Holger Hans Peter Freyther | acf8a0c | 2010-03-29 08:47:44 +0200 | [diff] [blame] | 1 | /* GSM Mobile Radio Interface Layer 3 messages on the A-bis interface |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 2 | * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */ |
| 3 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 4 | /* (C) 2008-2016 by Harald Welte <laforge@gnumonks.org> |
Holger Hans Peter Freyther | c121bb3 | 2012-12-26 10:17:42 +0100 | [diff] [blame] | 5 | * (C) 2008-2012 by Holger Hans Peter Freyther <zecke@selfish.org> |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 6 | * |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 7 | * All Rights Reserved |
| 8 | * |
| 9 | * This program is free software; you can redistribute it and/or modify |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 10 | * it under the terms of the GNU Affero General Public License as published by |
| 11 | * the Free Software Foundation; either version 3 of the License, or |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 12 | * (at your option) any later version. |
| 13 | * |
| 14 | * This program is distributed in the hope that it will be useful, |
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 17 | * GNU Affero General Public License for more details. |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 18 | * |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 19 | * You should have received a copy of the GNU Affero General Public License |
| 20 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 21 | * |
| 22 | */ |
| 23 | |
| 24 | |
| 25 | #include <stdio.h> |
| 26 | #include <stdlib.h> |
| 27 | #include <string.h> |
Max | ddee01f | 2016-05-24 14:23:27 +0200 | [diff] [blame] | 28 | #include <stdbool.h> |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 29 | #include <errno.h> |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 30 | #include <time.h> |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 31 | #include <netinet/in.h> |
Max | ddee01f | 2016-05-24 14:23:27 +0200 | [diff] [blame] | 32 | #include <sys/types.h> |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 33 | |
Neels Hofmeyr | 4ac8009 | 2019-03-04 02:46:37 +0100 | [diff] [blame] | 34 | #include "config.h" |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 35 | |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 36 | #include <osmocom/msc/debug.h> |
| 37 | #include <osmocom/msc/gsm_data.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 38 | #include <osmocom/msc/gsm_04_08.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 39 | #include <osmocom/msc/signal.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 40 | #include <osmocom/msc/transaction.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 41 | #include <osmocom/msc/vlr.h> |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 42 | #include <osmocom/msc/msc_a.h> |
Holger Hans Peter Freyther | 841c200 | 2010-09-30 18:52:23 +0800 | [diff] [blame] | 43 | |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 44 | #include <osmocom/gsm/gsm48.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 45 | #include <osmocom/gsm/gsm_utils.h> |
Max | 8db12e4 | 2016-04-18 23:11:18 +0200 | [diff] [blame] | 46 | #include <osmocom/gsm/protocol/gsm_04_08.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 47 | #include <osmocom/core/msgb.h> |
| 48 | #include <osmocom/core/talloc.h> |
Neels Hofmeyr | 93bafb6 | 2017-01-13 03:12:08 +0100 | [diff] [blame] | 49 | #include <osmocom/core/utils.h> |
Philipp Maier | 621ba03 | 2017-11-07 17:19:25 +0100 | [diff] [blame] | 50 | #include <osmocom/core/byteswap.h> |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 51 | #include <osmocom/core/fsm.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 52 | #include <osmocom/gsm/tlv.h> |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 53 | #include <osmocom/crypt/auth.h> |
Alexander Couzens | 8b7d785 | 2021-11-05 01:52:05 +0100 | [diff] [blame] | 54 | #include <osmocom/crypt/utran_cipher.h> |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 55 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 56 | #include <osmocom/msc/msub.h> |
| 57 | #include <osmocom/msc/msc_roles.h> |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 58 | #include <osmocom/msc/call_leg.h> |
Philipp Maier | fbf6610 | 2017-04-09 12:32:51 +0200 | [diff] [blame] | 59 | |
Holger Hans Peter Freyther | 1e61b25 | 2013-07-06 11:45:38 +0200 | [diff] [blame] | 60 | #include <assert.h> |
| 61 | |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 62 | |
Harald Welte (local) | d19e58b | 2009-08-15 02:30:58 +0200 | [diff] [blame] | 63 | void *tall_locop_ctx; |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 64 | void *tall_authciphop_ctx; |
Harald Welte | 2cf161b | 2009-06-20 22:36:41 +0200 | [diff] [blame] | 65 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 66 | static int gsm0408_loc_upd_acc(struct msc_a *msc_a, uint32_t send_tmsi); |
Harald Welte | 65e74cc | 2008-12-29 01:55:35 +0000 | [diff] [blame] | 67 | |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 68 | /*! Send a simple GSM 04.08 message without any payload |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 69 | * \param conn Active RAN connection |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 70 | * \param[in] pdisc Protocol discriminator |
| 71 | * \param[in] msg_type Message type |
| 72 | * \return result of \ref gsm48_conn_sendmsg |
| 73 | */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 74 | int gsm48_tx_simple(struct msc_a *msc_a, uint8_t pdisc, uint8_t msg_type) |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 75 | { |
| 76 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 TX SIMPLE"); |
| 77 | struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 78 | |
| 79 | gh->proto_discr = pdisc; |
| 80 | gh->msg_type = msg_type; |
| 81 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 82 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Holger Hans Peter Freyther | 9c137a7 | 2010-06-15 13:57:40 +0800 | [diff] [blame] | 83 | } |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 84 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 85 | /* clear all transactions globally; used in case of MNCC socket disconnect */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 86 | void gsm0408_clear_all_trans(struct gsm_network *net, enum trans_type type) |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 87 | { |
| 88 | struct gsm_trans *trans, *temp; |
| 89 | |
| 90 | LOGP(DCC, LOGL_NOTICE, "Clearing all currently active transactions!!!\n"); |
| 91 | |
| 92 | llist_for_each_entry_safe(trans, temp, &net->trans_list, entry) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 93 | if (trans->type == type) { |
Harald Welte | eb76c7a | 2010-12-23 02:47:53 +0100 | [diff] [blame] | 94 | trans->callref = 0; |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 95 | trans_free(trans); |
Harald Welte | eb76c7a | 2010-12-23 02:47:53 +0100 | [diff] [blame] | 96 | } |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 97 | } |
| 98 | } |
| 99 | |
Holger Freyther | 429e776 | 2008-12-30 13:28:30 +0000 | [diff] [blame] | 100 | /* Chapter 9.2.14 : Send LOCATION UPDATING REJECT */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 101 | static int gsm0408_loc_upd_rej(struct msc_a *msc_a, uint8_t cause) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 102 | { |
Holger Hans Peter Freyther | 230a4d8 | 2010-06-15 19:40:05 +0800 | [diff] [blame] | 103 | struct msgb *msg; |
| 104 | |
Holger Hans Peter Freyther | 230a4d8 | 2010-06-15 19:40:05 +0800 | [diff] [blame] | 105 | msg = gsm48_create_loc_upd_rej(cause); |
| 106 | if (!msg) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 107 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "Failed to create msg for LOCATION UPDATING REJECT.\n"); |
Holger Hans Peter Freyther | 230a4d8 | 2010-06-15 19:40:05 +0800 | [diff] [blame] | 108 | return -1; |
| 109 | } |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 110 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 111 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, "LOCATION UPDATING REJECT\n"); |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 112 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 113 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 114 | } |
| 115 | |
| 116 | /* Chapter 9.2.13 : Send LOCATION UPDATE ACCEPT */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 117 | static int gsm0408_loc_upd_acc(struct msc_a *msc_a, uint32_t send_tmsi) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 118 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 119 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD ACC"); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 120 | struct gsm48_hdr *gh; |
| 121 | struct gsm48_loc_area_id *lai; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 122 | struct gsm_network *net = msc_a_net(msc_a); |
| 123 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 124 | struct osmo_location_area_id laid = { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 125 | .plmn = net->plmn, |
| 126 | .lac = vsub->cgi.lai.lac, |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 127 | }; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 128 | uint8_t *l; |
| 129 | int rc; |
| 130 | struct osmo_mobile_identity mi = {}; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 131 | |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 132 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 133 | gh->proto_discr = GSM48_PDISC_MM; |
| 134 | gh->msg_type = GSM48_MT_MM_LOC_UPD_ACCEPT; |
| 135 | |
| 136 | lai = (struct gsm48_loc_area_id *) msgb_put(msg, sizeof(*lai)); |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 137 | gsm48_generate_lai2(lai, &laid); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 138 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 139 | if (send_tmsi == GSM_RESERVED_TMSI) { |
| 140 | /* we did not allocate a TMSI to the MS, so we need to |
| 141 | * include the IMSI in order for the MS to delete any |
| 142 | * old TMSI that might still be allocated */ |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 143 | mi.type = GSM_MI_TYPE_IMSI; |
| 144 | OSMO_STRLCPY_ARRAY(mi.imsi, vsub->imsi); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 145 | DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT\n", |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 146 | vlr_subscr_name(vsub)); |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 147 | } else { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 148 | /* Include the TMSI, which means that the MS will send a |
| 149 | * TMSI REALLOCATION COMPLETE, and we should wait for |
| 150 | * that until T3250 expiration */ |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 151 | mi.type = GSM_MI_TYPE_TMSI; |
| 152 | mi.tmsi = send_tmsi; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 153 | DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT (TMSI = 0x%08x)\n", |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 154 | vlr_subscr_name(vsub), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 155 | send_tmsi); |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 156 | } |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 157 | l = msgb_tl_put(msg, GSM48_IE_MOBILE_ID); |
| 158 | rc = osmo_mobile_identity_encode_msgb(msg, &mi, false); |
| 159 | if (rc < 0) { |
| 160 | msgb_free(msg); |
| 161 | return -EINVAL; |
| 162 | } |
| 163 | *l = rc; |
| 164 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 165 | /* TODO: Follow-on proceed */ |
| 166 | /* TODO: CTS permission */ |
| 167 | /* TODO: Equivalent PLMNs */ |
| 168 | /* TODO: Emergency Number List */ |
| 169 | /* TODO: Per-MS T3312 */ |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 170 | |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 171 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 172 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 173 | } |
| 174 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 175 | /* Transmit Chapter 9.2.10 Identity Request */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 176 | static int mm_tx_identity_req(struct msc_a *msc_a, uint8_t id_type) |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 177 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 178 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 ID REQ"); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 179 | struct gsm48_hdr *gh; |
Harald Welte | fc977a8 | 2008-12-27 10:19:37 +0000 | [diff] [blame] | 180 | |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 181 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 182 | gh->proto_discr = GSM48_PDISC_MM; |
| 183 | gh->msg_type = GSM48_MT_MM_ID_REQ; |
| 184 | gh->data[0] = id_type; |
| 185 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 186 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 187 | } |
| 188 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 189 | /* Parse Chapter 9.2.11 Identity Response */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 190 | static int mm_rx_id_resp(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 191 | { |
| 192 | struct gsm48_hdr *gh = msgb_l3(msg); |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 193 | uint8_t *mi_data = gh->data+1; |
Neels Hofmeyr | b62289a | 2019-01-11 00:04:32 +0100 | [diff] [blame] | 194 | uint8_t mi_len = gh->data[0]; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 195 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 196 | struct osmo_mobile_identity mi; |
| 197 | int rc; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 198 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 199 | if (!vsub) { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 200 | LOGP(DMM, LOGL_ERROR, |
| 201 | "Rx MM Identity Response: invalid: no subscriber\n"); |
| 202 | return -EINVAL; |
| 203 | } |
| 204 | |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 205 | /* There muct be at least one octet with MI type */ |
| 206 | if (!mi_len) { |
| 207 | LOGP(DMM, LOGL_NOTICE, "MM Identity Response contains " |
| 208 | "malformed Mobile Identity\n"); |
| 209 | return -EINVAL; |
| 210 | } |
| 211 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 212 | rc = osmo_mobile_identity_decode(&mi, mi_data, mi_len, false); |
| 213 | if (rc) { |
| 214 | LOGP(DMM, LOGL_ERROR, "Failure to decode Mobile Identity in MM Identity Response (rc=%d)\n", rc); |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 215 | return -EINVAL; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 216 | } |
| 217 | |
| 218 | /* Make sure we got what we expected */ |
| 219 | if (mi.type != msc_a->mm_id_req_type) { |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 220 | LOGP(DMM, LOGL_NOTICE, "MM Identity Response contains unexpected " |
| 221 | "Mobile Identity type %s (extected %s)\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 222 | gsm48_mi_type_name(mi.type), |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 223 | gsm48_mi_type_name(msc_a->mm_id_req_type)); |
| 224 | return -EINVAL; |
| 225 | } |
| 226 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 227 | DEBUGP(DMM, "IDENTITY RESPONSE: %s\n", osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 228 | |
Pablo Neira Ayuso | bbc5b99 | 2011-05-06 12:12:31 +0200 | [diff] [blame] | 229 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, gh->data); |
Harald Welte | 7659de1 | 2009-12-13 12:39:18 +0100 | [diff] [blame] | 230 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 231 | return vlr_subscr_rx_id_resp(vsub, &mi); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 232 | } |
| 233 | |
| 234 | /* 9.2.5 CM service accept */ |
| 235 | static int msc_gsm48_tx_mm_serv_ack(struct msc_a *msc_a) |
| 236 | { |
| 237 | struct msgb *msg; |
| 238 | struct gsm48_hdr *gh; |
| 239 | |
| 240 | msg = gsm48_msgb_alloc_name("GSM 04.08 SERV ACC"); |
| 241 | |
| 242 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 243 | gh->proto_discr = GSM48_PDISC_MM; |
| 244 | gh->msg_type = GSM48_MT_MM_CM_SERV_ACC; |
| 245 | |
| 246 | return msc_a_tx_dtap_to_i(msc_a, msg); |
| 247 | } |
| 248 | |
Neels Hofmeyr | 5d53c60 | 2022-04-24 23:37:07 +0200 | [diff] [blame] | 249 | /* 9.2.6 CM service reject. |
| 250 | * For an active and valid CM Service Request, instead use msc_vlr_tx_cm_serv_rej(), which also takes care of |
| 251 | * decrementing the use token for that service type. */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 252 | static int msc_gsm48_tx_mm_serv_rej(struct msc_a *msc_a, |
| 253 | enum gsm48_reject_value value) |
| 254 | { |
| 255 | struct msgb *msg; |
| 256 | |
| 257 | msg = gsm48_create_mm_serv_rej(value); |
| 258 | if (!msg) { |
| 259 | LOGP(DMM, LOGL_ERROR, "Failed to allocate CM Service Reject.\n"); |
| 260 | return -1; |
| 261 | } |
| 262 | |
| 263 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "-> CM SERVICE Reject cause: %d\n", value); |
| 264 | |
| 265 | return msc_a_tx_dtap_to_i(msc_a, msg); |
| 266 | } |
| 267 | |
| 268 | |
| 269 | /* Extract the R99 flag from various Complete Level 3 messages. Depending on the Message Type, extract R99 from the |
| 270 | * Classmark Type 1 or the Classmark Type 2. Return 1 for R99, 0 for pre-R99, negative if not a valid Complete Level 3 |
| 271 | * message. */ |
| 272 | int compl_l3_msg_is_r99(const struct msgb *msg) |
| 273 | { |
| 274 | const struct gsm48_hdr *gh = msgb_l3(msg); |
| 275 | uint8_t pdisc = gsm48_hdr_pdisc(gh); |
| 276 | const struct gsm48_loc_upd_req *lu; |
| 277 | const struct gsm48_imsi_detach_ind *idi; |
| 278 | uint8_t cm2_len; |
| 279 | const struct gsm48_classmark2 *cm2; |
| 280 | |
| 281 | switch (pdisc) { |
| 282 | case GSM48_PDISC_MM: |
| 283 | switch (gsm48_hdr_msg_type(gh)) { |
| 284 | case GSM48_MT_MM_LOC_UPD_REQUEST: |
| 285 | lu = (const struct gsm48_loc_upd_req *) gh->data; |
| 286 | return osmo_gsm48_classmark1_is_r99(&lu->classmark1) ? 1 : 0; |
| 287 | |
| 288 | case GSM48_MT_MM_CM_SERV_REQ: |
| 289 | case GSM48_MT_MM_CM_REEST_REQ: |
| 290 | break; |
| 291 | |
| 292 | case GSM48_MT_MM_IMSI_DETACH_IND: |
| 293 | idi = (const struct gsm48_imsi_detach_ind *) gh->data; |
| 294 | return osmo_gsm48_classmark1_is_r99(&idi->classmark1) ? 1 : 0; |
| 295 | |
| 296 | default: |
| 297 | return -1; |
| 298 | } |
| 299 | break; |
| 300 | |
| 301 | case GSM48_PDISC_RR: |
| 302 | switch (gsm48_hdr_msg_type(gh)) { |
| 303 | case GSM48_MT_RR_PAG_RESP: |
| 304 | break; |
| 305 | |
| 306 | default: |
| 307 | return -1; |
| 308 | } |
| 309 | break; |
| 310 | |
| 311 | default: |
| 312 | return -1; |
| 313 | } |
| 314 | |
| 315 | /* Both CM Service Request and Paging Response have Classmark Type 2 at the same location: */ |
| 316 | cm2_len = gh->data[1]; |
| 317 | cm2 = (void*)gh->data+2; |
| 318 | return osmo_gsm48_classmark2_is_r99(cm2, cm2_len) ? 1 : 0; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 319 | } |
| 320 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 321 | /* Chapter 9.2.15: Receive Location Updating Request. |
| 322 | * Keep this function non-static for direct invocation by unit tests. */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 323 | static int mm_rx_loc_upd_req(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 324 | { |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 325 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 326 | struct gsm48_loc_upd_req *lu; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 327 | enum vlr_lu_type vlr_lu_type = VLR_LU_TYPE_REGULAR; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 328 | uint32_t tmsi; |
| 329 | char *imsi; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 330 | struct osmo_location_area_id old_lai; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 331 | struct osmo_fsm_inst *lu_fsm; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 332 | bool is_utran; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 333 | struct gsm_network *net = msc_a_net(msc_a); |
| 334 | struct vlr_subscr *vsub; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 335 | struct osmo_mobile_identity mi; |
| 336 | int rc; |
| 337 | |
| 338 | rc = osmo_mobile_identity_decode_from_l3(&mi, msg, false); |
| 339 | if (rc) { |
| 340 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| 341 | "Failed to decode Mobile Identity in Location Updating Request\n"); |
| 342 | return -EINVAL; |
| 343 | } |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 344 | |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 345 | lu = (struct gsm48_loc_upd_req *) gh->data; |
| 346 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 347 | if (msc_a_is_establishing_auth_ciph(msc_a)) { |
| 348 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| 349 | "Cannot accept another LU, conn already busy establishing authenticity;" |
| 350 | " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 351 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi), osmo_lu_type_name(lu->type)); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 352 | return -EINVAL; |
| 353 | } |
| 354 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 355 | if (msc_a_is_accepted(msc_a)) { |
| 356 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| 357 | "Cannot accept another LU, conn already established;" |
| 358 | " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 359 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi), osmo_lu_type_name(lu->type)); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 360 | return -EINVAL; |
| 361 | } |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 362 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 363 | msc_a->complete_layer3_type = COMPLETE_LAYER3_LU; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 364 | |
| 365 | msub_update_id_from_mi(msc_a->c.msub, &mi); |
Neels Hofmeyr | 16c42b5 | 2018-04-02 12:26:16 +0200 | [diff] [blame] | 366 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 367 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 368 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi), osmo_lu_type_name(lu->type)); |
Holger Freyther | 73487a2 | 2008-12-31 18:53:57 +0000 | [diff] [blame] | 369 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 370 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, &mi); |
Harald Welte | 7659de1 | 2009-12-13 12:39:18 +0100 | [diff] [blame] | 371 | |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 372 | switch (lu->type) { |
| 373 | case GSM48_LUPD_NORMAL: |
Pau Espin Pedrol | 2e21a68 | 2021-06-04 16:45:44 +0200 | [diff] [blame] | 374 | rate_ctr_inc(rate_ctr_group_get_ctr(net->msc_ctrs, MSC_CTR_LOC_UPDATE_TYPE_NORMAL)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 375 | vlr_lu_type = VLR_LU_TYPE_REGULAR; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 376 | break; |
| 377 | case GSM48_LUPD_IMSI_ATT: |
Pau Espin Pedrol | 2e21a68 | 2021-06-04 16:45:44 +0200 | [diff] [blame] | 378 | rate_ctr_inc(rate_ctr_group_get_ctr(net->msc_ctrs, MSC_CTR_LOC_UPDATE_TYPE_ATTACH)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 379 | vlr_lu_type = VLR_LU_TYPE_IMSI_ATTACH; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 380 | break; |
| 381 | case GSM48_LUPD_PERIODIC: |
Pau Espin Pedrol | 2e21a68 | 2021-06-04 16:45:44 +0200 | [diff] [blame] | 382 | rate_ctr_inc(rate_ctr_group_get_ctr(net->msc_ctrs, MSC_CTR_LOC_UPDATE_TYPE_PERIODIC)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 383 | vlr_lu_type = VLR_LU_TYPE_PERIODIC; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 384 | break; |
| 385 | } |
| 386 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 387 | /* TODO: 10.5.1.6 MS Classmark for UMTS / Classmark 2 */ |
Martin Hauke | 3f07dac | 2019-11-14 17:49:08 +0100 | [diff] [blame] | 388 | /* TODO: 10.5.3.14 Additional update parameters (CS fallback calls) */ |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 389 | /* TODO: 10.5.7.8 Device properties */ |
| 390 | /* TODO: 10.5.1.15 MS network feature support */ |
Sylvain Munaut | 2030a2a | 2010-06-10 13:36:59 +0200 | [diff] [blame] | 391 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 392 | switch (mi.type) { |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 393 | case GSM_MI_TYPE_IMSI: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 394 | tmsi = GSM_RESERVED_TMSI; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 395 | imsi = mi.imsi; |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 396 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 397 | case GSM_MI_TYPE_TMSI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 398 | tmsi = mi.tmsi; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 399 | imsi = NULL; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 400 | break; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 401 | default: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 402 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "unknown mobile identity type\n"); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 403 | tmsi = GSM_RESERVED_TMSI; |
| 404 | imsi = NULL; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 405 | break; |
| 406 | } |
| 407 | |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 408 | gsm48_decode_lai2(&lu->lai, &old_lai); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 409 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "USIM: old LAI: %s\n", osmo_lai_name(&old_lai)); |
Harald Welte | 24516ea | 2009-07-04 10:18:00 +0200 | [diff] [blame] | 410 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 411 | msc_a_get(msc_a, __func__); |
| 412 | msc_a_get(msc_a, MSC_A_USE_LOCATION_UPDATING); |
| 413 | |
| 414 | is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| 415 | lu_fsm = vlr_loc_update(msc_a->c.fi, |
| 416 | MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| 417 | net->vlr, msc_a, vlr_lu_type, tmsi, imsi, |
| 418 | &old_lai, &msc_a->via_cell.lai, |
| 419 | is_utran || net->authentication_required, |
Neels Hofmeyr | d99a607 | 2022-10-10 23:34:48 +0200 | [diff] [blame] | 420 | msc_a_is_ciphering_to_be_attempted(msc_a), |
Neels Hofmeyr | 2ea7264 | 2022-10-10 23:35:47 +0200 | [diff] [blame] | 421 | msc_a_is_ciphering_required(msc_a), |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 422 | lu->key_seq, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 423 | osmo_gsm48_classmark1_is_r99(&lu->classmark1), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 424 | is_utran, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 425 | net->vlr->cfg.assign_tmsi); |
| 426 | if (!lu_fsm) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 427 | LOG_MSC_A(msc_a, LOGL_ERROR, "Can't start LU FSM\n"); |
| 428 | msc_a_put(msc_a, MSC_A_USE_LOCATION_UPDATING); |
| 429 | msc_a_put(msc_a, __func__); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 430 | return 0; |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 431 | } |
| 432 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 433 | /* From vlr_loc_update() we expect an implicit dispatch of |
| 434 | * VLR_ULA_E_UPDATE_LA, and thus we expect msc_vlr_subscr_assoc() to |
Thorsten Alteholz | 3a357de | 2019-07-16 20:51:16 +0200 | [diff] [blame] | 435 | * already have been called and completed. Has an error occurred? */ |
Harald Welte | 255539c | 2008-12-28 02:26:27 +0000 | [diff] [blame] | 436 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 437 | vsub = msc_a_vsub(msc_a); |
| 438 | if (!vsub) { |
| 439 | msc_a_put(msc_a, __func__); |
| 440 | return 0; |
| 441 | } |
| 442 | |
| 443 | if (vsub->lu_fsm != lu_fsm) { |
| 444 | LOG_MSC_A(msc_a, LOGL_ERROR, "Internal Error during Location Updating attempt\n"); |
| 445 | msc_a_release_cn(msc_a); |
| 446 | msc_a_put(msc_a, __func__); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 447 | return -EIO; |
| 448 | } |
| 449 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 450 | vsub->classmark.classmark1 = lu->classmark1; |
| 451 | vsub->classmark.classmark1_set = true; |
| 452 | msc_a_put(msc_a, __func__); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 453 | return 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 454 | } |
| 455 | |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 456 | /* Turn int into semi-octet representation: 98 => 0x89 */ |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 457 | /* FIXME: libosmocore/libosmogsm */ |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 458 | static uint8_t bcdify(uint8_t value) |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 459 | { |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 460 | uint8_t ret; |
| 461 | |
| 462 | ret = value / 10; |
| 463 | ret |= (value % 10) << 4; |
| 464 | |
| 465 | return ret; |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 466 | } |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 467 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 468 | /* Generate a message buffer that contains a valid MM info message, |
| 469 | * See also 3GPP TS 24.008, chapter 9.2.15a */ |
| 470 | struct msgb *gsm48_create_mm_info(struct gsm_network *net) |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 471 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 472 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 MM INF"); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 473 | struct gsm48_hdr *gh; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 474 | uint8_t *ptr8; |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 475 | int name_len, name_pad; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 476 | |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 477 | time_t cur_t; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 478 | struct tm* gmt_time; |
| 479 | struct tm* local_time; |
| 480 | int tzunits; |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 481 | int dst = 0; |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 482 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 483 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 484 | gh->proto_discr = GSM48_PDISC_MM; |
| 485 | gh->msg_type = GSM48_MT_MM_INFO; |
| 486 | |
| 487 | if (net->name_long) { |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 488 | #if 0 |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 489 | name_len = strlen(net->name_long); |
| 490 | /* 10.5.3.5a */ |
| 491 | ptr8 = msgb_put(msg, 3); |
| 492 | ptr8[0] = GSM48_IE_NAME_LONG; |
| 493 | ptr8[1] = name_len*2 +1; |
| 494 | ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| 495 | |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 496 | ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 497 | for (i = 0; i < name_len; i++) |
Harald Welte | 179f064 | 2008-12-31 23:59:18 +0000 | [diff] [blame] | 498 | ptr16[i] = htons(net->name_long[i]); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 499 | |
| 500 | /* FIXME: Use Cell Broadcast, not UCS-2, since |
| 501 | * UCS-2 is only supported by later revisions of the spec */ |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 502 | #endif |
| 503 | name_len = (strlen(net->name_long)*7)/8; |
| 504 | name_pad = (8 - strlen(net->name_long)*7)%8; |
| 505 | if (name_pad > 0) |
| 506 | name_len++; |
| 507 | /* 10.5.3.5a */ |
| 508 | ptr8 = msgb_put(msg, 3); |
| 509 | ptr8[0] = GSM48_IE_NAME_LONG; |
| 510 | ptr8[1] = name_len +1; |
| 511 | ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| 512 | |
| 513 | ptr8 = msgb_put(msg, name_len); |
Harald Welte | 5468f76 | 2015-01-01 12:41:17 +0100 | [diff] [blame] | 514 | gsm_7bit_encode_n(ptr8, name_len, net->name_long, NULL); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 515 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 516 | } |
| 517 | |
| 518 | if (net->name_short) { |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 519 | #if 0 |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 520 | name_len = strlen(net->name_short); |
| 521 | /* 10.5.3.5a */ |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 522 | ptr8 = (uint8_t *) msgb_put(msg, 3); |
Harald Welte | 7543eb7 | 2009-07-19 17:51:36 +0200 | [diff] [blame] | 523 | ptr8[0] = GSM48_IE_NAME_SHORT; |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 524 | ptr8[1] = name_len*2 + 1; |
| 525 | ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| 526 | |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 527 | ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 528 | for (i = 0; i < name_len; i++) |
Harald Welte | 179f064 | 2008-12-31 23:59:18 +0000 | [diff] [blame] | 529 | ptr16[i] = htons(net->name_short[i]); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 530 | #endif |
| 531 | name_len = (strlen(net->name_short)*7)/8; |
| 532 | name_pad = (8 - strlen(net->name_short)*7)%8; |
| 533 | if (name_pad > 0) |
| 534 | name_len++; |
| 535 | /* 10.5.3.5a */ |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 536 | ptr8 = (uint8_t *) msgb_put(msg, 3); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 537 | ptr8[0] = GSM48_IE_NAME_SHORT; |
| 538 | ptr8[1] = name_len +1; |
| 539 | ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| 540 | |
| 541 | ptr8 = msgb_put(msg, name_len); |
Harald Welte | 5468f76 | 2015-01-01 12:41:17 +0100 | [diff] [blame] | 542 | gsm_7bit_encode_n(ptr8, name_len, net->name_short, NULL); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 543 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 544 | } |
| 545 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 546 | /* Section 10.5.3.9 */ |
| 547 | cur_t = time(NULL); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 548 | gmt_time = gmtime(&cur_t); |
| 549 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 550 | ptr8 = msgb_put(msg, 8); |
| 551 | ptr8[0] = GSM48_IE_NET_TIME_TZ; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 552 | ptr8[1] = bcdify(gmt_time->tm_year % 100); |
| 553 | ptr8[2] = bcdify(gmt_time->tm_mon + 1); |
| 554 | ptr8[3] = bcdify(gmt_time->tm_mday); |
| 555 | ptr8[4] = bcdify(gmt_time->tm_hour); |
| 556 | ptr8[5] = bcdify(gmt_time->tm_min); |
| 557 | ptr8[6] = bcdify(gmt_time->tm_sec); |
| 558 | |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 559 | if (net->tz.override) { |
Harald Welte | 45f9171 | 2012-07-08 16:48:11 +0200 | [diff] [blame] | 560 | /* Convert tz.hr and tz.mn to units */ |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 561 | if (net->tz.hr < 0) { |
| 562 | tzunits = ((net->tz.hr/-1)*4); |
| 563 | tzunits = tzunits + (net->tz.mn/15); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 564 | ptr8[7] = bcdify(tzunits); |
| 565 | /* Set negative time */ |
| 566 | ptr8[7] |= 0x08; |
| 567 | } |
| 568 | else { |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 569 | tzunits = net->tz.hr*4; |
| 570 | tzunits = tzunits + (net->tz.mn/15); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 571 | ptr8[7] = bcdify(tzunits); |
| 572 | } |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 573 | /* Convert DST value */ |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 574 | if (net->tz.dst >= 0 && net->tz.dst <= 2) |
| 575 | dst = net->tz.dst; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 576 | } |
| 577 | else { |
| 578 | /* Need to get GSM offset and convert into 15 min units */ |
| 579 | /* This probably breaks if gmtoff returns a value not evenly divisible by 15? */ |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 580 | #ifdef HAVE_TM_GMTOFF_IN_TM |
Benoit Bolsee | 38bb344 | 2017-07-05 12:57:16 +0200 | [diff] [blame] | 581 | local_time = localtime(&cur_t); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 582 | tzunits = (local_time->tm_gmtoff/60)/15; |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 583 | #else |
Benoit Bolsee | 38bb344 | 2017-07-05 12:57:16 +0200 | [diff] [blame] | 584 | /* find timezone offset */ |
| 585 | time_t utc; |
| 586 | double offsetFromUTC; |
| 587 | utc = mktime(gmt_time); |
| 588 | local_time = localtime(&cur_t); |
| 589 | offsetFromUTC = difftime(cur_t, utc); |
| 590 | if (local_time->tm_isdst) |
| 591 | offsetFromUTC += 3600.0; |
| 592 | tzunits = ((int)offsetFromUTC) / 60 / 15; |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 593 | #endif |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 594 | if (tzunits < 0) { |
| 595 | tzunits = tzunits/-1; |
| 596 | ptr8[7] = bcdify(tzunits); |
| 597 | /* Flip it to negative */ |
| 598 | ptr8[7] |= 0x08; |
| 599 | } |
| 600 | else |
| 601 | ptr8[7] = bcdify(tzunits); |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 602 | |
| 603 | /* Does not support DST +2 */ |
| 604 | if (local_time->tm_isdst) |
| 605 | dst = 1; |
| 606 | } |
| 607 | |
| 608 | if (dst) { |
| 609 | ptr8 = msgb_put(msg, 3); |
| 610 | ptr8[0] = GSM48_IE_NET_DST; |
| 611 | ptr8[1] = 1; |
| 612 | ptr8[2] = dst; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 613 | } |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 614 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 615 | return msg; |
| 616 | } |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 617 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 618 | /* Section 9.2.15a */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 619 | int gsm48_tx_mm_info(struct msc_a *msc_a) |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 620 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 621 | struct gsm_network *net = msc_a_net(msc_a); |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 622 | struct msgb *msg; |
| 623 | |
| 624 | msg = gsm48_create_mm_info(net); |
| 625 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 626 | LOG_MSC_A(msc_a, LOGL_DEBUG, "Tx MM INFO\n"); |
| 627 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 628 | } |
| 629 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 630 | /*! Send an Authentication Request to MS on the given RAN connection |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 631 | * according to 3GPP/ETSI TS 24.008, Section 9.2.2. |
| 632 | * \param[in] conn Subscriber connection to send on. |
| 633 | * \param[in] rand Random challenge token to send, must be 16 bytes long. |
| 634 | * \param[in] autn r99: In case of UMTS mutual authentication, AUTN token to |
| 635 | * send; must be 16 bytes long, or pass NULL for plain GSM auth. |
| 636 | * \param[in] key_seq auth tuple's sequence number. |
| 637 | */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 638 | int gsm48_tx_mm_auth_req(struct msc_a *msc_a, uint8_t *rand, |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 639 | uint8_t *autn, int key_seq) |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 640 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 641 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 AUTH REQ"); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 642 | struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 643 | struct gsm48_auth_req *ar = (struct gsm48_auth_req *) msgb_put(msg, sizeof(*ar)); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 644 | |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 645 | DEBUGP(DMM, "Tx AUTH REQ (rand = %s)\n", osmo_hexdump_nospc(rand, 16)); |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 646 | if (autn) |
Neels Hofmeyr | 3355fd6 | 2017-02-14 17:42:25 +0100 | [diff] [blame] | 647 | DEBUGP(DMM, " AUTH REQ (autn = %s)\n", osmo_hexdump_nospc(autn, 16)); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 648 | |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 649 | gh->proto_discr = GSM48_PDISC_MM; |
| 650 | gh->msg_type = GSM48_MT_MM_AUTH_REQ; |
| 651 | |
Sylvain Munaut | bd55a6d | 2009-12-24 00:23:46 +0100 | [diff] [blame] | 652 | ar->key_seq = key_seq; |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 653 | |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 654 | /* 16 bytes RAND parameters */ |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 655 | osmo_static_assert(sizeof(ar->rand) == 16, sizeof_auth_req_r99_rand); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 656 | if (rand) |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 657 | memcpy(ar->rand, rand, 16); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 658 | |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 659 | |
| 660 | /* 16 bytes AUTN */ |
| 661 | if (autn) |
| 662 | msgb_tlv_put(msg, GSM48_IE_AUTN, 16, autn); |
| 663 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 664 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 665 | } |
| 666 | |
| 667 | /* Section 9.2.1 */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 668 | int gsm48_tx_mm_auth_rej(struct msc_a *msc_a) |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 669 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 670 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "-> AUTH REJECT\n"); |
| 671 | return gsm48_tx_simple(msc_a, GSM48_PDISC_MM, GSM48_MT_MM_AUTH_REJ); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 672 | } |
| 673 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 674 | static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type, |
| 675 | enum gsm48_reject_value cause); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 676 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 677 | static int cm_serv_reuse_conn(struct msc_a *msc_a, const struct osmo_mobile_identity *mi, enum osmo_cm_service_type cm_serv_type) |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 678 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 679 | struct gsm_network *net = msc_a_net(msc_a); |
| 680 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 681 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 682 | switch (mi->type) { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 683 | case GSM_MI_TYPE_IMSI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 684 | if (vlr_subscr_matches_imsi(vsub, mi->imsi)) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 685 | goto accept_reuse; |
| 686 | break; |
| 687 | case GSM_MI_TYPE_TMSI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 688 | if (vlr_subscr_matches_tmsi(vsub, mi->tmsi)) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 689 | goto accept_reuse; |
| 690 | break; |
| 691 | case GSM_MI_TYPE_IMEI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 692 | if (vlr_subscr_matches_imei(vsub, mi->imei)) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 693 | goto accept_reuse; |
| 694 | break; |
| 695 | default: |
| 696 | break; |
| 697 | } |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 698 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 699 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "CM Service Request with mismatching mobile identity: %s\n", |
| 700 | osmo_mobile_identity_to_str_c(OTC_SELECT, mi)); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 701 | msc_vlr_tx_cm_serv_rej(msc_a, cm_serv_type, GSM48_REJECT_ILLEGAL_MS); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 702 | return -EINVAL; |
Sylvain Munaut | ba87f45 | 2009-12-24 00:28:46 +0100 | [diff] [blame] | 703 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 704 | accept_reuse: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 705 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "re-using already accepted connection\n"); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 706 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 707 | msub_update_id(msc_a->c.msub); |
| 708 | return net->vlr->ops.tx_cm_serv_acc(msc_a, cm_serv_type); |
Sylvain Munaut | ba87f45 | 2009-12-24 00:28:46 +0100 | [diff] [blame] | 709 | } |
| 710 | |
Harald Welte | 4ed0e92 | 2009-01-10 03:17:30 +0000 | [diff] [blame] | 711 | /* |
| 712 | * Handle CM Service Requests |
| 713 | * a) Verify that the packet is long enough to contain the information |
Martin Hauke | 3f07dac | 2019-11-14 17:49:08 +0100 | [diff] [blame] | 714 | * we require otherwise reject with INCORRECT_MESSAGE |
Harald Welte | 4ed0e92 | 2009-01-10 03:17:30 +0000 | [diff] [blame] | 715 | * b) Try to parse the TMSI. If we do not have one reject |
| 716 | * c) Check that we know the subscriber with the TMSI otherwise reject |
| 717 | * with a HLR cause |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 718 | * d) Set the subscriber on the conn and accept |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 719 | * |
| 720 | * Keep this function non-static for direct invocation by unit tests. |
Harald Welte | 4ed0e92 | 2009-01-10 03:17:30 +0000 | [diff] [blame] | 721 | */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 722 | int gsm48_rx_mm_serv_req(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 723 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 724 | struct gsm_network *net = msc_a_net(msc_a); |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 725 | struct gsm48_hdr *gh; |
| 726 | struct gsm48_service_request *req; |
| 727 | struct gsm48_classmark2 *cm2; |
| 728 | uint8_t *cm2_buf, cm2_len; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 729 | bool is_utran; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 730 | struct vlr_subscr *vsub; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 731 | struct osmo_mobile_identity mi; |
| 732 | int rc; |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 733 | |
Neels Hofmeyr | 5d53c60 | 2022-04-24 23:37:07 +0200 | [diff] [blame] | 734 | /* There are two ways to respond with a CM Service Reject: |
| 735 | * Directly and only send the CM Service Reject with msc_gsm48_tx_mm_serv_rej(). |
| 736 | * Decrement the CM Service use count token and send the message with msc_vlr_tx_cm_serv_rej(). |
| 737 | * |
| 738 | * Until we accept the CM Service Request message as such, there is no use count placed for the service type. |
| 739 | * So in here use msc_gsm48_tx_mm_serv_rej() to respond. |
| 740 | */ |
| 741 | |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 742 | /* Make sure that both header and CM Service Request fit into the buffer */ |
| 743 | if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*req)) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 744 | LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: wrong message size (%u < %zu)\n", |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 745 | msgb_l3len(msg), sizeof(*gh) + sizeof(*req)); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 746 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 747 | } |
| 748 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 749 | rc = osmo_mobile_identity_decode_from_l3(&mi, msg, false); |
| 750 | if (rc) { |
| 751 | LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: unable to decode Mobile Identity\n"); |
| 752 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| 753 | } |
| 754 | |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 755 | gh = (struct gsm48_hdr *) msgb_l3(msg); |
| 756 | req = (struct gsm48_service_request *) gh->data; |
| 757 | |
| 758 | /* Unfortunately in Phase1 the Classmark2 length is variable, so we cannot |
| 759 | * just use gsm48_service_request struct, and need to parse it manually. */ |
| 760 | cm2_len = gh->data[1]; |
| 761 | cm2_buf = gh->data + 2; |
| 762 | cm2 = (struct gsm48_classmark2 *) cm2_buf; |
| 763 | |
| 764 | /* Prevent buffer overrun: check the length of Classmark2 */ |
| 765 | if (cm2_buf + cm2_len > msg->tail) { |
| 766 | LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: Classmark2 " |
| 767 | "length=%u is too big\n", cm2_len); |
| 768 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| 769 | } |
| 770 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 771 | if (msc_a_is_establishing_auth_ciph(msc_a)) { |
| 772 | LOG_MSC_A(msc_a, LOGL_ERROR, |
| 773 | "Cannot accept CM Service Request, conn already busy establishing authenticity\n"); |
| 774 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_CONGESTION); |
Neels Hofmeyr | 7ce21dc | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 775 | /* or should we accept and note down the service request anyway? */ |
| 776 | } |
| 777 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 778 | msc_a->complete_layer3_type = COMPLETE_LAYER3_CM_SERVICE_REQ; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 779 | msub_update_id_from_mi(msc_a->c.msub, &mi); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 780 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "Rx CM SERVICE REQUEST cm_service_type=%s\n", |
| 781 | osmo_cm_service_type_name(req->cm_service_type)); |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 782 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 783 | switch (mi.type) { |
Harald Welte | 3995d2e | 2018-01-24 11:23:54 +0100 | [diff] [blame] | 784 | case GSM_MI_TYPE_IMSI: |
| 785 | case GSM_MI_TYPE_TMSI: |
| 786 | /* continue below */ |
| 787 | break; |
| 788 | case GSM_MI_TYPE_IMEI: |
| 789 | if (req->cm_service_type == GSM48_CMSERV_EMERGENCY) { |
| 790 | /* We don't do emergency calls by IMEI */ |
Vadim Yanitskiy | 4456065 | 2019-05-09 21:05:41 +0700 | [diff] [blame] | 791 | LOG_MSC_A(msc_a, LOGL_NOTICE, "Tx CM SERVICE REQUEST REJECT: " |
| 792 | "emergency services by IMEI are not supported\n"); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 793 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_IMEI_NOT_ACCEPTED); |
Harald Welte | 3995d2e | 2018-01-24 11:23:54 +0100 | [diff] [blame] | 794 | } |
| 795 | /* fall-through for non-emergency setup */ |
| 796 | default: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 797 | LOG_MSC_A(msc_a, LOGL_ERROR, "MI type is not expected: %s\n", gsm48_mi_type_name(mi.type)); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 798 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 799 | } |
| 800 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 801 | if (!msc_a_cm_service_type_to_use(req->cm_service_type)) |
| 802 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_SRV_OPT_NOT_SUPPORTED); |
Harald Welte | 37382ec | 2018-01-24 12:49:34 +0100 | [diff] [blame] | 803 | |
Neels Hofmeyr | 5d53c60 | 2022-04-24 23:37:07 +0200 | [diff] [blame] | 804 | /* At this point, the CM Service Request message is being accepted. |
| 805 | * Increment the matching use token, and from here on use msc_vlr_tx_cm_serv_rej() to respond in case of |
| 806 | * failure. */ |
| 807 | msc_a_get(msc_a, msc_a_cm_service_type_to_use(req->cm_service_type)); |
| 808 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 809 | if (msc_a_is_accepted(msc_a)) |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 810 | return cm_serv_reuse_conn(msc_a, &mi, req->cm_service_type); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 811 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 812 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, &mi); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 813 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 814 | is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| 815 | vlr_proc_acc_req(msc_a->c.fi, |
| 816 | MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| 817 | net->vlr, msc_a, |
| 818 | VLR_PR_ARQ_T_CM_SERV_REQ, |
| 819 | req->cm_service_type, |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 820 | &mi, &msc_a->via_cell.lai, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 821 | is_utran || net->authentication_required, |
Neels Hofmeyr | d99a607 | 2022-10-10 23:34:48 +0200 | [diff] [blame] | 822 | msc_a_is_ciphering_to_be_attempted(msc_a), |
Neels Hofmeyr | 2ea7264 | 2022-10-10 23:35:47 +0200 | [diff] [blame] | 823 | msc_a_is_ciphering_required(msc_a), |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 824 | req->cipher_key_seq, |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 825 | osmo_gsm48_classmark2_is_r99(cm2, cm2_len), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 826 | is_utran); |
Holger Freyther | eb44398 | 2009-06-04 13:58:42 +0000 | [diff] [blame] | 827 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 828 | /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
Thorsten Alteholz | 3a357de | 2019-07-16 20:51:16 +0200 | [diff] [blame] | 829 | * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occurred? */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 830 | vsub = msc_a_vsub(msc_a); |
| 831 | if (!vsub) { |
| 832 | LOG_MSC_A(msc_a, LOGL_ERROR, "subscriber not allowed to do a CM Service Request\n"); |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 833 | return -EIO; |
| 834 | } |
| 835 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 836 | vsub->classmark.classmark2 = *cm2; |
Vadim Yanitskiy | b380a8c | 2019-05-08 16:11:29 +0700 | [diff] [blame] | 837 | vsub->classmark.classmark2_len = cm2_len; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 838 | return 0; |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 839 | } |
| 840 | |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 841 | /* Receive a CM Re-establish Request */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 842 | static int gsm48_rx_cm_reest_req(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 843 | { |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 844 | struct gsm_network *net = msc_a_net(msc_a); |
| 845 | struct gsm48_hdr *gh; |
| 846 | struct gsm48_service_request *req; |
| 847 | struct gsm48_classmark2 *cm2; |
| 848 | uint8_t *cm2_buf, cm2_len; |
| 849 | bool is_utran; |
| 850 | struct vlr_subscr *vsub; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 851 | struct osmo_mobile_identity mi; |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 852 | struct msub *prev_msub; |
| 853 | struct msc_a *prev_msc_a; |
| 854 | |
Philipp Maier | 9194b33 | 2020-09-11 21:26:23 +0200 | [diff] [blame] | 855 | int rc = osmo_mobile_identity_decode_from_l3(&mi, msg, false); |
| 856 | if (rc) { |
| 857 | LOGP(DMM, LOGL_ERROR, "CM RE-ESTABLISH REQUEST: cannot decode Mobile Identity\n"); |
| 858 | return -EINVAL; |
| 859 | } |
| 860 | |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 861 | msc_a->complete_layer3_type = COMPLETE_LAYER3_CM_RE_ESTABLISH_REQ; |
| 862 | msub_update_id_from_mi(msc_a->c.msub, &mi); |
| 863 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 864 | DEBUGP(DMM, "<- CM RE-ESTABLISH REQUEST %s\n", osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 865 | |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 866 | gh = (struct gsm48_hdr *) msgb_l3(msg); |
| 867 | req = (struct gsm48_service_request *) gh->data; |
| 868 | |
| 869 | /* Unfortunately in Phase1 the Classmark2 length is variable, so we cannot |
| 870 | * just use gsm48_service_request struct, and need to parse it manually. */ |
| 871 | cm2_len = gh->data[1]; |
| 872 | cm2_buf = gh->data + 2; |
| 873 | cm2 = (struct gsm48_classmark2 *) cm2_buf; |
| 874 | |
| 875 | /* Prevent buffer overrun: check the length of Classmark2 */ |
| 876 | if (cm2_buf + cm2_len > msg->tail) { |
| 877 | LOG_MSC_A(msc_a, LOGL_ERROR, "Rx CM SERVICE REQUEST: Classmark2 " |
| 878 | "length=%u is too big\n", cm2_len); |
| 879 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_INCORRECT_MESSAGE); |
| 880 | } |
| 881 | |
| 882 | /* Look up the other, previously active connection for this subscriber */ |
| 883 | vsub = vlr_subscr_find_by_mi(net->vlr, &mi, __func__); |
| 884 | prev_msub = msub_for_vsub(vsub); |
| 885 | prev_msc_a = msub_msc_a(prev_msub); |
| 886 | if (!vsub || !prev_msub || !prev_msc_a) { |
| 887 | LOG_MSC_A(msc_a, LOGL_ERROR, "CM Re-Establish Request for unknown subscriber: %s\n", |
| 888 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
| 889 | if (vsub) |
| 890 | vlr_subscr_put(vsub, __func__); |
| 891 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_CALL_CAN_NOT_BE_IDENTIFIED); |
| 892 | } |
| 893 | |
| 894 | LOG_MSC_A(msc_a, LOGL_NOTICE, "New conn requesting Re-Establishment\n"); |
| 895 | LOG_MSC_A(prev_msc_a, LOGL_NOTICE, "Old conn matching Re-Establishment request (%s)\n", |
| 896 | osmo_use_count_to_str_c(OTC_SELECT, &prev_msc_a->use_count)); |
| 897 | |
| 898 | if (!prev_msc_a->cc.call_leg || !prev_msc_a->cc.active_trans) { |
| 899 | LOG_MSC_A(msc_a, LOGL_ERROR, "CM Re-Establish Request only supported for voice calls\n"); |
| 900 | if (vsub) |
| 901 | vlr_subscr_put(vsub, __func__); |
| 902 | return msc_gsm48_tx_mm_serv_rej(msc_a, GSM48_REJECT_CALL_CAN_NOT_BE_IDENTIFIED); |
| 903 | } |
| 904 | |
| 905 | msc_a_get(prev_msc_a, __func__); |
| 906 | |
| 907 | /* Move the call_leg and active CC trans over to the new msc_a */ |
| 908 | call_leg_reparent(prev_msc_a->cc.call_leg, |
| 909 | msc_a->c.fi, |
| 910 | MSC_EV_CALL_LEG_TERM, |
| 911 | MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE, |
| 912 | MSC_EV_CALL_LEG_RTP_COMPLETE); |
| 913 | msc_a->cc.call_leg = prev_msc_a->cc.call_leg; |
| 914 | prev_msc_a->cc.call_leg = NULL; |
| 915 | |
| 916 | msc_a->cc.active_trans = prev_msc_a->cc.active_trans; |
| 917 | msc_a->cc.active_trans->msc_a = msc_a; |
| 918 | msc_a_get(msc_a, MSC_A_USE_CC); |
| 919 | prev_msc_a->cc.active_trans = NULL; |
| 920 | msc_a_put(prev_msc_a, MSC_A_USE_CC); |
| 921 | |
| 922 | /* Dis-associate the VLR subscriber from the previous msc_a, so that we can start a new Process Access Request |
| 923 | * on the new msc_a. */ |
| 924 | if (vsub->proc_arq_fsm) { |
| 925 | osmo_fsm_inst_term(vsub->proc_arq_fsm, OSMO_FSM_TERM_REGULAR, NULL); |
| 926 | vsub->proc_arq_fsm = NULL; |
| 927 | } |
| 928 | if (prev_msub->vsub) { |
| 929 | vlr_subscr_put(prev_msub->vsub, VSUB_USE_MSUB); |
| 930 | prev_msub->vsub = NULL; |
| 931 | } |
| 932 | |
| 933 | /* Clear the previous conn. |
| 934 | * FIXME: we are clearing the previous conn before having authenticated the new conn. That means anyone can send |
| 935 | * CM Re-Establishing requests with arbitrary mobile identities without having to authenticate, and can freely |
| 936 | * Clear any connections at will. */ |
| 937 | msc_a_release_cn(prev_msc_a); |
| 938 | msc_a_put(prev_msc_a, __func__); |
| 939 | prev_msc_a = NULL; |
| 940 | |
| 941 | /* Kick off Authentication and Ciphering for the new conn. */ |
| 942 | is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| 943 | vlr_proc_acc_req(msc_a->c.fi, |
| 944 | MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| 945 | net->vlr, msc_a, |
| 946 | VLR_PR_ARQ_T_CM_RE_ESTABLISH_REQ, 0, |
| 947 | &mi, &msc_a->via_cell.lai, |
| 948 | is_utran || net->authentication_required, |
Neels Hofmeyr | d99a607 | 2022-10-10 23:34:48 +0200 | [diff] [blame] | 949 | msc_a_is_ciphering_to_be_attempted(msc_a), |
Neels Hofmeyr | 2ea7264 | 2022-10-10 23:35:47 +0200 | [diff] [blame] | 950 | msc_a_is_ciphering_required(msc_a), |
Neels Hofmeyr | ae98b97 | 2021-07-27 03:46:49 +0200 | [diff] [blame] | 951 | req->cipher_key_seq, |
| 952 | osmo_gsm48_classmark2_is_r99(cm2, cm2_len), |
| 953 | is_utran); |
| 954 | vlr_subscr_put(vsub, __func__); |
| 955 | |
| 956 | /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START, and we expect |
| 957 | * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occurred? */ |
| 958 | vsub = msc_a_vsub(msc_a); |
| 959 | if (!vsub) { |
| 960 | LOG_MSC_A(msc_a, LOGL_ERROR, "subscriber not allowed to do a CM Service Request\n"); |
| 961 | return -EIO; |
| 962 | } |
| 963 | |
| 964 | vsub->classmark.classmark2 = *cm2; |
| 965 | vsub->classmark.classmark2_len = cm2_len; |
| 966 | return 0; |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 967 | } |
| 968 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 969 | static int gsm48_rx_mm_imsi_detach_ind(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 970 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 971 | struct gsm_network *net = msc_a_net(msc_a); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 972 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 973 | struct gsm48_imsi_detach_ind *idi = |
| 974 | (struct gsm48_imsi_detach_ind *) gh->data; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 975 | struct osmo_mobile_identity mi; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 976 | struct vlr_subscr *vsub = NULL; |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 977 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 978 | int rc = osmo_mobile_identity_decode_from_l3(&mi, msg, false); |
| 979 | if (rc) { |
| 980 | LOGP(DMM, LOGL_ERROR, "IMSI DETACH INDICATION: cannot decode Mobile Identity\n"); |
| 981 | return -EINVAL; |
| 982 | } |
| 983 | |
| 984 | DEBUGP(DMM, "IMSI DETACH INDICATION: %s\n", osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 985 | |
Pau Espin Pedrol | 2e21a68 | 2021-06-04 16:45:44 +0200 | [diff] [blame] | 986 | rate_ctr_inc(rate_ctr_group_get_ctr(net->msc_ctrs, MSC_CTR_LOC_UPDATE_TYPE_DETACH)); |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 987 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 988 | switch (mi.type) { |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 989 | case GSM_MI_TYPE_TMSI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 990 | vsub = vlr_subscr_find_by_tmsi(net->vlr, mi.tmsi, __func__); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 991 | break; |
| 992 | case GSM_MI_TYPE_IMSI: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 993 | vsub = vlr_subscr_find_by_imsi(net->vlr, mi.imsi, __func__); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 994 | break; |
| 995 | case GSM_MI_TYPE_IMEI: |
| 996 | case GSM_MI_TYPE_IMEISV: |
| 997 | /* no sim card... FIXME: what to do ? */ |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 998 | LOGP(DMM, LOGL_ERROR, "%s: unimplemented mobile identity type\n", |
| 999 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1000 | break; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1001 | default: |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1002 | LOGP(DMM, LOGL_ERROR, "%s: unknown mobile identity type\n", |
| 1003 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1004 | break; |
| 1005 | } |
| 1006 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1007 | if (!vsub) { |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1008 | LOGP(DMM, LOGL_ERROR, "IMSI DETACH for unknown subscriber %s\n", |
| 1009 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1010 | } else { |
| 1011 | LOGP(DMM, LOGL_INFO, "IMSI DETACH for %s\n", vlr_subscr_name(vsub)); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1012 | msub_set_vsub(msc_a->c.msub, vsub); |
Neels Hofmeyr | facd57a | 2017-12-15 03:48:48 +0100 | [diff] [blame] | 1013 | |
| 1014 | if (vsub->cs.is_paging) |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1015 | paging_expired(vsub); |
Neels Hofmeyr | facd57a | 2017-12-15 03:48:48 +0100 | [diff] [blame] | 1016 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1017 | vsub->classmark.classmark1 = idi->classmark1; |
| 1018 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1019 | vlr_subscr_rx_imsi_detach(vsub); |
| 1020 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_DETACHED, vsub); |
Neels Hofmeyr | 7c5346c | 2019-02-19 02:36:35 +0100 | [diff] [blame] | 1021 | vlr_subscr_put(vsub, __func__); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1022 | } |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1023 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1024 | msc_a_release_cn(msc_a); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1025 | return 0; |
| 1026 | } |
| 1027 | |
Harald Welte | d2a7f5a | 2009-06-05 20:08:20 +0000 | [diff] [blame] | 1028 | static int gsm48_rx_mm_status(struct msgb *msg) |
| 1029 | { |
| 1030 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1031 | |
| 1032 | DEBUGP(DMM, "MM STATUS (reject cause 0x%02x)\n", gh->data[0]); |
| 1033 | |
| 1034 | return 0; |
| 1035 | } |
| 1036 | |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1037 | static int parse_gsm_auth_resp(uint8_t *res, uint8_t *res_len, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1038 | struct msc_a *msc_a, |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1039 | struct msgb *msg) |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 1040 | { |
| 1041 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1042 | struct gsm48_auth_resp *ar = (struct gsm48_auth_resp*) gh->data; |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 1043 | |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1044 | if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*ar)) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1045 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: l3 length invalid: %u\n", |
| 1046 | msgb_l3len(msg)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1047 | return -EINVAL; |
| 1048 | } |
| 1049 | |
| 1050 | *res_len = sizeof(ar->sres); |
| 1051 | memcpy(res, ar->sres, sizeof(ar->sres)); |
| 1052 | return 0; |
| 1053 | } |
| 1054 | |
| 1055 | static int parse_umts_auth_resp(uint8_t *res, uint8_t *res_len, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1056 | struct msc_a *msc_a, |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1057 | struct msgb *msg) |
| 1058 | { |
| 1059 | struct gsm48_hdr *gh; |
| 1060 | uint8_t *data; |
| 1061 | uint8_t iei; |
| 1062 | uint8_t ie_len; |
| 1063 | unsigned int data_len; |
| 1064 | |
| 1065 | /* First parse the GSM part */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1066 | if (parse_gsm_auth_resp(res, res_len, msc_a, msg)) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1067 | return -EINVAL; |
| 1068 | OSMO_ASSERT(*res_len == 4); |
| 1069 | |
| 1070 | /* Then add the extended res part */ |
| 1071 | gh = msgb_l3(msg); |
| 1072 | data = gh->data + sizeof(struct gsm48_auth_resp); |
| 1073 | data_len = msgb_l3len(msg) - (data - (uint8_t*)msgb_l3(msg)); |
| 1074 | |
| 1075 | if (data_len < 3) { |
Vadim Yanitskiy | 2fca80e | 2019-05-08 16:53:23 +0700 | [diff] [blame] | 1076 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: " |
| 1077 | "message length=%u is too short\n", data_len); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1078 | return -EINVAL; |
| 1079 | } |
| 1080 | |
| 1081 | iei = data[0]; |
| 1082 | ie_len = data[1]; |
| 1083 | if (iei != GSM48_IE_AUTH_RES_EXT) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1084 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION RESPONSE: expected IEI 0x%02x, got 0x%02x\n", |
| 1085 | GSM48_IE_AUTH_RES_EXT, iei); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1086 | return -EINVAL; |
| 1087 | } |
| 1088 | |
| 1089 | if (ie_len > 12) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1090 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| 1091 | "MM R99 AUTHENTICATION RESPONSE: extended Auth Resp IE 0x%02x is too large: %u bytes\n", |
| 1092 | GSM48_IE_AUTH_RES_EXT, ie_len); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1093 | return -EINVAL; |
| 1094 | } |
| 1095 | |
| 1096 | *res_len += ie_len; |
| 1097 | memcpy(res + 4, &data[2], ie_len); |
| 1098 | return 0; |
| 1099 | } |
| 1100 | |
| 1101 | /* Chapter 9.2.3: Authentication Response */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1102 | static int gsm48_rx_mm_auth_resp(struct msc_a *msc_a, struct msgb *msg) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1103 | { |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1104 | uint8_t res[16]; |
| 1105 | uint8_t res_len; |
| 1106 | int rc; |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1107 | bool is_umts; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1108 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1109 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1110 | if (!vsub) { |
| 1111 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM AUTHENTICATION RESPONSE: invalid: no subscriber\n"); |
| 1112 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1113 | return -EINVAL; |
| 1114 | } |
| 1115 | |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1116 | is_umts = (msgb_l3len(msg) > sizeof(struct gsm48_hdr) + sizeof(struct gsm48_auth_resp)); |
| 1117 | |
| 1118 | if (is_umts) |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1119 | rc = parse_umts_auth_resp(res, &res_len, msc_a, msg); |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1120 | else |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1121 | rc = parse_gsm_auth_resp(res, &res_len, msc_a, msg); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1122 | |
| 1123 | if (rc) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1124 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, |
| 1125 | "MM AUTHENTICATION RESPONSE: invalid: parsing %s AKA Auth Response" |
| 1126 | " failed with rc=%d; dispatching zero length SRES/RES to trigger failure\n", |
| 1127 | is_umts ? "UMTS" : "GSM", rc); |
Neels Hofmeyr | 8e0af0b | 2018-03-10 03:32:18 +0100 | [diff] [blame] | 1128 | memset(res, 0, sizeof(res)); |
| 1129 | res_len = 0; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1130 | } |
| 1131 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1132 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "MM %s AUTHENTICATION RESPONSE (%s = %s)\n", |
| 1133 | is_umts ? "UMTS" : "GSM", is_umts ? "res" : "sres", |
| 1134 | osmo_hexdump_nospc(res, res_len)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1135 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1136 | return vlr_subscr_rx_auth_resp(vsub, osmo_gsm48_classmark_is_r99(&vsub->classmark), |
| 1137 | msc_a->c.ran->type == OSMO_RAT_UTRAN_IU, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1138 | res, res_len); |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 1139 | } |
| 1140 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1141 | static int gsm48_rx_mm_auth_fail(struct msc_a *msc_a, struct msgb *msg) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1142 | { |
| 1143 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1144 | uint8_t cause; |
| 1145 | uint8_t auts_tag; |
| 1146 | uint8_t auts_len; |
| 1147 | uint8_t *auts; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1148 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1149 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1150 | if (!vsub) { |
| 1151 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION FAILURE: invalid: no subscriber\n"); |
| 1152 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1153 | return -EINVAL; |
| 1154 | } |
| 1155 | |
| 1156 | if (msgb_l3len(msg) < sizeof(*gh) + 1) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1157 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "MM R99 AUTHENTICATION FAILURE: l3 length invalid: %u\n", |
| 1158 | msgb_l3len(msg)); |
| 1159 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1160 | return -EINVAL; |
| 1161 | } |
| 1162 | |
| 1163 | cause = gh->data[0]; |
| 1164 | |
| 1165 | if (cause != GSM48_REJECT_SYNCH_FAILURE) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1166 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, "MM R99 AUTHENTICATION FAILURE: cause 0x%0x\n", cause); |
| 1167 | vlr_subscr_rx_auth_fail(vsub, NULL); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1168 | return 0; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1169 | } |
| 1170 | |
| 1171 | /* This is a Synch Failure procedure, which should pass an AUTS to |
| 1172 | * resynchronize the sequence nr with the HLR. Expecting exactly one |
| 1173 | * TLV with 14 bytes of AUTS. */ |
| 1174 | |
| 1175 | if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1176 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| 1177 | "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure: missing AUTS IE\n"); |
| 1178 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1179 | return -EINVAL; |
| 1180 | } |
| 1181 | |
| 1182 | auts_tag = gh->data[1]; |
| 1183 | auts_len = gh->data[2]; |
| 1184 | auts = &gh->data[3]; |
| 1185 | |
| 1186 | if (auts_tag != GSM48_IE_AUTS |
| 1187 | || auts_len != 14) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1188 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| 1189 | "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure:" |
| 1190 | " expected AUTS IE 0x%02x of 14 bytes," |
| 1191 | " got IE 0x%02x of %u bytes\n", |
| 1192 | GSM48_IE_AUTS, auts_tag, auts_len); |
| 1193 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1194 | return -EINVAL; |
| 1195 | } |
| 1196 | |
| 1197 | if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2 + auts_len) { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1198 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_INFO, |
| 1199 | "MM R99 AUTHENTICATION FAILURE: invalid Synch Failure msg: message truncated (%u)\n", |
| 1200 | msgb_l3len(msg)); |
| 1201 | msc_a_release_mo(msc_a, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1202 | return -EINVAL; |
| 1203 | } |
| 1204 | |
| 1205 | /* We have an AUTS IE with exactly 14 bytes of AUTS and the msgb is |
| 1206 | * large enough. */ |
| 1207 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1208 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "MM R99 AUTHENTICATION SYNCH (AUTS = %s)\n", |
| 1209 | osmo_hexdump_nospc(auts, 14)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1210 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1211 | return vlr_subscr_rx_auth_fail(vsub, auts); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1212 | } |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1213 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1214 | static int gsm48_rx_mm_tmsi_reall_compl(struct msc_a *msc_a) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1215 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1216 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| 1217 | if (!vsub) { |
| 1218 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_ERROR, "Rx MM TMSI Reallocation Complete: invalid: no subscriber\n"); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1219 | return -EINVAL; |
| 1220 | } |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1221 | LOG_MSC_A_CAT(msc_a, DMM, LOGL_DEBUG, "TMSI Reallocation Completed\n"); |
| 1222 | return vlr_subscr_rx_tmsi_reall_compl(vsub); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1223 | } |
| 1224 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1225 | /* Receive a GSM 04.08 Mobility Management (MM) message */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1226 | int gsm0408_rcv_mm(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1227 | { |
| 1228 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 1229 | int rc = 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1230 | |
Neels Hofmeyr | 531734a | 2016-03-14 16:13:24 +0100 | [diff] [blame] | 1231 | switch (gsm48_hdr_msg_type(gh)) { |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1232 | case GSM48_MT_MM_LOC_UPD_REQUEST: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1233 | rc = mm_rx_loc_upd_req(msc_a, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1234 | break; |
| 1235 | case GSM48_MT_MM_ID_RESP: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1236 | rc = mm_rx_id_resp(msc_a, msg); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1237 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1238 | case GSM48_MT_MM_CM_SERV_REQ: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1239 | rc = gsm48_rx_mm_serv_req(msc_a, msg); |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 1240 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1241 | case GSM48_MT_MM_STATUS: |
Harald Welte | d2a7f5a | 2009-06-05 20:08:20 +0000 | [diff] [blame] | 1242 | rc = gsm48_rx_mm_status(msg); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1243 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1244 | case GSM48_MT_MM_TMSI_REALL_COMPL: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1245 | rc = gsm48_rx_mm_tmsi_reall_compl(msc_a); |
Harald Welte | 69b2af2 | 2009-01-06 19:47:00 +0000 | [diff] [blame] | 1246 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1247 | case GSM48_MT_MM_IMSI_DETACH_IND: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1248 | rc = gsm48_rx_mm_imsi_detach_ind(msc_a, msg); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1249 | break; |
| 1250 | case GSM48_MT_MM_CM_REEST_REQ: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1251 | rc = gsm48_rx_cm_reest_req(msc_a, msg); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1252 | break; |
| 1253 | case GSM48_MT_MM_AUTH_RESP: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1254 | rc = gsm48_rx_mm_auth_resp(msc_a, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1255 | break; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1256 | case GSM48_MT_MM_AUTH_FAIL: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1257 | rc = gsm48_rx_mm_auth_fail(msc_a, msg); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1258 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1259 | default: |
Harald Welte | 5d24ba1 | 2009-12-24 12:13:17 +0100 | [diff] [blame] | 1260 | LOGP(DMM, LOGL_NOTICE, "Unknown GSM 04.08 MM msg type 0x%02x\n", |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1261 | gh->msg_type); |
| 1262 | break; |
| 1263 | } |
| 1264 | |
| 1265 | return rc; |
| 1266 | } |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1267 | |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1268 | /* Receive a PAGING RESPONSE message from the MS */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1269 | static int gsm48_rx_rr_pag_resp(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1270 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1271 | struct gsm_network *net = msc_a_net(msc_a); |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1272 | struct gsm48_hdr *gh = msgb_l3(msg); |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 1273 | struct gsm48_pag_resp *pr = |
| 1274 | (struct gsm48_pag_resp *)gh->data; |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1275 | uint8_t classmark2_len = gh->data[1]; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1276 | uint8_t *classmark2_buf = gh->data+2; |
| 1277 | struct gsm48_classmark2 *cm2 = (void*)classmark2_buf; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1278 | bool is_utran; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1279 | struct vlr_subscr *vsub; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1280 | struct osmo_mobile_identity mi; |
| 1281 | int rc; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1282 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1283 | if (msc_a_is_establishing_auth_ciph(msc_a)) { |
Vadim Yanitskiy | 5b19f6e | 2020-01-25 07:02:47 +0700 | [diff] [blame] | 1284 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_ERROR, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1285 | "Ignoring Paging Response, conn already busy establishing authenticity\n"); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1286 | return 0; |
| 1287 | } |
| 1288 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1289 | if (msc_a_is_accepted(msc_a)) { |
Vadim Yanitskiy | 5b19f6e | 2020-01-25 07:02:47 +0700 | [diff] [blame] | 1290 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_ERROR, "Ignoring Paging Response, conn already established\n"); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1291 | return 0; |
| 1292 | } |
| 1293 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1294 | rc = osmo_mobile_identity_decode_from_l3(&mi, msg, false); |
| 1295 | if (rc) { |
| 1296 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_ERROR, "Paging Response: cannot decode Mobile Identity\n"); |
| 1297 | return -EINVAL; |
| 1298 | } |
| 1299 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1300 | msc_a->complete_layer3_type = COMPLETE_LAYER3_PAGING_RESP; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1301 | msub_update_id_from_mi(msc_a->c.msub, &mi); |
| 1302 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_DEBUG, "Rx PAGING RESPONSE %s\n", osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Neels Hofmeyr | 6d804b1 | 2017-02-18 22:20:46 +0100 | [diff] [blame] | 1303 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1304 | msc_a_get(msc_a, MSC_A_USE_PAGING_RESPONSE); |
| 1305 | |
| 1306 | is_utran = (msc_a->c.ran->type == OSMO_RAT_UTRAN_IU); |
| 1307 | vlr_proc_acc_req(msc_a->c.fi, |
| 1308 | MSC_A_EV_AUTHENTICATED, MSC_A_EV_CN_CLOSE, NULL, |
| 1309 | net->vlr, msc_a, |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1310 | VLR_PR_ARQ_T_PAGING_RESP, 0, &mi, &msc_a->via_cell.lai, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1311 | is_utran || net->authentication_required, |
Neels Hofmeyr | d99a607 | 2022-10-10 23:34:48 +0200 | [diff] [blame] | 1312 | msc_a_is_ciphering_to_be_attempted(msc_a), |
Neels Hofmeyr | 2ea7264 | 2022-10-10 23:35:47 +0200 | [diff] [blame] | 1313 | msc_a_is_ciphering_required(msc_a), |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 1314 | pr->key_seq, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1315 | osmo_gsm48_classmark2_is_r99(cm2, classmark2_len), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1316 | is_utran); |
Holger Freyther | 053e09d | 2009-02-14 22:51:06 +0000 | [diff] [blame] | 1317 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1318 | /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
Thorsten Alteholz | 3a357de | 2019-07-16 20:51:16 +0200 | [diff] [blame] | 1319 | * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occurred? */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1320 | vsub = msc_a_vsub(msc_a); |
| 1321 | if (!vsub) { |
Vadim Yanitskiy | 5b19f6e | 2020-01-25 07:02:47 +0700 | [diff] [blame] | 1322 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_ERROR, "subscriber not allowed to do a Paging Response\n"); |
Neels Hofmeyr | 667d5e0 | 2020-08-19 13:40:33 +0000 | [diff] [blame] | 1323 | |
| 1324 | /* Above MSC_A_USE_PAGING_RESPONSE may already have been removed by a forced release, put that use only |
| 1325 | * if it still exists. (see msc_a_fsm_releasing_onenter()) */ |
| 1326 | if (osmo_use_count_by(&msc_a->use_count, MSC_A_USE_PAGING_RESPONSE)) |
| 1327 | msc_a_put(msc_a, MSC_A_USE_PAGING_RESPONSE); |
| 1328 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1329 | return -EIO; |
| 1330 | } |
| 1331 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1332 | vsub->classmark.classmark2 = *cm2; |
| 1333 | vsub->classmark.classmark2_len = classmark2_len; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1334 | return 0; |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1335 | } |
| 1336 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1337 | static int gsm48_rx_rr_ciphering_mode_complete(struct msc_a *msc_a, struct msgb *msg) |
| 1338 | { |
| 1339 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
| 1340 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1341 | unsigned int payload_len = msgb_l3len(msg) - sizeof(*gh); |
| 1342 | struct tlv_parsed tp; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1343 | struct tlv_p_entry *mi_tlv; |
| 1344 | struct osmo_mobile_identity mi; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1345 | |
| 1346 | tlv_parse(&tp, &gsm48_att_tlvdef, gh->data, payload_len, 0, 0); |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1347 | mi_tlv = TLVP_GET(&tp, GSM48_IE_MOBILE_ID); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1348 | |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 1349 | /* IMEI(SV) is optional for this message */ |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1350 | if (!mi_tlv) |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1351 | return 0; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1352 | if (!mi_tlv->len) |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 1353 | return -EINVAL; |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1354 | |
| 1355 | if (osmo_mobile_identity_decode(&mi, mi_tlv->val, mi_tlv->len, false)) { |
| 1356 | LOGP(DMM, LOGL_ERROR, "RR Ciphering Mode Complete contains invalid Mobile Identity %s\n", |
| 1357 | osmo_hexdump(mi_tlv->val, mi_tlv->len)); |
| 1358 | return -EINVAL; |
| 1359 | } |
| 1360 | if (mi.type != GSM_MI_TYPE_IMEISV) { |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 1361 | LOGP(DMM, LOGL_ERROR, "RR Ciphering Mode Complete contains " |
| 1362 | "unexpected Mobile Identity type %s\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1363 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 1364 | return -EINVAL; |
| 1365 | } |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1366 | |
Neels Hofmeyr | 38816da | 2019-08-29 00:43:18 +0200 | [diff] [blame] | 1367 | LOG_MSC_A(msc_a, LOGL_DEBUG, "RR Ciphering Mode Complete contains Mobile Identity: %s\n", |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1368 | osmo_mobile_identity_to_str_c(OTC_SELECT, &mi)); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1369 | |
| 1370 | if (!vsub) |
| 1371 | return 0; |
| 1372 | |
Neels Hofmeyr | 46d526a | 2020-05-29 03:27:50 +0200 | [diff] [blame] | 1373 | return vlr_subscr_rx_id_resp(vsub, &mi); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1374 | } |
| 1375 | |
| 1376 | static int gsm48_rx_rr_app_info(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1377 | { |
| 1378 | struct gsm48_hdr *gh = msgb_l3(msg); |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 1379 | uint8_t apdu_id_flags; |
| 1380 | uint8_t apdu_len; |
| 1381 | uint8_t *apdu_data; |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1382 | |
| 1383 | apdu_id_flags = gh->data[0]; |
| 1384 | apdu_len = gh->data[1]; |
| 1385 | apdu_data = gh->data+2; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1386 | |
Vadim Yanitskiy | 6a9a3a7 | 2020-01-25 06:53:50 +0700 | [diff] [blame] | 1387 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_DEBUG, "Rx RR APPLICATION INFO " |
| 1388 | "(id/flags=0x%02x apdu_len=%u apdu=%s)\n", |
| 1389 | apdu_id_flags, apdu_len, osmo_hexdump(apdu_data, apdu_len)); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1390 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1391 | /* we're not using the app info blob anywhere, so ignore. */ |
| 1392 | #if 0 |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1393 | return db_apdu_blob_store(conn->subscr, apdu_id_flags, apdu_len, apdu_data); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1394 | #else |
| 1395 | return 0; |
| 1396 | #endif |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1397 | } |
| 1398 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1399 | /* Receive a GSM 04.08 Radio Resource (RR) message */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1400 | int gsm0408_rcv_rr(struct msc_a *msc_a, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1401 | { |
| 1402 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1403 | int rc = 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1404 | |
| 1405 | switch (gh->msg_type) { |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1406 | case GSM48_MT_RR_PAG_RESP: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1407 | rc = gsm48_rx_rr_pag_resp(msc_a, msg); |
| 1408 | break; |
| 1409 | case GSM48_MT_RR_CIPH_M_COMPL: |
| 1410 | rc = gsm48_rx_rr_ciphering_mode_complete(msc_a, msg); |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1411 | break; |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1412 | case GSM48_MT_RR_APP_INFO: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1413 | rc = gsm48_rx_rr_app_info(msc_a, msg); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1414 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1415 | default: |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1416 | LOG_MSC_A_CAT(msc_a, DRR, LOGL_NOTICE, "MSC: Unimplemented %s GSM 04.08 RR " |
| 1417 | "message\n", gsm48_rr_msg_name(gh->msg_type)); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1418 | break; |
| 1419 | } |
| 1420 | |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1421 | return rc; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1422 | } |
| 1423 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1424 | int gsm48_send_rr_app_info(struct msc_a *msc_a, uint8_t apdu_id, |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 1425 | uint8_t apdu_len, const uint8_t *apdu) |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1426 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 1427 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 APP INF"); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1428 | struct gsm48_hdr *gh; |
| 1429 | |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1430 | DEBUGP(DRR, "TX APPLICATION INFO id=0x%02x, len=%u\n", |
| 1431 | apdu_id, apdu_len); |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1432 | |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1433 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 2 + apdu_len); |
| 1434 | gh->proto_discr = GSM48_PDISC_RR; |
| 1435 | gh->msg_type = GSM48_MT_RR_APP_INFO; |
| 1436 | gh->data[0] = apdu_id; |
| 1437 | gh->data[1] = apdu_len; |
| 1438 | memcpy(gh->data+2, apdu, apdu_len); |
| 1439 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1440 | return msc_a_tx_dtap_to_i(msc_a, msg); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1441 | } |
| 1442 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1443 | extern int gsm0408_rcv_cc(struct msc_a *msc_a, struct msgb *msg); |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 1444 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1445 | /*********************************************************************** |
| 1446 | * VLR integration |
| 1447 | ***********************************************************************/ |
| 1448 | |
| 1449 | /* VLR asks us to send an authentication request */ |
Neels Hofmeyr | 8b6e536 | 2018-11-30 02:57:33 +0100 | [diff] [blame] | 1450 | static int msc_vlr_tx_auth_req(void *msc_conn_ref, struct vlr_auth_tuple *at, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1451 | bool send_autn) |
| 1452 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1453 | struct msc_a *msc_a = msc_conn_ref; |
| 1454 | return gsm48_tx_mm_auth_req(msc_a, at->vec.rand, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1455 | send_autn? at->vec.autn : NULL, |
| 1456 | at->key_seq); |
| 1457 | } |
| 1458 | |
| 1459 | /* VLR asks us to send an authentication reject */ |
| 1460 | static int msc_vlr_tx_auth_rej(void *msc_conn_ref) |
| 1461 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1462 | struct msc_a *msc_a = msc_conn_ref; |
| 1463 | return gsm48_tx_mm_auth_rej(msc_a); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1464 | } |
| 1465 | |
| 1466 | /* VLR asks us to transmit an Identity Request of given type */ |
| 1467 | static int msc_vlr_tx_id_req(void *msc_conn_ref, uint8_t mi_type) |
| 1468 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1469 | struct msc_a *msc_a = msc_conn_ref; |
Vadim Yanitskiy | a79aac0 | 2019-12-28 01:19:19 +0100 | [diff] [blame] | 1470 | |
| 1471 | /* Store requested MI type, so we can check the response */ |
| 1472 | msc_a->mm_id_req_type = mi_type; |
| 1473 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1474 | return mm_tx_identity_req(msc_a, mi_type); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1475 | } |
| 1476 | |
| 1477 | /* VLR asks us to transmit a Location Update Accept */ |
| 1478 | static int msc_vlr_tx_lu_acc(void *msc_conn_ref, uint32_t send_tmsi) |
| 1479 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1480 | struct msc_a *msc_a = msc_conn_ref; |
| 1481 | return gsm0408_loc_upd_acc(msc_a, send_tmsi); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1482 | } |
| 1483 | |
| 1484 | /* VLR asks us to transmit a Location Update Reject */ |
Neels Hofmeyr | 1580959 | 2018-04-06 02:57:51 +0200 | [diff] [blame] | 1485 | static int msc_vlr_tx_lu_rej(void *msc_conn_ref, enum gsm48_reject_value cause) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1486 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1487 | struct msc_a *msc_a = msc_conn_ref; |
| 1488 | return gsm0408_loc_upd_rej(msc_a, cause); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1489 | } |
| 1490 | |
| 1491 | /* VLR asks us to transmit a CM Service Accept */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1492 | int msc_vlr_tx_cm_serv_acc(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1493 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1494 | struct msc_a *msc_a = msc_conn_ref; |
| 1495 | return msc_gsm48_tx_mm_serv_ack(msc_a); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1496 | } |
| 1497 | |
| 1498 | static int msc_vlr_tx_common_id(void *msc_conn_ref) |
| 1499 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1500 | struct msc_a *msc_a = msc_conn_ref; |
Pau Espin Pedrol | 6710670 | 2021-04-27 18:20:15 +0200 | [diff] [blame] | 1501 | struct vlr_subscr *vsub = msc_a_vsub(msc_a); |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1502 | struct ran_msg msg = { |
| 1503 | .msg_type = RAN_MSG_COMMON_ID, |
| 1504 | .common_id = { |
Pau Espin Pedrol | 6710670 | 2021-04-27 18:20:15 +0200 | [diff] [blame] | 1505 | .imsi = vsub->imsi, |
| 1506 | .last_eutran_plmn_present = vsub->sgs.last_eutran_plmn_present, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1507 | }, |
| 1508 | }; |
Pau Espin Pedrol | 6710670 | 2021-04-27 18:20:15 +0200 | [diff] [blame] | 1509 | if (vsub->sgs.last_eutran_plmn_present) { |
| 1510 | memcpy(&msg.common_id.last_eutran_plmn, &vsub->sgs.last_eutran_plmn, |
| 1511 | sizeof(vsub->sgs.last_eutran_plmn)); |
| 1512 | } |
| 1513 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1514 | return msc_a_ran_down(msc_a, MSC_ROLE_I, &msg); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1515 | } |
| 1516 | |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1517 | /* VLR asks us to transmit MM info. */ |
| 1518 | static int msc_vlr_tx_mm_info(void *msc_conn_ref) |
| 1519 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1520 | struct msc_a *msc_a = msc_conn_ref; |
| 1521 | struct gsm_network *net = msc_a_net(msc_a); |
| 1522 | if (!net->send_mm_info) |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1523 | return 0; |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1524 | return gsm48_tx_mm_info(msc_a); |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1525 | } |
| 1526 | |
Neels Hofmeyr | 5d53c60 | 2022-04-24 23:37:07 +0200 | [diff] [blame] | 1527 | /* VLR asks us to transmit a CM Service Reject. |
| 1528 | * Decrement the CM Service type's use token and send the CM Service Reject message. */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1529 | static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum osmo_cm_service_type cm_service_type, |
| 1530 | enum gsm48_reject_value cause) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1531 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1532 | struct msc_a *msc_a = msc_conn_ref; |
| 1533 | msc_gsm48_tx_mm_serv_rej(msc_a, cause); |
| 1534 | msc_a_put(msc_a, msc_a_cm_service_type_to_use(cm_service_type)); |
| 1535 | return 0; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1536 | } |
| 1537 | |
| 1538 | /* VLR informs us that the subscriber data has somehow been modified */ |
| 1539 | static void msc_vlr_subscr_update(struct vlr_subscr *subscr) |
| 1540 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1541 | struct msub *msub = msub_for_vsub(subscr); |
| 1542 | LOGVSUBP(LOGL_NOTICE, subscr, "VLR: update for IMSI=%s (MSISDN=%s)%s\n", |
| 1543 | subscr->imsi, subscr->msisdn, msub ? "" : " (NO CONN!)"); |
| 1544 | msub_update_id(msub); |
Neels Hofmeyr | 68cf957 | 2018-09-18 15:52:58 +0200 | [diff] [blame] | 1545 | } |
| 1546 | |
Neels Hofmeyr | 68f50da | 2020-06-24 14:22:52 +0200 | [diff] [blame] | 1547 | /* VLR informs us that the subscriber has been associated with a conn. |
| 1548 | * The subscriber has *not* been authenticated yet, so the vsub should be protected from potentially invalid information |
| 1549 | * from the msc_a. */ |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1550 | static int msc_vlr_subscr_assoc(void *msc_conn_ref, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1551 | struct vlr_subscr *vsub) |
| 1552 | { |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1553 | struct msc_a *msc_a = msc_conn_ref; |
| 1554 | struct msub *msub = msc_a->c.msub; |
Max | 48d4ec0 | 2018-02-12 16:51:03 +0100 | [diff] [blame] | 1555 | OSMO_ASSERT(vsub); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1556 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1557 | if (msub_set_vsub(msub, vsub)) |
| 1558 | return -EINVAL; |
Neels Hofmeyr | 68f50da | 2020-06-24 14:22:52 +0200 | [diff] [blame] | 1559 | |
| 1560 | /* FIXME: would be better to modify vsub->* only after the subscriber is authenticated, in |
| 1561 | * evaluate_acceptance_outcome(conn_accepted == true). */ |
| 1562 | |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1563 | vsub->cs.attached_via_ran = msc_a->c.ran->type; |
Neels Hofmeyr | 68cf957 | 2018-09-18 15:52:58 +0200 | [diff] [blame] | 1564 | |
| 1565 | /* In case we have already received Classmark Information before the VLR Subscriber was |
| 1566 | * associated with the conn: merge the new Classmark into vsub->classmark. Don't overwrite valid |
| 1567 | * vsub->classmark with unset classmark, though. */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1568 | osmo_gsm48_classmark_update(&vsub->classmark, &msc_a->temporary_classmark); |
| 1569 | |
| 1570 | msub_update_id(msub); |
| 1571 | |
| 1572 | osmo_fsm_inst_dispatch(msc_a->c.fi, MSC_A_EV_COMPLETE_LAYER_3_OK, NULL); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1573 | return 0; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1574 | } |
| 1575 | |
| 1576 | /* operations that we need to implement for libvlr */ |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1577 | const struct vlr_ops msc_vlr_ops = { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1578 | .tx_auth_req = msc_vlr_tx_auth_req, |
| 1579 | .tx_auth_rej = msc_vlr_tx_auth_rej, |
| 1580 | .tx_id_req = msc_vlr_tx_id_req, |
| 1581 | .tx_lu_acc = msc_vlr_tx_lu_acc, |
| 1582 | .tx_lu_rej = msc_vlr_tx_lu_rej, |
| 1583 | .tx_cm_serv_acc = msc_vlr_tx_cm_serv_acc, |
| 1584 | .tx_cm_serv_rej = msc_vlr_tx_cm_serv_rej, |
Neels Hofmeyr | c4628a3 | 2018-12-07 14:47:34 +0100 | [diff] [blame] | 1585 | .set_ciph_mode = msc_a_vlr_set_cipher_mode, |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1586 | .tx_common_id = msc_vlr_tx_common_id, |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1587 | .tx_mm_info = msc_vlr_tx_mm_info, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1588 | .subscr_update = msc_vlr_subscr_update, |
| 1589 | .subscr_assoc = msc_vlr_subscr_assoc, |
| 1590 | }; |
| 1591 | |
Neels Hofmeyr | 79e580b | 2018-03-22 16:48:22 +0100 | [diff] [blame] | 1592 | struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value) |
| 1593 | { |
| 1594 | struct msgb *msg; |
| 1595 | struct gsm48_hdr *gh; |
| 1596 | |
| 1597 | msg = gsm48_msgb_alloc_name("GSM 04.08 SERV REJ"); |
| 1598 | if (!msg) |
| 1599 | return NULL; |
| 1600 | |
| 1601 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 1602 | gh->proto_discr = GSM48_PDISC_MM; |
| 1603 | gh->msg_type = GSM48_MT_MM_CM_SERV_REJ; |
| 1604 | gh->data[0] = value; |
| 1605 | |
| 1606 | return msg; |
| 1607 | } |
| 1608 | |
| 1609 | struct msgb *gsm48_create_loc_upd_rej(uint8_t cause) |
| 1610 | { |
| 1611 | struct gsm48_hdr *gh; |
| 1612 | struct msgb *msg; |
| 1613 | |
| 1614 | msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD REJ"); |
| 1615 | if (!msg) |
| 1616 | return NULL; |
| 1617 | |
| 1618 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 1619 | gh->proto_discr = GSM48_PDISC_MM; |
| 1620 | gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT; |
| 1621 | gh->data[0] = cause; |
| 1622 | return msg; |
| 1623 | } |