ar->sres)); |
| return 0; |
| } |
| |
| static int parse_umts_auth_resp(uint8_t *res, uint8_t *res_len, |
| struct msc_a *msc_a, |
| struct msgb *msg) |
| { |
| struct gsm48_hdr *gh; |
| uint8_t *data; |
| uint8_t iei; |
| uint8_t ie_len; |
| unsigned int data_len; |
| |
| /* First parse the GSM part */ |
| if (parse_gsm_auth_resp(res, res_len, msc_a, msg)) |
| return -EINVAL; |
| OSMO_ASSERT(*res_len == 4); |
| |
| /* Then add the extended res part */ |
| gh = msgb_l3(msg); |
| data = gh->data + sizeof(struct gsm48_auth_resp); |
| data_len = msgb_l3len(msg) - (data - (uint8_t*)msgb_l3(msg)); |
| |
| if (data_len < 3) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: " |
| "message length=%u is too short\n", data_len); |
| return -EINVAL; |
| } |
| |
| iei = data[0]; |
| ie_len = data[1]; |
| if (iei != GSM48_IE_AUTH_RES_EXT) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION RESPONSE: expected IEI 0x%02x, got 0x%02x\n", |
| GSM48_IE_AUTH_RES_EXT, iei); |
| return -EINVAL; |
| } |
| |
| if (ie_len > 12) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| "MM R99 AUTHENTICATION RESPONSE: extended Auth Resp IE 0x%02x is too large: %u bytes\n", |
| GSM48_IE_AUTH_RES_EXT, ie_len); |
| return -EINVAL; |
| } |
| |
| *res_len += ie_len; |
| memcpy(res + 4, &data[2], ie_len); |
| return 0; |
| } |
| |
| /* Chapter 9.2.3: Authentication Response */ |
| static int gsm48_rx_mm_auth_resp(struct msc_a *msc_a, struct msgb *msg) |
| { |
| uint8_t res[16]; |
| uint8_t res_len; |
| int rc; |
| bool is_umts; |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| |
| if (!vsub) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: invalid: no subscriber\n"); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| is_umts = (msgb_l3len(msg) > sizeof(struct gsm48_hdr) + sizeof(struct gsm48_auth_resp)); |
| |
| if (is_umts) |
| rc = parse_umts_auth_resp(res, &res_len, msc_a, msg); |
| else |
| rc = parse_gsm_auth_resp(res, &res_len, msc_a, msg); |
| |
| if (rc) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| "MM AUTHENTICATION RESPONSE: invalid: parsing %s AKA Auth Response" |
| " failed with rc=%d; dispatching zero length SRES/RES to trigger failure\n", |
| is_umts ? "UMTS" : "GSM", rc); |
| memset(res, 0, sizeof(res)); |
| res_len = 0; |
| } |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "MM %s AUTHENTICATION RESPONSE (%s = %s)\n", |
| is_umts ? "UMTS" : "GSM", is_umts ? "res" : "sres", |
| osmo_hexdump_nospc(res, res_len)); |
| |
| return vlr_subscr_rx_auth_resp(vsub, osmo_gsm48_classmark_is_r99(&vsub->classmark), |
| msc_a->c.ran->type == OSMO_RAT_UTRAN_IU, |
| res, res_len); |
| } |
| |
| static int gsm48_rx_mm_auth_fail(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| uint8_t cause; |
| uint8_t auts_tag; |
| uint8_t auts_len; |
| uint8_t *auts; |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| |
| if (!vsub) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION FAILURE: invalid: no subscriber\n"); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| if (msgb_l3len(msg) < sizeof(*gh) + 1) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION FAILURE: l3 length invalid: %u\n", |
| msgb_l3len(msg)); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| cause = gh->data[0]; |
| |
| if (cause != GSM48_REJECT_SYNCH_FAILURE) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, "MM R99 AUTHENTICATION FAILURE: cause 0x%0x\n", cause); |
| vlr_subscr_rx_auth_fail(vsub, NULL); |
| return 0; |
| } |
| |
| /* This is a Synch Failure procedure, which should pass an AUTS to |
| * resynchronize the sequence nr with the HLR. Expecting exactly one |
| * TLV with 14 bytes of AUTS. */ |
| |
| if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure: missing AUTS IE\n"); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| auts_tag = gh->data[1]; |
| auts_len = gh->data[2]; |
| auts = &gh->data[3]; |
| |
| if (auts_tag != GSM48_IE_AUTS |
| || auts_len != 14) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure:" |
| " expected AUTS IE 0x%02x of 14 bytes," |
| " got IE 0x%02x of %u bytes\n", |
| GSM48_IE_AUTS, auts_tag, auts_len); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2 + auts_len) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure msg: message truncated (%u)\n", |
| msgb_l3len(msg)); |
| msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
| return -EINVAL; |
| } |
| |
| /* We have an AUTS IE with exactly 14 bytes of AUTS and the msgb is |
| * large enough. */ |
| |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "MM R99 AUTHENTICATION SYNCH (AUTS = %s)\n", |
| osmo_hexdump_nospc(auts, 14)); |
| |
| return vlr_subscr_rx_auth_fail(vsub, auts); |
| } |
| |
| static int gsm48_rx_mm_tmsi_reall_compl(struct msc_a *msc_a) |
| { |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| if (!vsub) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "Rx MM TMSI Reallocation Complete: invalid: no subscriber\n"); |
| return -EINVAL; |
| } |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "TMSI Reallocation Completed\n"); |
| return vlr_subscr_rx_tmsi_reall_compl(vsub); |
| } |
| |
| /* Receive a GSM 04.08 Mobility Management (MM) message */ |
| int gsm0408_rcv_mm(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| int rc = 0; |
| |
| switch (gsm48_hdr_msg_type(gh)) { |
| case GSM48_MT_MM_LOC_UPD_REQUEST: |
| rc = mm_rx_loc_upd_req(msc_a, msg); |
| break; |
| case GSM48_MT_MM_ID_RESP: |
| rc = mm_rx_id_resp(msc_a, msg); |
| break; |
| case GSM48_MT_MM_CM_SERV_REQ: |
| rc = gsm48_rx_mm_serv_req(msc_a, msg); |
| break; |
| case GSM48_MT_MM_STATUS: |
| rc = gsm48_rx_mm_status(msg); |
| break; |
| case GSM48_MT_MM_TMSI_REALL_COMPL: |
| rc = gsm48_rx_mm_tmsi_reall_compl(msc_a); |
| break; |
| case GSM48_MT_MM_IMSI_DETACH_IND: |
| rc = gsm48_rx_mm_imsi_detach_ind(msc_a, msg); |
| break; |
| case GSM48_MT_MM_CM_REEST_REQ: |
| rc = gsm48_rx_cm_reest_req(msc_a, msg); |
| break; |
| case GSM48_MT_MM_AUTH_RESP: |
| rc = gsm48_rx_mm_auth_resp(msc_a, msg); |
| break; |
| case GSM48_MT_MM_AUTH_FAIL: |
| rc = gsm48_rx_mm_auth_fail(msc_a, msg); |
| break; |
| default: |
| LOGP(DMM, LOGL_NOTICE, "Unknown GSM 04.08 MM msg type 0x%02x\n", |
| gh->msg_type); |
| break; |
| } |
| |
| return rc; |
| } |
| |
| /* Receive a PAGING RESPONSE message from the MS */ |
| static int gsm48_rx_rr_pag_resp(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm_network *net = msc_a_net(msc_a); |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| struct gsm48_pag_resp *pr = |
| (struct gsm48_pag_resp *)gh->data; |
| uint8_t classmark2_len = gh->data[1]; |
| uint8_t *classmark2_buf = gh->data+2; |
| struct gsm48_classmark2 *cm2 = (void*)classmark2_buf; |
| uint8_t *mi_lv = classmark2_buf + classmark2_len; |
| bool is_utran; |
| struct vlr_subscr *vsub; |
| |
| if (msc_a_is_establishing_auth_ciph(msc_a)) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| "Ignoring Paging Response, conn already busy establishing authenticity\n"); |
| return 0; |
| } |
| |
| if (msc_a_is_accepted(msc_a)) { |
| LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "Ignoring Paging Response, conn already established\n"); |
| return 0; |
| } |
| |
| msc_a->complete_layer3_type = COMPLETE_LAYER3_PAGING_RESP; |
| msub_update_id_from_mi(msc_a->c.msub, mi_lv + 1, *mi_lv); |
| LOG_MSC_A_CAT(msc_a, DRR, LOGL_DEBUG, "Rx PAGING RESPONSE\n"); |
| |
| msc_a_get(msc_a, MSC_A_USE_PAGING_RESPONSE); |
| |
| is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| vlr_proc_acc_req(msc_a->c.fi, |
| MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| net->vlr, msc_a, |
| VLR_PR_ARQ_T_PAGING_RESP, 0, mi_lv, &msc_a->via_cell.lai, |
| is_utran || net->authentication_required, |
| net->a5_encryption_mask > 0x01, |
| pr->key_seq, |
| osmo_gsm48_classmark2_is_r99(cm2, classmark2_len), |
| is_utran); |
| |
| /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
| * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occurred? */ |
| vsub = msc_a_vsub(msc_a); |
| if (!vsub) { |
| LOG_MSC_A(msc_a, LOGL_ERROR, "subscriber not allowed to do a Paging Response\n"); |
| msc_a_put(msc_a, MSC_A_USE_PAGING_RESPONSE); |
| return -EIO; |
| } |
| |
| vsub->classmark.classmark2 = *cm2; |
| vsub->classmark.classmark2_len = classmark2_len; |
| return 0; |
| } |
| |
| static int gsm48_rx_rr_ciphering_mode_complete(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh); |
| struct tlv_parsed tp; |
| struct tlv_p_entry *mi; |
| |
| tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0); |
| mi = TLVP_GET(&tp, GSM48_IE_MOBILE_ID); |
| |
| if (!mi) |
| return 0; |
| |
| LOG_MSC_A(msc_a, LOGL_DEBUG, "Ciphering Mode Complete contains Mobile Identity: %s\n", |
| osmo_mi_name(mi->val, mi->len)); |
| |
| if (!vsub) |
| return 0; |
| |
| return vlr_subscr_rx_id_resp(vsub, mi->val, mi->len); |
| } |
| |
| static int gsm48_rx_rr_app_info(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| uint8_t apdu_id_flags; |
| uint8_t apdu_len; |
| uint8_t *apdu_data; |
| |
| apdu_id_flags = gh->data[0]; |
| apdu_len = gh->data[1]; |
| apdu_data = gh->data+2; |
| |
| DEBUGP(DRR, "RX APPLICATION INFO id/flags=0x%02x apdu_len=%u apdu=%s\n", |
| apdu_id_flags, apdu_len, osmo_hexdump(apdu_data, apdu_len)); |
| |
| /* we're not using the app info blob anywhere, so ignore. */ |
| #if 0 |
| return db_apdu_blob_store(conn->subscr, apdu_id_flags, apdu_len, apdu_data); |
| #else |
| return 0; |
| #endif |
| } |
| |
| /* Receive a GSM 04.08 Radio Resource (RR) message */ |
| int gsm0408_rcv_rr(struct msc_a *msc_a, struct msgb *msg) |
| { |
| struct gsm48_hdr *gh = msgb_l3(msg); |
| int rc = 0; |
| |
| switch (gh->msg_type) { |
| case GSM48_MT_RR_PAG_RESP: |
| rc = gsm48_rx_rr_pag_resp(msc_a, msg); |
| break; |
| case GSM48_MT_RR_CIPH_M_COMPL: |
| rc = gsm48_rx_rr_ciphering_mode_complete(msc_a, msg); |
| break; |
| case GSM48_MT_RR_APP_INFO: |
| rc = gsm48_rx_rr_app_info(msc_a, msg); |
| break; |
| default: |
| LOG_MSC_A_CAT(msc_a, DRR, LOGL_NOTICE, "MSC: Unimplemented %s GSM 04.08 RR " |
| "message\n", gsm48_rr_msg_name(gh->msg_type)); |
| break; |
| } |
| |
| return rc; |
| } |
| |
| int gsm48_send_rr_app_info(struct msc_a *msc_a, uint8_t apdu_id, |
| uint8_t apdu_len, const uint8_t *apdu) |
| { |
| struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 APP INF"); |
| struct gsm48_hdr *gh; |
| |
| DEBUGP(DRR, "TX APPLICATION INFO id=0x%02x, len=%u\n", |
| apdu_id, apdu_len); |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 2 + apdu_len); |
| gh->proto_discr = GSM48_PDISC_RR; |
| gh->msg_type = GSM48_MT_RR_APP_INFO; |
| gh->data[0] = apdu_id; |
| gh->data[1] = apdu_len; |
| memcpy(gh->data+2, apdu, apdu_len); |
| |
| return msc_a_tx_dtap_to_i(msc_a, msg); |
| } |
| |
| extern int gsm0408_rcv_cc(struct msc_a *msc_a, struct msgb *msg); |
| |
| /*********************************************************************** |
| * VLR integration |
| ***********************************************************************/ |
| |
| /* VLR asks us to send an authentication request */ |
| static int msc_vlr_tx_auth_req(void *msc_conn_ref, struct vlr_auth_tuple *at, |
| bool send_autn) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return gsm48_tx_mm_auth_req(msc_a, at->vec.rand, |
| send_autn? at->vec.autn : NULL, |
| at->key_seq); |
| } |
| |
| /* VLR asks us to send an authentication reject */ |
| static int msc_vlr_tx_auth_rej(void *msc_conn_ref) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return gsm48_tx_mm_auth_rej(msc_a); |
| } |
| |
| /* VLR asks us to transmit an Identity Request of given type */ |
| static int msc_vlr_tx_id_req(void *msc_conn_ref, uint8_t mi_type) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return mm_tx_identity_req(msc_a, mi_type); |
| } |
| |
| /* VLR asks us to transmit a Location Update Accept */ |
| static int msc_vlr_tx_lu_acc(void *msc_conn_ref, uint32_t send_tmsi) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return gsm0408_loc_upd_acc(msc_a, send_tmsi); |
| } |
| |
| /* VLR asks us to transmit a Location Update Reject */ |
| static int msc_vlr_tx_lu_rej(void *msc_conn_ref, enum gsm48_reject_value cause) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return gsm0408_loc_upd_rej(msc_a, cause); |
| } |
| |
| /* VLR asks us to transmit a CM Service Accept */ |
| int msc_vlr_tx_cm_serv_acc(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| return msc_gsm48_tx_mm_serv_ack(msc_a); |
| } |
| |
| static int msc_vlr_tx_common_id(void *msc_conn_ref) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| struct ran_msg msg = { |
| .msg_type = RAN_MSG_COMMON_ID, |
| .common_id = { |
| .imsi = msc_a_vsub(msc_a)->imsi, |
| }, |
| }; |
| return msc_a_ran_down(msc_a, MSC_ROLE_I, &msg); |
| } |
| |
| /* VLR asks us to transmit MM info. */ |
| static int msc_vlr_tx_mm_info(void *msc_conn_ref) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| struct gsm_network *net = msc_a_net(msc_a); |
| if (!net->send_mm_info) |
| return 0; |
| return gsm48_tx_mm_info(msc_a); |
| } |
| |
| /* VLR asks us to transmit a CM Service Reject */ |
| static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type, |
| enum gsm48_reject_value cause) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| msc_gsm48_tx_mm_serv_rej(msc_a, cause); |
| msc_a_put(msc_a, msc_a_cm_service_type_to_use(cm_service_type)); |
| return 0; |
| } |
| |
| /* VLR informs us that the subscriber data has somehow been modified */ |
| static void msc_vlr_subscr_update(struct vlr_subscr *subscr) |
| { |
| struct msub *msub = msub_for_vsub(subscr); |
| LOGVSUBP(LOGL_NOTICE, subscr, "VLR: update for IMSI=%s (MSISDN=%s)%s\n", |
| subscr->imsi, subscr->msisdn, msub ? "" : " (NO CONN!)"); |
| msub_update_id(msub); |
| } |
| |
| /* VLR informs us that the subscriber has been associated with a conn */ |
| static int msc_vlr_subscr_assoc(void *msc_conn_ref, |
| struct vlr_subscr *vsub) |
| { |
| struct msc_a *msc_a = msc_conn_ref; |
| struct msub *msub = msc_a->c.msub; |
| OSMO_ASSERT(vsub); |
| |
| if (msub_set_vsub(msub, vsub)) |
| return -EINVAL; |
| vsub->cs.attached_via_ran = msc_a->c.ran->type; |
| |
| /* In case we have already received Classmark Information before the VLR Subscriber was |
| * associated with the conn: merge the new Classmark into vsub->classmark. Don't overwrite valid |
| * vsub->classmark with unset classmark, though. */ |
| osmo_gsm48_classmark_update(&vsub->classmark, &msc_a->temporary_classmark); |
| |
| msub_update_id(msub); |
| |
| osmo_fsm_inst_dispatch(msc_a->c.fi, MSC_A_EV_COMPLETE_LAYER_3_OK, NULL); |
| return 0; |
| } |
| |
| /* operations that we need to implement for libvlr */ |
| const struct vlr_ops msc_vlr_ops = { |
| .tx_auth_req = msc_vlr_tx_auth_req, |
| .tx_auth_rej = msc_vlr_tx_auth_rej, |
| .tx_id_req = msc_vlr_tx_id_req, |
| .tx_lu_acc = msc_vlr_tx_lu_acc, |
| .tx_lu_rej = msc_vlr_tx_lu_rej, |
| .tx_cm_serv_acc = msc_vlr_tx_cm_serv_acc, |
| .tx_cm_serv_rej = msc_vlr_tx_cm_serv_rej, |
| .set_ciph_mode = msc_a_vlr_set_cipher_mode, |
| .tx_common_id = msc_vlr_tx_common_id, |
| .tx_mm_info = msc_vlr_tx_mm_info, |
| .subscr_update = msc_vlr_subscr_update, |
| .subscr_assoc = msc_vlr_subscr_assoc, |
| }; |
| |
| struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value) |
| { |
| struct msgb *msg; |
| struct gsm48_hdr *gh; |
| |
| msg = gsm48_msgb_alloc_name("GSM 04.08 SERV REJ"); |
| if (!msg) |
| return NULL; |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_CM_SERV_REJ; |
| gh->data[0] = value; |
| |
| return msg; |
| } |
| |
| struct msgb *gsm48_create_loc_upd_rej(uint8_t cause) |
| { |
| struct gsm48_hdr *gh; |
| struct msgb *msg; |
| |
| msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD REJ"); |
| if (!msg) |
| return NULL; |
| |
| gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| gh->proto_discr = GSM48_PDISC_MM; |
| gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT; |
| gh->data[0] = cause; |
| return msg; |
| } |
| |
| int gsm48_extract_mi(uint8_t *classmark2_lv, int length, char *mi_string, uint8_t *mi_type) |
| { |
| /* Check the size for the classmark */ |
| if (length < 1 + *classmark2_lv) |
| return -1; |
| |
| uint8_t *mi_lv = classmark2_lv + *classmark2_lv + 1; |
| if (length < 2 + *classmark2_lv + mi_lv[0]) |
| return -2; |
| |
| *mi_type = mi_lv[1] & GSM_MI_TYPE_MASK; |
| return gsm48_mi_to_string(mi_string, GSM48_MI_SIZE, mi_lv+1, *mi_lv); |
| } |
| |
| int gsm48_paging_extract_mi(struct gsm48_pag_resp *resp, int length, |
| char *mi_string, uint8_t *mi_type) |
| { |
| static const uint32_t classmark_offset = |
| offsetof(struct gsm48_pag_resp, classmark2); |
| uint8_t *classmark2_lv = (uint8_t *) &resp->classmark2; |
| return gsm48_extract_mi(classmark2_lv, length - classmark_offset, |
| mi_string, mi_type); |
| } |