Holger Hans Peter Freyther | acf8a0c | 2010-03-29 08:47:44 +0200 | [diff] [blame] | 1 | /* GSM Mobile Radio Interface Layer 3 messages on the A-bis interface |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 2 | * 3GPP TS 04.08 version 7.21.0 Release 1998 / ETSI TS 100 940 V7.21.0 */ |
| 3 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 4 | /* (C) 2008-2016 by Harald Welte <laforge@gnumonks.org> |
Holger Hans Peter Freyther | c121bb3 | 2012-12-26 10:17:42 +0100 | [diff] [blame] | 5 | * (C) 2008-2012 by Holger Hans Peter Freyther <zecke@selfish.org> |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 6 | * |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 7 | * All Rights Reserved |
| 8 | * |
| 9 | * This program is free software; you can redistribute it and/or modify |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 10 | * it under the terms of the GNU Affero General Public License as published by |
| 11 | * the Free Software Foundation; either version 3 of the License, or |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 12 | * (at your option) any later version. |
| 13 | * |
| 14 | * This program is distributed in the hope that it will be useful, |
| 15 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 16 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 17 | * GNU Affero General Public License for more details. |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 18 | * |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 19 | * You should have received a copy of the GNU Affero General Public License |
| 20 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 21 | * |
| 22 | */ |
| 23 | |
| 24 | |
| 25 | #include <stdio.h> |
| 26 | #include <stdlib.h> |
| 27 | #include <string.h> |
Max | ddee01f | 2016-05-24 14:23:27 +0200 | [diff] [blame] | 28 | #include <stdbool.h> |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 29 | #include <errno.h> |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 30 | #include <time.h> |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 31 | #include <netinet/in.h> |
Max | ddee01f | 2016-05-24 14:23:27 +0200 | [diff] [blame] | 32 | #include <regex.h> |
| 33 | #include <sys/types.h> |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 34 | |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 35 | #include "bscconfig.h" |
| 36 | |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 37 | #include <osmocom/msc/db.h> |
| 38 | #include <osmocom/msc/debug.h> |
| 39 | #include <osmocom/msc/gsm_data.h> |
| 40 | #include <osmocom/msc/gsm_subscriber.h> |
| 41 | #include <osmocom/msc/gsm_04_11.h> |
| 42 | #include <osmocom/msc/gsm_04_08.h> |
| 43 | #include <osmocom/msc/gsm_04_80.h> |
| 44 | #include <osmocom/msc/gsm_04_14.h> |
Vadim Yanitskiy | 5b860fa | 2018-06-12 05:24:52 +0700 | [diff] [blame] | 45 | #include <osmocom/msc/gsm_09_11.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 46 | #include <osmocom/msc/signal.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 47 | #include <osmocom/msc/transaction.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 48 | #include <osmocom/msc/silent_call.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 49 | #include <osmocom/msc/mncc_int.h> |
Pablo Neira Ayuso | ed5cacb | 2011-08-17 22:44:07 +0200 | [diff] [blame] | 50 | #include <osmocom/abis/e1_input.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 51 | #include <osmocom/core/bitvec.h> |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 52 | #include <osmocom/msc/vlr.h> |
| 53 | #include <osmocom/msc/msc_ifaces.h> |
Holger Hans Peter Freyther | 841c200 | 2010-09-30 18:52:23 +0800 | [diff] [blame] | 54 | |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 55 | #include <osmocom/gsm/gsm48.h> |
| 56 | #include <osmocom/gsm/gsm0480.h> |
| 57 | #include <osmocom/gsm/gsm_utils.h> |
Max | 8db12e4 | 2016-04-18 23:11:18 +0200 | [diff] [blame] | 58 | #include <osmocom/gsm/protocol/gsm_04_08.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 59 | #include <osmocom/core/msgb.h> |
| 60 | #include <osmocom/core/talloc.h> |
Neels Hofmeyr | 93bafb6 | 2017-01-13 03:12:08 +0100 | [diff] [blame] | 61 | #include <osmocom/core/utils.h> |
Philipp Maier | 621ba03 | 2017-11-07 17:19:25 +0100 | [diff] [blame] | 62 | #include <osmocom/core/byteswap.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 63 | #include <osmocom/gsm/tlv.h> |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 64 | #include <osmocom/crypt/auth.h> |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 65 | #ifdef BUILD_IU |
Neels Hofmeyr | 00e82d6 | 2017-07-05 15:19:52 +0200 | [diff] [blame] | 66 | #include <osmocom/ranap/iu_client.h> |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 67 | #endif |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 68 | |
Neels Hofmeyr | 9084396 | 2017-09-04 15:04:35 +0200 | [diff] [blame] | 69 | #include <osmocom/msc/msc_ifaces.h> |
| 70 | #include <osmocom/msc/a_iface.h> |
Philipp Maier | 621ba03 | 2017-11-07 17:19:25 +0100 | [diff] [blame] | 71 | #include <osmocom/msc/msc_mgcp.h> |
Philipp Maier | fbf6610 | 2017-04-09 12:32:51 +0200 | [diff] [blame] | 72 | |
Holger Hans Peter Freyther | 1e61b25 | 2013-07-06 11:45:38 +0200 | [diff] [blame] | 73 | #include <assert.h> |
| 74 | |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 75 | |
Harald Welte (local) | d19e58b | 2009-08-15 02:30:58 +0200 | [diff] [blame] | 76 | void *tall_locop_ctx; |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 77 | void *tall_authciphop_ctx; |
Harald Welte | 2cf161b | 2009-06-20 22:36:41 +0200 | [diff] [blame] | 78 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 79 | static int gsm0408_loc_upd_acc(struct ran_conn *conn, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 80 | uint32_t send_tmsi); |
Harald Welte | 65e74cc | 2008-12-29 01:55:35 +0000 | [diff] [blame] | 81 | |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 82 | /*! Send a simple GSM 04.08 message without any payload |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 83 | * \param conn Active RAN connection |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 84 | * \param[in] pdisc Protocol discriminator |
| 85 | * \param[in] msg_type Message type |
| 86 | * \return result of \ref gsm48_conn_sendmsg |
| 87 | */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 88 | int gsm48_tx_simple(struct ran_conn *conn, |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 89 | uint8_t pdisc, uint8_t msg_type) |
| 90 | { |
| 91 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 TX SIMPLE"); |
| 92 | struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 93 | |
| 94 | gh->proto_discr = pdisc; |
| 95 | gh->msg_type = msg_type; |
| 96 | |
| 97 | return gsm48_conn_sendmsg(msg, conn, NULL); |
| 98 | } |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 99 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 100 | static bool classmark1_is_r99(const struct gsm48_classmark1 *cm1) |
| 101 | { |
| 102 | return cm1->rev_lev >= 2; |
| 103 | } |
| 104 | |
| 105 | static bool classmark2_is_r99(const uint8_t *cm2, uint8_t cm2_len) |
| 106 | { |
| 107 | uint8_t rev_lev; |
| 108 | if (!cm2_len) |
| 109 | return false; |
| 110 | rev_lev = (cm2[0] >> 5) & 0x3; |
| 111 | return rev_lev >= 2; |
| 112 | } |
| 113 | |
Neels Hofmeyr | 9d74425 | 2018-03-22 16:09:50 +0100 | [diff] [blame] | 114 | static bool classmark_is_r99(struct gsm_classmark *cm) |
| 115 | { |
Neels Hofmeyr | 9d74425 | 2018-03-22 16:09:50 +0100 | [diff] [blame] | 116 | if (cm->classmark1_set) |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 117 | return classmark1_is_r99(&cm->classmark1); |
| 118 | return classmark2_is_r99(cm->classmark2, cm->classmark2_len); |
Neels Hofmeyr | 9d74425 | 2018-03-22 16:09:50 +0100 | [diff] [blame] | 119 | } |
| 120 | |
Neels Hofmeyr | 5769d36 | 2018-12-18 03:13:51 +0100 | [diff] [blame] | 121 | static const char *classmark_a5_name(const struct gsm_classmark *cm) |
| 122 | { |
| 123 | static char buf[128]; |
| 124 | char cm1[42]; |
| 125 | char cm2[42]; |
| 126 | char cm3[42]; |
| 127 | |
| 128 | if (cm->classmark1_set) |
| 129 | snprintf(cm1, sizeof(cm1), "cm1{a5/1=%s}", |
| 130 | cm->classmark1.a5_1 ? "not-supported":"supported" /* inverted logic */); |
| 131 | else |
| 132 | snprintf(cm1, sizeof(cm1), "no-cm1"); |
| 133 | |
| 134 | if (cm->classmark2_len >= 3) |
| 135 | snprintf(cm2, sizeof(cm2), " cm2{0x%x=%s%s}", |
| 136 | cm->classmark2[2], |
| 137 | cm->classmark2[2] & 0x1 ? " A5/2" : "", |
| 138 | cm->classmark2[2] & 0x2 ? " A5/3" : ""); |
| 139 | else |
| 140 | snprintf(cm2, sizeof(cm2), " no-cm2"); |
| 141 | |
| 142 | if (cm->classmark3_len >= 1) |
| 143 | snprintf(cm3, sizeof(cm3), " cm3{0x%x=%s%s%s%s}", |
| 144 | cm->classmark3[0], |
| 145 | cm->classmark3[0] & (1 << 0) ? " A5/4" : "", |
| 146 | cm->classmark3[0] & (1 << 1) ? " A5/5" : "", |
| 147 | cm->classmark3[0] & (1 << 2) ? " A5/6" : "", |
| 148 | cm->classmark3[0] & (1 << 3) ? " A5/7" : ""); |
| 149 | else |
| 150 | snprintf(cm3, sizeof(cm3), " no-cm3"); |
| 151 | |
| 152 | snprintf(buf, sizeof(buf), "%s%s%s", cm1, cm2, cm3); |
| 153 | return buf; |
| 154 | } |
| 155 | |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 156 | /* Determine if the given CLASSMARK (1/2/3) value permits a given A5/n cipher. |
| 157 | * Return 1 when the given A5/n is permitted, 0 when not, and negative if the respective MS CLASSMARK is |
| 158 | * not known, where the negative number indicates the classmark type: -2 means Classmark 2 is not |
| 159 | * available. */ |
| 160 | static int classmark_supports_a5(const struct gsm_classmark *cm, uint8_t a5) |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 161 | { |
| 162 | switch (a5) { |
| 163 | case 0: |
| 164 | /* all phones must implement A5/0, see 3GPP TS 43.020 4.9 */ |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 165 | return 1; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 166 | case 1: |
| 167 | /* 3GPP TS 43.020 4.9 requires A5/1 to be suppored by all phones and actually states: |
| 168 | * "The network shall not provide service to an MS which indicates that it does not |
| 169 | * support the ciphering algorithm A5/1.". However, let's be more tolerant based |
| 170 | * on policy here */ |
| 171 | /* See 3GPP TS 24.008 10.5.1.7 */ |
| 172 | if (!cm->classmark1_set) { |
| 173 | DEBUGP(DMSC, "CLASSMARK 1 unknown, assuming MS supports A5/1\n"); |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 174 | return -1; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 175 | } else { |
| 176 | if (cm->classmark1.a5_1) |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 177 | return 0; /* Inverted logic for this bit! */ |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 178 | else |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 179 | return 1; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 180 | } |
| 181 | break; |
| 182 | case 2: |
| 183 | case 3: |
| 184 | /* See 3GPP TS 24.008 10.5.1.6 */ |
| 185 | if (cm->classmark2_len < 3) { |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 186 | return -2; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 187 | } else { |
| 188 | if (cm->classmark2[2] & (1 << (a5-2))) |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 189 | return 1; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 190 | else |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 191 | return 0; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 192 | } |
| 193 | break; |
| 194 | case 4: |
| 195 | case 5: |
| 196 | case 6: |
| 197 | case 7: |
| 198 | /* See 3GPP TS 24.008 10.5.1.7 */ |
| 199 | if (cm->classmark3_len < 1) { |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 200 | return -3; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 201 | } else { |
| 202 | if (cm->classmark3[0] & (1 << (a5-4))) |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 203 | return 1; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 204 | else |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 205 | return 0; |
Harald Welte | 7133072 | 2017-12-23 19:59:02 +0100 | [diff] [blame] | 206 | } |
| 207 | break; |
| 208 | default: |
| 209 | return false; |
| 210 | } |
| 211 | } |
| 212 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 213 | int gsm48_conn_sendmsg(struct msgb *msg, struct ran_conn *conn, struct gsm_trans *trans) |
Holger Hans Peter Freyther | 9c137a7 | 2010-06-15 13:57:40 +0800 | [diff] [blame] | 214 | { |
| 215 | struct gsm48_hdr *gh = (struct gsm48_hdr *) msg->data; |
| 216 | |
| 217 | /* if we get passed a transaction reference, do some common |
| 218 | * work that the caller no longer has to do */ |
| 219 | if (trans) { |
| 220 | gh->proto_discr = trans->protocol | (trans->transaction_id << 4); |
Harald Welte | 0e2fa5d | 2018-04-09 16:35:01 +0200 | [diff] [blame] | 221 | OMSC_LINKID_CB(msg) = trans->dlci; |
Holger Hans Peter Freyther | 9c137a7 | 2010-06-15 13:57:40 +0800 | [diff] [blame] | 222 | } |
| 223 | |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 224 | return msc_tx_dtap(conn, msg); |
Holger Hans Peter Freyther | 9c137a7 | 2010-06-15 13:57:40 +0800 | [diff] [blame] | 225 | } |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 226 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 227 | /* clear all transactions globally; used in case of MNCC socket disconnect */ |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 228 | void gsm0408_clear_all_trans(struct gsm_network *net, int protocol) |
| 229 | { |
| 230 | struct gsm_trans *trans, *temp; |
| 231 | |
| 232 | LOGP(DCC, LOGL_NOTICE, "Clearing all currently active transactions!!!\n"); |
| 233 | |
| 234 | llist_for_each_entry_safe(trans, temp, &net->trans_list, entry) { |
Harald Welte | eb76c7a | 2010-12-23 02:47:53 +0100 | [diff] [blame] | 235 | if (trans->protocol == protocol) { |
| 236 | trans->callref = 0; |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 237 | trans_free(trans); |
Harald Welte | eb76c7a | 2010-12-23 02:47:53 +0100 | [diff] [blame] | 238 | } |
Harald Welte | 371efe5 | 2010-12-22 23:17:50 +0100 | [diff] [blame] | 239 | } |
| 240 | } |
| 241 | |
Holger Freyther | 429e776 | 2008-12-30 13:28:30 +0000 | [diff] [blame] | 242 | /* Chapter 9.2.14 : Send LOCATION UPDATING REJECT */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 243 | static int gsm0408_loc_upd_rej(struct ran_conn *conn, uint8_t cause) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 244 | { |
Holger Hans Peter Freyther | 230a4d8 | 2010-06-15 19:40:05 +0800 | [diff] [blame] | 245 | struct msgb *msg; |
| 246 | |
Holger Hans Peter Freyther | 230a4d8 | 2010-06-15 19:40:05 +0800 | [diff] [blame] | 247 | msg = gsm48_create_loc_upd_rej(cause); |
| 248 | if (!msg) { |
| 249 | LOGP(DMM, LOGL_ERROR, "Failed to create msg for LOCATION UPDATING REJECT.\n"); |
| 250 | return -1; |
| 251 | } |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 252 | |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 253 | LOGP(DMM, LOGL_INFO, "Subscriber %s: LOCATION UPDATING REJECT\n", |
| 254 | vlr_subscr_name(conn->vsub)); |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 255 | |
Holger Hans Peter Freyther | 9c137a7 | 2010-06-15 13:57:40 +0800 | [diff] [blame] | 256 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 257 | } |
| 258 | |
| 259 | /* Chapter 9.2.13 : Send LOCATION UPDATE ACCEPT */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 260 | static int gsm0408_loc_upd_acc(struct ran_conn *conn, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 261 | uint32_t send_tmsi) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 262 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 263 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD ACC"); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 264 | struct gsm48_hdr *gh; |
| 265 | struct gsm48_loc_area_id *lai; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 266 | uint8_t *mid; |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 267 | struct osmo_location_area_id laid = { |
| 268 | .plmn = conn->network->plmn, |
| 269 | .lac = conn->lac, |
| 270 | }; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 271 | |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 272 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 273 | gh->proto_discr = GSM48_PDISC_MM; |
| 274 | gh->msg_type = GSM48_MT_MM_LOC_UPD_ACCEPT; |
| 275 | |
| 276 | lai = (struct gsm48_loc_area_id *) msgb_put(msg, sizeof(*lai)); |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 277 | gsm48_generate_lai2(lai, &laid); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 278 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 279 | if (send_tmsi == GSM_RESERVED_TMSI) { |
| 280 | /* we did not allocate a TMSI to the MS, so we need to |
| 281 | * include the IMSI in order for the MS to delete any |
| 282 | * old TMSI that might still be allocated */ |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 283 | uint8_t mi[10]; |
| 284 | int len; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 285 | len = gsm48_generate_mid_from_imsi(mi, conn->vsub->imsi); |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 286 | mid = msgb_put(msg, len); |
| 287 | memcpy(mid, mi, len); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 288 | DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT\n", |
| 289 | vlr_subscr_name(conn->vsub)); |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 290 | } else { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 291 | /* Include the TMSI, which means that the MS will send a |
| 292 | * TMSI REALLOCATION COMPLETE, and we should wait for |
| 293 | * that until T3250 expiration */ |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 294 | mid = msgb_put(msg, GSM48_MID_TMSI_LEN); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 295 | gsm48_generate_mid_from_tmsi(mid, send_tmsi); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 296 | DEBUGP(DMM, "-> %s LOCATION UPDATE ACCEPT (TMSI = 0x%08x)\n", |
| 297 | vlr_subscr_name(conn->vsub), |
| 298 | send_tmsi); |
Holger Hans Peter Freyther | 666e36a | 2015-07-13 20:33:08 +0200 | [diff] [blame] | 299 | } |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 300 | /* TODO: Follow-on proceed */ |
| 301 | /* TODO: CTS permission */ |
| 302 | /* TODO: Equivalent PLMNs */ |
| 303 | /* TODO: Emergency Number List */ |
| 304 | /* TODO: Per-MS T3312 */ |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 305 | |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 306 | |
Holger Hans Peter Freyther | dc5db24 | 2010-06-15 14:07:27 +0800 | [diff] [blame] | 307 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 308 | } |
| 309 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 310 | /* Transmit Chapter 9.2.10 Identity Request */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 311 | static int mm_tx_identity_req(struct ran_conn *conn, uint8_t id_type) |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 312 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 313 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 ID REQ"); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 314 | struct gsm48_hdr *gh; |
Harald Welte | fc977a8 | 2008-12-27 10:19:37 +0000 | [diff] [blame] | 315 | |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 316 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 317 | gh->proto_discr = GSM48_PDISC_MM; |
| 318 | gh->msg_type = GSM48_MT_MM_ID_REQ; |
| 319 | gh->data[0] = id_type; |
| 320 | |
Holger Hans Peter Freyther | d521d97 | 2010-06-15 14:11:01 +0800 | [diff] [blame] | 321 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 322 | } |
| 323 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 324 | /* Parse Chapter 9.2.11 Identity Response */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 325 | static int mm_rx_id_resp(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 326 | { |
| 327 | struct gsm48_hdr *gh = msgb_l3(msg); |
Neels Hofmeyr | b62289a | 2019-01-11 00:04:32 +0100 | [diff] [blame] | 328 | uint8_t *mi = gh->data+1; |
| 329 | uint8_t mi_len = gh->data[0]; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 330 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 331 | if (!conn->vsub) { |
| 332 | LOGP(DMM, LOGL_ERROR, |
| 333 | "Rx MM Identity Response: invalid: no subscriber\n"); |
| 334 | return -EINVAL; |
| 335 | } |
| 336 | |
Neels Hofmeyr | b62289a | 2019-01-11 00:04:32 +0100 | [diff] [blame] | 337 | DEBUGP(DMM, "IDENTITY RESPONSE: MI=%s\n", osmo_mi_name(mi, mi_len)); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 338 | |
Pablo Neira Ayuso | bbc5b99 | 2011-05-06 12:12:31 +0200 | [diff] [blame] | 339 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, gh->data); |
Harald Welte | 7659de1 | 2009-12-13 12:39:18 +0100 | [diff] [blame] | 340 | |
Neels Hofmeyr | b62289a | 2019-01-11 00:04:32 +0100 | [diff] [blame] | 341 | return vlr_subscr_rx_id_resp(conn->vsub, mi, mi_len); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 342 | } |
| 343 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 344 | /* Chapter 9.2.15: Receive Location Updating Request. |
| 345 | * Keep this function non-static for direct invocation by unit tests. */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 346 | int mm_rx_loc_upd_req(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 347 | { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 348 | struct gsm_network *net = conn->network; |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 349 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 350 | struct gsm48_loc_upd_req *lu; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 351 | uint8_t mi_type; |
Holger Hans Peter Freyther | d1862d7 | 2009-08-19 07:54:59 +0200 | [diff] [blame] | 352 | char mi_string[GSM48_MI_SIZE]; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 353 | enum vlr_lu_type vlr_lu_type = VLR_LU_TYPE_REGULAR; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 354 | uint32_t tmsi; |
| 355 | char *imsi; |
| 356 | struct osmo_location_area_id old_lai, new_lai; |
| 357 | struct osmo_fsm_inst *lu_fsm; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 358 | bool is_utran; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 359 | |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 360 | lu = (struct gsm48_loc_upd_req *) gh->data; |
| 361 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 362 | if (ran_conn_is_establishing_auth_ciph(conn)) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 363 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_ERROR, |
| 364 | "Cannot accept another LU, conn already busy establishing authenticity;" |
| 365 | " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| 366 | osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 367 | return -EINVAL; |
| 368 | } |
| 369 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 370 | if (ran_conn_is_accepted(conn)) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 371 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_ERROR, |
| 372 | "Cannot accept another LU, conn already established;" |
| 373 | " extraneous LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| 374 | osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 375 | return -EINVAL; |
| 376 | } |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 377 | |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 378 | conn->complete_layer3_type = COMPLETE_LAYER3_LU; |
| 379 | ran_conn_update_id_from_mi(conn, lu->mi, lu->mi_len); |
Neels Hofmeyr | 16c42b5 | 2018-04-02 12:26:16 +0200 | [diff] [blame] | 380 | |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 381 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_DEBUG, "LOCATION UPDATING REQUEST: MI=%s LU-type=%s\n", |
| 382 | osmo_mi_name(lu->mi, lu->mi_len), osmo_lu_type_name(lu->type)); |
Holger Freyther | 73487a2 | 2008-12-31 18:53:57 +0000 | [diff] [blame] | 383 | |
Pablo Neira Ayuso | bbc5b99 | 2011-05-06 12:12:31 +0200 | [diff] [blame] | 384 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, &lu->mi_len); |
Harald Welte | 7659de1 | 2009-12-13 12:39:18 +0100 | [diff] [blame] | 385 | |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 386 | switch (lu->type) { |
| 387 | case GSM48_LUPD_NORMAL: |
Neels Hofmeyr | a9f2bb5 | 2016-05-09 21:09:47 +0200 | [diff] [blame] | 388 | rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_NORMAL]); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 389 | vlr_lu_type = VLR_LU_TYPE_REGULAR; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 390 | break; |
| 391 | case GSM48_LUPD_IMSI_ATT: |
Neels Hofmeyr | a9f2bb5 | 2016-05-09 21:09:47 +0200 | [diff] [blame] | 392 | rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_ATTACH]); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 393 | vlr_lu_type = VLR_LU_TYPE_IMSI_ATTACH; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 394 | break; |
| 395 | case GSM48_LUPD_PERIODIC: |
Neels Hofmeyr | a9f2bb5 | 2016-05-09 21:09:47 +0200 | [diff] [blame] | 396 | rate_ctr_inc(&conn->network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_PERIODIC]); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 397 | vlr_lu_type = VLR_LU_TYPE_PERIODIC; |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 398 | break; |
| 399 | } |
| 400 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 401 | /* TODO: 10.5.1.6 MS Classmark for UMTS / Classmark 2 */ |
| 402 | /* TODO: 10.5.3.14 Aditional update parameters (CS fallback calls) */ |
| 403 | /* TODO: 10.5.7.8 Device properties */ |
| 404 | /* TODO: 10.5.1.15 MS network feature support */ |
Sylvain Munaut | 2030a2a | 2010-06-10 13:36:59 +0200 | [diff] [blame] | 405 | |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 406 | mi_type = lu->mi[0] & GSM_MI_TYPE_MASK; |
| 407 | gsm48_mi_to_string(mi_string, sizeof(mi_string), lu->mi, lu->mi_len); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 408 | switch (mi_type) { |
| 409 | case GSM_MI_TYPE_IMSI: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 410 | tmsi = GSM_RESERVED_TMSI; |
| 411 | imsi = mi_string; |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 412 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 413 | case GSM_MI_TYPE_TMSI: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 414 | tmsi = tmsi_from_string(mi_string); |
| 415 | imsi = NULL; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 416 | break; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 417 | default: |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 418 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_ERROR, "unknown mobile identity type\n"); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 419 | tmsi = GSM_RESERVED_TMSI; |
| 420 | imsi = NULL; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 421 | break; |
| 422 | } |
| 423 | |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 424 | gsm48_decode_lai2(&lu->lai, &old_lai); |
| 425 | new_lai.plmn = conn->network->plmn; |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 426 | new_lai.lac = conn->lac; |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 427 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_DEBUG, "LU/new-LAC: %u/%u\n", old_lai.lac, new_lai.lac); |
Harald Welte | 24516ea | 2009-07-04 10:18:00 +0200 | [diff] [blame] | 428 | |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 429 | is_utran = (conn->via_ran == OSMO_RAT_UTRAN_IU); |
Neels Hofmeyr | 4d3a66b | 2018-03-31 18:45:59 +0200 | [diff] [blame] | 430 | lu_fsm = vlr_loc_update(conn->fi, |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 431 | RAN_CONN_E_ACCEPTED, RAN_CONN_E_CN_CLOSE, NULL, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 432 | net->vlr, conn, vlr_lu_type, tmsi, imsi, |
| 433 | &old_lai, &new_lai, |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 434 | is_utran || conn->network->authentication_required, |
Harald Welte | 7b222aa | 2017-12-23 19:30:32 +0100 | [diff] [blame] | 435 | is_utran || conn->network->a5_encryption_mask > 0x01, |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 436 | lu->key_seq, |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 437 | classmark1_is_r99(&lu->classmark1), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 438 | is_utran, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 439 | net->vlr->cfg.assign_tmsi); |
| 440 | if (!lu_fsm) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 441 | LOG_RAN_CONN(conn, LOGL_ERROR, "Can't start LU FSM\n"); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 442 | return 0; |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 443 | } |
| 444 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 445 | /* From vlr_loc_update() we expect an implicit dispatch of |
| 446 | * VLR_ULA_E_UPDATE_LA, and thus we expect msc_vlr_subscr_assoc() to |
| 447 | * already have been called and completed. Has an error occured? */ |
Harald Welte | 255539c | 2008-12-28 02:26:27 +0000 | [diff] [blame] | 448 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 449 | if (!conn->vsub || conn->vsub->lu_fsm != lu_fsm) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 450 | LOG_RAN_CONN(conn, LOGL_ERROR, "internal error during Location Updating attempt\n"); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 451 | return -EIO; |
| 452 | } |
| 453 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 454 | conn->vsub->classmark.classmark1 = lu->classmark1; |
| 455 | conn->vsub->classmark.classmark1_set = true; |
| 456 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 457 | ran_conn_complete_layer_3(conn); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 458 | return 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 459 | } |
| 460 | |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 461 | /* Turn int into semi-octet representation: 98 => 0x89 */ |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 462 | /* FIXME: libosmocore/libosmogsm */ |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 463 | static uint8_t bcdify(uint8_t value) |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 464 | { |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 465 | uint8_t ret; |
| 466 | |
| 467 | ret = value / 10; |
| 468 | ret |= (value % 10) << 4; |
| 469 | |
| 470 | return ret; |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 471 | } |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 472 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 473 | /* Generate a message buffer that contains a valid MM info message, |
| 474 | * See also 3GPP TS 24.008, chapter 9.2.15a */ |
| 475 | struct msgb *gsm48_create_mm_info(struct gsm_network *net) |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 476 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 477 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 MM INF"); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 478 | struct gsm48_hdr *gh; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 479 | uint8_t *ptr8; |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 480 | int name_len, name_pad; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 481 | |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 482 | time_t cur_t; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 483 | struct tm* gmt_time; |
| 484 | struct tm* local_time; |
| 485 | int tzunits; |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 486 | int dst = 0; |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 487 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 488 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
| 489 | gh->proto_discr = GSM48_PDISC_MM; |
| 490 | gh->msg_type = GSM48_MT_MM_INFO; |
| 491 | |
| 492 | if (net->name_long) { |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 493 | #if 0 |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 494 | name_len = strlen(net->name_long); |
| 495 | /* 10.5.3.5a */ |
| 496 | ptr8 = msgb_put(msg, 3); |
| 497 | ptr8[0] = GSM48_IE_NAME_LONG; |
| 498 | ptr8[1] = name_len*2 +1; |
| 499 | ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| 500 | |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 501 | ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 502 | for (i = 0; i < name_len; i++) |
Harald Welte | 179f064 | 2008-12-31 23:59:18 +0000 | [diff] [blame] | 503 | ptr16[i] = htons(net->name_long[i]); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 504 | |
| 505 | /* FIXME: Use Cell Broadcast, not UCS-2, since |
| 506 | * UCS-2 is only supported by later revisions of the spec */ |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 507 | #endif |
| 508 | name_len = (strlen(net->name_long)*7)/8; |
| 509 | name_pad = (8 - strlen(net->name_long)*7)%8; |
| 510 | if (name_pad > 0) |
| 511 | name_len++; |
| 512 | /* 10.5.3.5a */ |
| 513 | ptr8 = msgb_put(msg, 3); |
| 514 | ptr8[0] = GSM48_IE_NAME_LONG; |
| 515 | ptr8[1] = name_len +1; |
| 516 | ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| 517 | |
| 518 | ptr8 = msgb_put(msg, name_len); |
Harald Welte | 5468f76 | 2015-01-01 12:41:17 +0100 | [diff] [blame] | 519 | gsm_7bit_encode_n(ptr8, name_len, net->name_long, NULL); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 520 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 521 | } |
| 522 | |
| 523 | if (net->name_short) { |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 524 | #if 0 |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 525 | name_len = strlen(net->name_short); |
| 526 | /* 10.5.3.5a */ |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 527 | ptr8 = (uint8_t *) msgb_put(msg, 3); |
Harald Welte | 7543eb7 | 2009-07-19 17:51:36 +0200 | [diff] [blame] | 528 | ptr8[0] = GSM48_IE_NAME_SHORT; |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 529 | ptr8[1] = name_len*2 + 1; |
| 530 | ptr8[2] = 0x90; /* UCS2, no spare bits, no CI */ |
| 531 | |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 532 | ptr16 = (uint16_t *) msgb_put(msg, name_len*2); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 533 | for (i = 0; i < name_len; i++) |
Harald Welte | 179f064 | 2008-12-31 23:59:18 +0000 | [diff] [blame] | 534 | ptr16[i] = htons(net->name_short[i]); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 535 | #endif |
| 536 | name_len = (strlen(net->name_short)*7)/8; |
| 537 | name_pad = (8 - strlen(net->name_short)*7)%8; |
| 538 | if (name_pad > 0) |
| 539 | name_len++; |
| 540 | /* 10.5.3.5a */ |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 541 | ptr8 = (uint8_t *) msgb_put(msg, 3); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 542 | ptr8[0] = GSM48_IE_NAME_SHORT; |
| 543 | ptr8[1] = name_len +1; |
| 544 | ptr8[2] = 0x80 | name_pad; /* Cell Broadcast DCS, no CI */ |
| 545 | |
| 546 | ptr8 = msgb_put(msg, name_len); |
Harald Welte | 5468f76 | 2015-01-01 12:41:17 +0100 | [diff] [blame] | 547 | gsm_7bit_encode_n(ptr8, name_len, net->name_short, NULL); |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 548 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 549 | } |
| 550 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 551 | /* Section 10.5.3.9 */ |
| 552 | cur_t = time(NULL); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 553 | gmt_time = gmtime(&cur_t); |
| 554 | |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 555 | ptr8 = msgb_put(msg, 8); |
| 556 | ptr8[0] = GSM48_IE_NET_TIME_TZ; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 557 | ptr8[1] = bcdify(gmt_time->tm_year % 100); |
| 558 | ptr8[2] = bcdify(gmt_time->tm_mon + 1); |
| 559 | ptr8[3] = bcdify(gmt_time->tm_mday); |
| 560 | ptr8[4] = bcdify(gmt_time->tm_hour); |
| 561 | ptr8[5] = bcdify(gmt_time->tm_min); |
| 562 | ptr8[6] = bcdify(gmt_time->tm_sec); |
| 563 | |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 564 | if (net->tz.override) { |
Harald Welte | 45f9171 | 2012-07-08 16:48:11 +0200 | [diff] [blame] | 565 | /* Convert tz.hr and tz.mn to units */ |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 566 | if (net->tz.hr < 0) { |
| 567 | tzunits = ((net->tz.hr/-1)*4); |
| 568 | tzunits = tzunits + (net->tz.mn/15); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 569 | ptr8[7] = bcdify(tzunits); |
| 570 | /* Set negative time */ |
| 571 | ptr8[7] |= 0x08; |
| 572 | } |
| 573 | else { |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 574 | tzunits = net->tz.hr*4; |
| 575 | tzunits = tzunits + (net->tz.mn/15); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 576 | ptr8[7] = bcdify(tzunits); |
| 577 | } |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 578 | /* Convert DST value */ |
Neels Hofmeyr | 7398395 | 2016-05-10 13:29:33 +0200 | [diff] [blame] | 579 | if (net->tz.dst >= 0 && net->tz.dst <= 2) |
| 580 | dst = net->tz.dst; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 581 | } |
| 582 | else { |
| 583 | /* Need to get GSM offset and convert into 15 min units */ |
| 584 | /* This probably breaks if gmtoff returns a value not evenly divisible by 15? */ |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 585 | #ifdef HAVE_TM_GMTOFF_IN_TM |
Benoit Bolsee | 38bb344 | 2017-07-05 12:57:16 +0200 | [diff] [blame] | 586 | local_time = localtime(&cur_t); |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 587 | tzunits = (local_time->tm_gmtoff/60)/15; |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 588 | #else |
Benoit Bolsee | 38bb344 | 2017-07-05 12:57:16 +0200 | [diff] [blame] | 589 | /* find timezone offset */ |
| 590 | time_t utc; |
| 591 | double offsetFromUTC; |
| 592 | utc = mktime(gmt_time); |
| 593 | local_time = localtime(&cur_t); |
| 594 | offsetFromUTC = difftime(cur_t, utc); |
| 595 | if (local_time->tm_isdst) |
| 596 | offsetFromUTC += 3600.0; |
| 597 | tzunits = ((int)offsetFromUTC) / 60 / 15; |
Harald Welte | 9c3dc90 | 2012-04-08 16:59:24 +0200 | [diff] [blame] | 598 | #endif |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 599 | if (tzunits < 0) { |
| 600 | tzunits = tzunits/-1; |
| 601 | ptr8[7] = bcdify(tzunits); |
| 602 | /* Flip it to negative */ |
| 603 | ptr8[7] |= 0x08; |
| 604 | } |
| 605 | else |
| 606 | ptr8[7] = bcdify(tzunits); |
Jacob Erlbeck | f46e226 | 2014-01-07 15:05:16 +0100 | [diff] [blame] | 607 | |
| 608 | /* Does not support DST +2 */ |
| 609 | if (local_time->tm_isdst) |
| 610 | dst = 1; |
| 611 | } |
| 612 | |
| 613 | if (dst) { |
| 614 | ptr8 = msgb_put(msg, 3); |
| 615 | ptr8[0] = GSM48_IE_NET_DST; |
| 616 | ptr8[1] = 1; |
| 617 | ptr8[2] = dst; |
Gus Bourg | 1c5dd2c | 2011-12-02 10:18:17 +0100 | [diff] [blame] | 618 | } |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 619 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 620 | return msg; |
| 621 | } |
Daniel Willmann | eea9337 | 2009-08-13 03:42:07 +0200 | [diff] [blame] | 622 | |
Harald Welte | 0df904d | 2018-12-03 11:00:04 +0100 | [diff] [blame] | 623 | /* Section 9.2.15a */ |
| 624 | int gsm48_tx_mm_info(struct ran_conn *conn) |
| 625 | { |
| 626 | struct gsm_network *net = conn->network; |
| 627 | struct msgb *msg; |
| 628 | |
| 629 | msg = gsm48_create_mm_info(net); |
| 630 | |
| 631 | LOG_RAN_CONN(conn, LOGL_DEBUG, "Tx MM INFO\n"); |
Holger Hans Peter Freyther | 9140174 | 2010-06-15 14:16:02 +0800 | [diff] [blame] | 632 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte | db253af | 2008-12-30 17:56:55 +0000 | [diff] [blame] | 633 | } |
| 634 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 635 | /*! Send an Authentication Request to MS on the given RAN connection |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 636 | * according to 3GPP/ETSI TS 24.008, Section 9.2.2. |
| 637 | * \param[in] conn Subscriber connection to send on. |
| 638 | * \param[in] rand Random challenge token to send, must be 16 bytes long. |
| 639 | * \param[in] autn r99: In case of UMTS mutual authentication, AUTN token to |
| 640 | * send; must be 16 bytes long, or pass NULL for plain GSM auth. |
| 641 | * \param[in] key_seq auth tuple's sequence number. |
| 642 | */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 643 | int gsm48_tx_mm_auth_req(struct ran_conn *conn, uint8_t *rand, |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 644 | uint8_t *autn, int key_seq) |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 645 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 646 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 AUTH REQ"); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 647 | struct gsm48_hdr *gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 648 | struct gsm48_auth_req *ar = (struct gsm48_auth_req *) msgb_put(msg, sizeof(*ar)); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 649 | |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 650 | DEBUGP(DMM, "Tx AUTH REQ (rand = %s)\n", osmo_hexdump_nospc(rand, 16)); |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 651 | if (autn) |
Neels Hofmeyr | 3355fd6 | 2017-02-14 17:42:25 +0100 | [diff] [blame] | 652 | DEBUGP(DMM, " AUTH REQ (autn = %s)\n", osmo_hexdump_nospc(autn, 16)); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 653 | |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 654 | gh->proto_discr = GSM48_PDISC_MM; |
| 655 | gh->msg_type = GSM48_MT_MM_AUTH_REQ; |
| 656 | |
Sylvain Munaut | bd55a6d | 2009-12-24 00:23:46 +0100 | [diff] [blame] | 657 | ar->key_seq = key_seq; |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 658 | |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 659 | /* 16 bytes RAND parameters */ |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 660 | osmo_static_assert(sizeof(ar->rand) == 16, sizeof_auth_req_r99_rand); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 661 | if (rand) |
Sylvain Munaut | 849f554 | 2009-09-27 11:10:17 +0200 | [diff] [blame] | 662 | memcpy(ar->rand, rand, 16); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 663 | |
Neels Hofmeyr | d675515 | 2017-01-27 00:25:47 +0100 | [diff] [blame] | 664 | |
| 665 | /* 16 bytes AUTN */ |
| 666 | if (autn) |
| 667 | msgb_tlv_put(msg, GSM48_IE_AUTN, 16, autn); |
| 668 | |
Holger Hans Peter Freyther | e9ed340 | 2010-06-16 12:30:50 +0800 | [diff] [blame] | 669 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 670 | } |
| 671 | |
| 672 | /* Section 9.2.1 */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 673 | int gsm48_tx_mm_auth_rej(struct ran_conn *conn) |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 674 | { |
| 675 | DEBUGP(DMM, "-> AUTH REJECT\n"); |
Holger Hans Peter Freyther | e9ed340 | 2010-06-16 12:30:50 +0800 | [diff] [blame] | 676 | return gsm48_tx_simple(conn, GSM48_PDISC_MM, GSM48_MT_MM_AUTH_REJ); |
Harald Welte | 7984d5c | 2009-08-12 22:56:50 +0200 | [diff] [blame] | 677 | } |
| 678 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 679 | static int msc_vlr_tx_cm_serv_acc(void *msc_conn_ref); |
Neels Hofmeyr | 1580959 | 2018-04-06 02:57:51 +0200 | [diff] [blame] | 680 | static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum gsm48_reject_value result); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 681 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 682 | static int cm_serv_reuse_conn(struct ran_conn *conn, const uint8_t *mi_lv) |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 683 | { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 684 | uint8_t mi_type; |
| 685 | char mi_string[GSM48_MI_SIZE]; |
| 686 | uint32_t tmsi; |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 687 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 688 | gsm48_mi_to_string(mi_string, sizeof(mi_string), mi_lv+1, mi_lv[0]); |
| 689 | mi_type = mi_lv[1] & GSM_MI_TYPE_MASK; |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 690 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 691 | switch (mi_type) { |
| 692 | case GSM_MI_TYPE_IMSI: |
| 693 | if (vlr_subscr_matches_imsi(conn->vsub, mi_string)) |
| 694 | goto accept_reuse; |
| 695 | break; |
| 696 | case GSM_MI_TYPE_TMSI: |
| 697 | tmsi = osmo_load32be(mi_lv+2); |
| 698 | if (vlr_subscr_matches_tmsi(conn->vsub, tmsi)) |
| 699 | goto accept_reuse; |
| 700 | break; |
| 701 | case GSM_MI_TYPE_IMEI: |
| 702 | if (vlr_subscr_matches_imei(conn->vsub, mi_string)) |
| 703 | goto accept_reuse; |
| 704 | break; |
| 705 | default: |
| 706 | break; |
| 707 | } |
Holger Hans Peter Freyther | 2147bc4 | 2013-12-27 17:19:19 +0100 | [diff] [blame] | 708 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 709 | LOGP(DMM, LOGL_ERROR, "%s: CM Service Request with mismatching mobile identity: %s %s\n", |
| 710 | vlr_subscr_name(conn->vsub), gsm48_mi_type_name(mi_type), mi_string); |
Neels Hofmeyr | 1580959 | 2018-04-06 02:57:51 +0200 | [diff] [blame] | 711 | msc_vlr_tx_cm_serv_rej(conn, GSM48_REJECT_ILLEGAL_MS); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 712 | return -EINVAL; |
Sylvain Munaut | ba87f45 | 2009-12-24 00:28:46 +0100 | [diff] [blame] | 713 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 714 | accept_reuse: |
| 715 | DEBUGP(DMM, "%s: re-using already accepted connection\n", |
| 716 | vlr_subscr_name(conn->vsub)); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 717 | |
| 718 | if (!conn->received_cm_service_request) { |
| 719 | conn->received_cm_service_request = true; |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 720 | ran_conn_get(conn, RAN_CONN_USE_CM_SERVICE); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 721 | } |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 722 | ran_conn_update_id(conn); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 723 | return conn->network->vlr->ops.tx_cm_serv_acc(conn); |
Sylvain Munaut | ba87f45 | 2009-12-24 00:28:46 +0100 | [diff] [blame] | 724 | } |
| 725 | |
Harald Welte | 4ed0e92 | 2009-01-10 03:17:30 +0000 | [diff] [blame] | 726 | /* |
| 727 | * Handle CM Service Requests |
| 728 | * a) Verify that the packet is long enough to contain the information |
| 729 | * we require otherwsie reject with INCORRECT_MESSAGE |
| 730 | * b) Try to parse the TMSI. If we do not have one reject |
| 731 | * c) Check that we know the subscriber with the TMSI otherwise reject |
| 732 | * with a HLR cause |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 733 | * d) Set the subscriber on the conn and accept |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 734 | * |
| 735 | * Keep this function non-static for direct invocation by unit tests. |
Harald Welte | 4ed0e92 | 2009-01-10 03:17:30 +0000 | [diff] [blame] | 736 | */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 737 | int gsm48_rx_mm_serv_req(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 738 | { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 739 | struct gsm_network *net = conn->network; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 740 | uint8_t mi_type; |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 741 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 742 | struct gsm48_service_request *req = |
| 743 | (struct gsm48_service_request *)gh->data; |
Holger Hans Peter Freyther | 5d65806 | 2010-05-14 08:02:08 +0800 | [diff] [blame] | 744 | /* unfortunately in Phase1 the classmark2 length is variable */ |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 745 | uint8_t classmark2_len = gh->data[1]; |
| 746 | uint8_t *classmark2 = gh->data+2; |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 747 | uint8_t *mi_p = classmark2 + classmark2_len; |
| 748 | uint8_t mi_len = *mi_p; |
| 749 | uint8_t *mi = mi_p + 1; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 750 | struct osmo_location_area_id lai; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 751 | bool is_utran; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 752 | |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 753 | lai.plmn = conn->network->plmn; |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 754 | lai.lac = conn->lac; |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 755 | |
| 756 | if (msg->data_len < sizeof(struct gsm48_service_request*)) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 757 | LOG_RAN_CONN(conn, LOGL_ERROR, "Rx CM SERVICE REQUEST: wrong message size (%u < %zu)\n", |
| 758 | msg->data_len, sizeof(struct gsm48_service_request*)); |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 759 | return msc_gsm48_tx_mm_serv_rej(conn, |
| 760 | GSM48_REJECT_INCORRECT_MESSAGE); |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 761 | } |
| 762 | |
| 763 | if (msg->data_len < req->mi_len + 6) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 764 | LOG_RAN_CONN(conn, LOGL_ERROR, "Rx CM SERVICE REQUEST: message does not fit in packet\n"); |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 765 | return msc_gsm48_tx_mm_serv_rej(conn, |
| 766 | GSM48_REJECT_INCORRECT_MESSAGE); |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 767 | } |
| 768 | |
Neels Hofmeyr | 7ce21dc | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 769 | if (ran_conn_is_establishing_auth_ciph(conn)) { |
| 770 | LOG_RAN_CONN(conn, LOGL_ERROR, |
| 771 | "Cannot accept CM Service Request, conn already busy establishing authenticity\n"); |
| 772 | msc_vlr_tx_cm_serv_rej(conn, GSM48_REJECT_CONGESTION); |
| 773 | return -EINVAL; |
| 774 | /* or should we accept and note down the service request anyway? */ |
| 775 | } |
| 776 | |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 777 | conn->complete_layer3_type = COMPLETE_LAYER3_CM_SERVICE_REQ; |
| 778 | ran_conn_update_id_from_mi(conn, mi, mi_len); |
| 779 | LOG_RAN_CONN_CAT(conn, DMM, LOGL_DEBUG, "Rx CM SERVICE REQUEST cm_service_type=0x%02x\n", |
| 780 | req->cm_service_type); |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 781 | |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 782 | mi_type = (mi && mi_len) ? (mi[0] & GSM_MI_TYPE_MASK) : GSM_MI_TYPE_NONE; |
Harald Welte | 3995d2e | 2018-01-24 11:23:54 +0100 | [diff] [blame] | 783 | switch (mi_type) { |
| 784 | case GSM_MI_TYPE_IMSI: |
| 785 | case GSM_MI_TYPE_TMSI: |
| 786 | /* continue below */ |
| 787 | break; |
| 788 | case GSM_MI_TYPE_IMEI: |
| 789 | if (req->cm_service_type == GSM48_CMSERV_EMERGENCY) { |
| 790 | /* We don't do emergency calls by IMEI */ |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 791 | LOG_RAN_CONN(conn, LOGL_NOTICE, "Tx CM SERVICE REQUEST REJECT\n"); |
Harald Welte | 3995d2e | 2018-01-24 11:23:54 +0100 | [diff] [blame] | 792 | return msc_gsm48_tx_mm_serv_rej(conn, GSM48_REJECT_IMEI_NOT_ACCEPTED); |
| 793 | } |
| 794 | /* fall-through for non-emergency setup */ |
| 795 | default: |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 796 | LOG_RAN_CONN(conn, LOGL_ERROR, "MI type is not expected: %s\n", gsm48_mi_type_name(mi_type)); |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 797 | return msc_gsm48_tx_mm_serv_rej(conn, |
| 798 | GSM48_REJECT_INCORRECT_MESSAGE); |
Harald Welte | ba4cf16 | 2009-01-10 01:49:35 +0000 | [diff] [blame] | 799 | } |
| 800 | |
Harald Welte | 37382ec | 2018-01-24 12:49:34 +0100 | [diff] [blame] | 801 | switch (req->cm_service_type) { |
| 802 | case GSM48_CMSERV_MO_CALL_PACKET: |
| 803 | case GSM48_CMSERV_EMERGENCY: |
| 804 | case GSM48_CMSERV_SMS: |
| 805 | case GSM48_CMSERV_SUP_SERV: |
| 806 | /* continue below */ |
| 807 | break; |
| 808 | default: |
| 809 | return msc_gsm48_tx_mm_serv_rej(conn, GSM48_REJECT_SRV_OPT_NOT_SUPPORTED); |
| 810 | } |
| 811 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 812 | if (ran_conn_is_accepted(conn)) |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 813 | return cm_serv_reuse_conn(conn, mi_p); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 814 | |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 815 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_IDENTITY, mi_p); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 816 | |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 817 | is_utran = (conn->via_ran == OSMO_RAT_UTRAN_IU); |
Neels Hofmeyr | 4d3a66b | 2018-03-31 18:45:59 +0200 | [diff] [blame] | 818 | vlr_proc_acc_req(conn->fi, |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 819 | RAN_CONN_E_ACCEPTED, RAN_CONN_E_CN_CLOSE, NULL, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 820 | net->vlr, conn, |
| 821 | VLR_PR_ARQ_T_CM_SERV_REQ, mi-1, &lai, |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 822 | is_utran || conn->network->authentication_required, |
Harald Welte | 7b222aa | 2017-12-23 19:30:32 +0100 | [diff] [blame] | 823 | is_utran || conn->network->a5_encryption_mask > 0x01, |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 824 | req->cipher_key_seq, |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 825 | classmark2_is_r99(classmark2, classmark2_len), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 826 | is_utran); |
Holger Freyther | eb44398 | 2009-06-04 13:58:42 +0000 | [diff] [blame] | 827 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 828 | /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
| 829 | * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occured? */ |
| 830 | if (!conn->vsub) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 831 | LOG_RAN_CONN(conn, LOGL_ERROR, "subscriber not allowed to do a CM Service Request\n"); |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 832 | return -EIO; |
| 833 | } |
| 834 | |
| 835 | memcpy(conn->vsub->classmark.classmark2, classmark2, classmark2_len); |
| 836 | conn->vsub->classmark.classmark2_len = classmark2_len; |
| 837 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 838 | ran_conn_complete_layer_3(conn); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 839 | return 0; |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 840 | } |
| 841 | |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 842 | /* Receive a CM Re-establish Request */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 843 | static int gsm48_rx_cm_reest_req(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 844 | { |
| 845 | uint8_t mi_type; |
| 846 | char mi_string[GSM48_MI_SIZE]; |
| 847 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 848 | |
| 849 | uint8_t classmark2_len = gh->data[1]; |
| 850 | uint8_t *classmark2 = gh->data+2; |
| 851 | uint8_t mi_len = *(classmark2 + classmark2_len); |
| 852 | uint8_t *mi = (classmark2 + classmark2_len + 1); |
| 853 | |
| 854 | gsm48_mi_to_string(mi_string, sizeof(mi_string), mi, mi_len); |
| 855 | mi_type = mi[0] & GSM_MI_TYPE_MASK; |
| 856 | DEBUGP(DMM, "<- CM RE-ESTABLISH REQUEST MI(%s)=%s\n", gsm48_mi_type_name(mi_type), mi_string); |
| 857 | |
| 858 | /* we don't support CM call re-establishment */ |
| 859 | return msc_gsm48_tx_mm_serv_rej(conn, GSM48_REJECT_SRV_OPT_NOT_SUPPORTED); |
| 860 | } |
| 861 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 862 | static int gsm48_rx_mm_imsi_detach_ind(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 863 | { |
Neels Hofmeyr | a9f2bb5 | 2016-05-09 21:09:47 +0200 | [diff] [blame] | 864 | struct gsm_network *network = conn->network; |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 865 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 866 | struct gsm48_imsi_detach_ind *idi = |
| 867 | (struct gsm48_imsi_detach_ind *) gh->data; |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 868 | uint8_t mi_type = idi->mi[0] & GSM_MI_TYPE_MASK; |
Holger Hans Peter Freyther | d1862d7 | 2009-08-19 07:54:59 +0200 | [diff] [blame] | 869 | char mi_string[GSM48_MI_SIZE]; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 870 | struct vlr_subscr *vsub = NULL; |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 871 | |
Holger Hans Peter Freyther | d1862d7 | 2009-08-19 07:54:59 +0200 | [diff] [blame] | 872 | gsm48_mi_to_string(mi_string, sizeof(mi_string), idi->mi, idi->mi_len); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 873 | DEBUGP(DMM, "IMSI DETACH INDICATION: MI(%s)=%s\n", |
| 874 | gsm48_mi_type_name(mi_type), mi_string); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 875 | |
Neels Hofmeyr | a9f2bb5 | 2016-05-09 21:09:47 +0200 | [diff] [blame] | 876 | rate_ctr_inc(&network->msc_ctrs->ctr[MSC_CTR_LOC_UPDATE_TYPE_DETACH]); |
Harald Welte | 24ff6ee | 2009-12-22 00:41:05 +0100 | [diff] [blame] | 877 | |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 878 | switch (mi_type) { |
| 879 | case GSM_MI_TYPE_TMSI: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 880 | vsub = vlr_subscr_find_by_tmsi(network->vlr, |
| 881 | tmsi_from_string(mi_string)); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 882 | break; |
| 883 | case GSM_MI_TYPE_IMSI: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 884 | vsub = vlr_subscr_find_by_imsi(network->vlr, mi_string); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 885 | break; |
| 886 | case GSM_MI_TYPE_IMEI: |
| 887 | case GSM_MI_TYPE_IMEISV: |
| 888 | /* no sim card... FIXME: what to do ? */ |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 889 | LOGP(DMM, LOGL_ERROR, "MI(%s)=%s: unimplemented mobile identity type\n", |
| 890 | gsm48_mi_type_name(mi_type), mi_string); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 891 | break; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 892 | default: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 893 | LOGP(DMM, LOGL_ERROR, "MI(%s)=%s: unknown mobile identity type\n", |
| 894 | gsm48_mi_type_name(mi_type), mi_string); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 895 | break; |
| 896 | } |
| 897 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 898 | if (!vsub) { |
| 899 | LOGP(DMM, LOGL_ERROR, "IMSI DETACH for unknown subscriber MI(%s)=%s\n", |
| 900 | gsm48_mi_type_name(mi_type), mi_string); |
| 901 | } else { |
| 902 | LOGP(DMM, LOGL_INFO, "IMSI DETACH for %s\n", vlr_subscr_name(vsub)); |
Neels Hofmeyr | facd57a | 2017-12-15 03:48:48 +0100 | [diff] [blame] | 903 | |
| 904 | if (vsub->cs.is_paging) |
| 905 | subscr_paging_cancel(vsub, GSM_PAGING_EXPIRED); |
| 906 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 907 | /* We already got Classmark 1 during Location Updating ... but well, ok */ |
| 908 | vsub->classmark.classmark1 = idi->classmark1; |
| 909 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 910 | vlr_subscr_rx_imsi_detach(vsub); |
| 911 | osmo_signal_dispatch(SS_SUBSCR, S_SUBSCR_DETACHED, vsub); |
| 912 | vlr_subscr_put(vsub); |
| 913 | } |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 914 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 915 | ran_conn_close(conn, 0); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 916 | return 0; |
| 917 | } |
| 918 | |
Harald Welte | d2a7f5a | 2009-06-05 20:08:20 +0000 | [diff] [blame] | 919 | static int gsm48_rx_mm_status(struct msgb *msg) |
| 920 | { |
| 921 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 922 | |
| 923 | DEBUGP(DMM, "MM STATUS (reject cause 0x%02x)\n", gh->data[0]); |
| 924 | |
| 925 | return 0; |
| 926 | } |
| 927 | |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 928 | static int parse_gsm_auth_resp(uint8_t *res, uint8_t *res_len, |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 929 | struct ran_conn *conn, |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 930 | struct msgb *msg) |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 931 | { |
| 932 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 933 | struct gsm48_auth_resp *ar = (struct gsm48_auth_resp*) gh->data; |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 934 | |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 935 | if (msgb_l3len(msg) < sizeof(*gh) + sizeof(*ar)) { |
| 936 | LOGP(DMM, LOGL_ERROR, |
| 937 | "%s: MM AUTHENTICATION RESPONSE:" |
| 938 | " l3 length invalid: %u\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 939 | vlr_subscr_name(conn->vsub), msgb_l3len(msg)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 940 | return -EINVAL; |
| 941 | } |
| 942 | |
| 943 | *res_len = sizeof(ar->sres); |
| 944 | memcpy(res, ar->sres, sizeof(ar->sres)); |
| 945 | return 0; |
| 946 | } |
| 947 | |
| 948 | static int parse_umts_auth_resp(uint8_t *res, uint8_t *res_len, |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 949 | struct ran_conn *conn, |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 950 | struct msgb *msg) |
| 951 | { |
| 952 | struct gsm48_hdr *gh; |
| 953 | uint8_t *data; |
| 954 | uint8_t iei; |
| 955 | uint8_t ie_len; |
| 956 | unsigned int data_len; |
| 957 | |
| 958 | /* First parse the GSM part */ |
| 959 | if (parse_gsm_auth_resp(res, res_len, conn, msg)) |
| 960 | return -EINVAL; |
| 961 | OSMO_ASSERT(*res_len == 4); |
| 962 | |
| 963 | /* Then add the extended res part */ |
| 964 | gh = msgb_l3(msg); |
| 965 | data = gh->data + sizeof(struct gsm48_auth_resp); |
| 966 | data_len = msgb_l3len(msg) - (data - (uint8_t*)msgb_l3(msg)); |
| 967 | |
| 968 | if (data_len < 3) { |
| 969 | LOGP(DMM, LOGL_ERROR, |
| 970 | "%s: MM AUTHENTICATION RESPONSE:" |
| 971 | " l3 length invalid: %u\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 972 | vlr_subscr_name(conn->vsub), msgb_l3len(msg)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 973 | return -EINVAL; |
| 974 | } |
| 975 | |
| 976 | iei = data[0]; |
| 977 | ie_len = data[1]; |
| 978 | if (iei != GSM48_IE_AUTH_RES_EXT) { |
| 979 | LOGP(DMM, LOGL_ERROR, |
| 980 | "%s: MM R99 AUTHENTICATION RESPONSE:" |
| 981 | " expected IEI 0x%02x, got 0x%02x\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 982 | vlr_subscr_name(conn->vsub), |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 983 | GSM48_IE_AUTH_RES_EXT, iei); |
| 984 | return -EINVAL; |
| 985 | } |
| 986 | |
| 987 | if (ie_len > 12) { |
| 988 | LOGP(DMM, LOGL_ERROR, |
| 989 | "%s: MM R99 AUTHENTICATION RESPONSE:" |
| 990 | " extended Auth Resp IE 0x%02x is too large: %u bytes\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 991 | vlr_subscr_name(conn->vsub), GSM48_IE_AUTH_RES_EXT, ie_len); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 992 | return -EINVAL; |
| 993 | } |
| 994 | |
| 995 | *res_len += ie_len; |
| 996 | memcpy(res + 4, &data[2], ie_len); |
| 997 | return 0; |
| 998 | } |
| 999 | |
| 1000 | /* Chapter 9.2.3: Authentication Response */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1001 | static int gsm48_rx_mm_auth_resp(struct ran_conn *conn, struct msgb *msg) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1002 | { |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1003 | uint8_t res[16]; |
| 1004 | uint8_t res_len; |
| 1005 | int rc; |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1006 | bool is_umts; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1007 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1008 | if (!conn->vsub) { |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1009 | LOGP(DMM, LOGL_ERROR, |
| 1010 | "MM AUTHENTICATION RESPONSE: invalid: no subscriber\n"); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1011 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1012 | return -EINVAL; |
| 1013 | } |
| 1014 | |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1015 | is_umts = (msgb_l3len(msg) > sizeof(struct gsm48_hdr) + sizeof(struct gsm48_auth_resp)); |
| 1016 | |
| 1017 | if (is_umts) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1018 | rc = parse_umts_auth_resp(res, &res_len, conn, msg); |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1019 | else |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1020 | rc = parse_gsm_auth_resp(res, &res_len, conn, msg); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1021 | |
| 1022 | if (rc) { |
Neels Hofmeyr | 8e0af0b | 2018-03-10 03:32:18 +0100 | [diff] [blame] | 1023 | LOGP(DMM, LOGL_ERROR, |
| 1024 | "%s: MM AUTHENTICATION RESPONSE: invalid: parsing %s AKA Auth Response" |
| 1025 | " failed with rc=%d; dispatching zero length SRES/RES to trigger failure\n", |
Neels Hofmeyr | 25f69d5 | 2018-03-10 03:44:06 +0100 | [diff] [blame] | 1026 | vlr_subscr_name(conn->vsub), is_umts ? "UMTS" : "GSM", rc); |
Neels Hofmeyr | 8e0af0b | 2018-03-10 03:32:18 +0100 | [diff] [blame] | 1027 | memset(res, 0, sizeof(res)); |
| 1028 | res_len = 0; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1029 | } |
| 1030 | |
| 1031 | DEBUGP(DMM, "%s: MM %s AUTHENTICATION RESPONSE (%s = %s)\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1032 | vlr_subscr_name(conn->vsub), |
Neels Hofmeyr | d97821f | 2018-03-10 04:51:39 +0100 | [diff] [blame] | 1033 | is_umts ? "UMTS" : "GSM", is_umts ? "res" : "sres", |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1034 | osmo_hexdump_nospc(res, res_len)); |
| 1035 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1036 | return vlr_subscr_rx_auth_resp(conn->vsub, classmark_is_r99(&conn->vsub->classmark), |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1037 | conn->via_ran == OSMO_RAT_UTRAN_IU, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1038 | res, res_len); |
Sylvain Munaut | 30a1538 | 2009-12-24 00:27:26 +0100 | [diff] [blame] | 1039 | } |
| 1040 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1041 | static int gsm48_rx_mm_auth_fail(struct ran_conn *conn, struct msgb *msg) |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1042 | { |
| 1043 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1044 | uint8_t cause; |
| 1045 | uint8_t auts_tag; |
| 1046 | uint8_t auts_len; |
| 1047 | uint8_t *auts; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1048 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1049 | if (!conn->vsub) { |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1050 | LOGP(DMM, LOGL_ERROR, |
| 1051 | "MM R99 AUTHENTICATION FAILURE: invalid: no subscriber\n"); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1052 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1053 | return -EINVAL; |
| 1054 | } |
| 1055 | |
| 1056 | if (msgb_l3len(msg) < sizeof(*gh) + 1) { |
| 1057 | LOGP(DMM, LOGL_ERROR, |
| 1058 | "%s: MM R99 AUTHENTICATION FAILURE:" |
| 1059 | " l3 length invalid: %u\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1060 | vlr_subscr_name(conn->vsub), msgb_l3len(msg)); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1061 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1062 | return -EINVAL; |
| 1063 | } |
| 1064 | |
| 1065 | cause = gh->data[0]; |
| 1066 | |
| 1067 | if (cause != GSM48_REJECT_SYNCH_FAILURE) { |
| 1068 | LOGP(DMM, LOGL_INFO, |
| 1069 | "%s: MM R99 AUTHENTICATION FAILURE: cause 0x%0x\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1070 | vlr_subscr_name(conn->vsub), cause); |
| 1071 | vlr_subscr_rx_auth_fail(conn->vsub, NULL); |
| 1072 | return 0; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1073 | } |
| 1074 | |
| 1075 | /* This is a Synch Failure procedure, which should pass an AUTS to |
| 1076 | * resynchronize the sequence nr with the HLR. Expecting exactly one |
| 1077 | * TLV with 14 bytes of AUTS. */ |
| 1078 | |
| 1079 | if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2) { |
| 1080 | LOGP(DMM, LOGL_INFO, |
| 1081 | "%s: MM R99 AUTHENTICATION FAILURE:" |
| 1082 | " invalid Synch Failure: missing AUTS IE\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1083 | vlr_subscr_name(conn->vsub)); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1084 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1085 | return -EINVAL; |
| 1086 | } |
| 1087 | |
| 1088 | auts_tag = gh->data[1]; |
| 1089 | auts_len = gh->data[2]; |
| 1090 | auts = &gh->data[3]; |
| 1091 | |
| 1092 | if (auts_tag != GSM48_IE_AUTS |
| 1093 | || auts_len != 14) { |
| 1094 | LOGP(DMM, LOGL_INFO, |
| 1095 | "%s: MM R99 AUTHENTICATION FAILURE:" |
| 1096 | " invalid Synch Failure:" |
| 1097 | " expected AUTS IE 0x%02x of 14 bytes," |
| 1098 | " got IE 0x%02x of %u bytes\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1099 | vlr_subscr_name(conn->vsub), |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1100 | GSM48_IE_AUTS, auts_tag, auts_len); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1101 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1102 | return -EINVAL; |
| 1103 | } |
| 1104 | |
| 1105 | if (msgb_l3len(msg) < sizeof(*gh) + 1 + 2 + auts_len) { |
| 1106 | LOGP(DMM, LOGL_INFO, |
| 1107 | "%s: MM R99 AUTHENTICATION FAILURE:" |
| 1108 | " invalid Synch Failure msg: message truncated (%u)\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1109 | vlr_subscr_name(conn->vsub), msgb_l3len(msg)); |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1110 | ran_conn_close(conn, GSM_CAUSE_AUTH_FAILED); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1111 | return -EINVAL; |
| 1112 | } |
| 1113 | |
| 1114 | /* We have an AUTS IE with exactly 14 bytes of AUTS and the msgb is |
| 1115 | * large enough. */ |
| 1116 | |
| 1117 | DEBUGP(DMM, "%s: MM R99 AUTHENTICATION SYNCH (AUTS = %s)\n", |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1118 | vlr_subscr_name(conn->vsub), osmo_hexdump_nospc(auts, 14)); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1119 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1120 | return vlr_subscr_rx_auth_fail(conn->vsub, auts); |
| 1121 | } |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1122 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1123 | static int gsm48_rx_mm_tmsi_reall_compl(struct ran_conn *conn) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1124 | { |
| 1125 | DEBUGP(DMM, "TMSI Reallocation Completed. Subscriber: %s\n", |
| 1126 | vlr_subscr_name(conn->vsub)); |
| 1127 | if (!conn->vsub) { |
| 1128 | LOGP(DMM, LOGL_ERROR, |
| 1129 | "Rx MM TMSI Reallocation Complete: invalid: no subscriber\n"); |
| 1130 | return -EINVAL; |
| 1131 | } |
| 1132 | return vlr_subscr_rx_tmsi_reall_compl(conn->vsub); |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1133 | } |
| 1134 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1135 | /* Receive a GSM 04.08 Mobility Management (MM) message */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1136 | static int gsm0408_rcv_mm(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1137 | { |
| 1138 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 4bfdfe7 | 2009-06-10 23:11:52 +0800 | [diff] [blame] | 1139 | int rc = 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1140 | |
Neels Hofmeyr | 531734a | 2016-03-14 16:13:24 +0100 | [diff] [blame] | 1141 | switch (gsm48_hdr_msg_type(gh)) { |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1142 | case GSM48_MT_MM_LOC_UPD_REQUEST: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1143 | rc = mm_rx_loc_upd_req(conn, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1144 | break; |
| 1145 | case GSM48_MT_MM_ID_RESP: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1146 | rc = mm_rx_id_resp(conn, msg); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1147 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1148 | case GSM48_MT_MM_CM_SERV_REQ: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1149 | rc = gsm48_rx_mm_serv_req(conn, msg); |
Harald Welte | 4b63454 | 2008-12-27 01:55:51 +0000 | [diff] [blame] | 1150 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1151 | case GSM48_MT_MM_STATUS: |
Harald Welte | d2a7f5a | 2009-06-05 20:08:20 +0000 | [diff] [blame] | 1152 | rc = gsm48_rx_mm_status(msg); |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1153 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1154 | case GSM48_MT_MM_TMSI_REALL_COMPL: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1155 | rc = gsm48_rx_mm_tmsi_reall_compl(conn); |
Harald Welte | 69b2af2 | 2009-01-06 19:47:00 +0000 | [diff] [blame] | 1156 | break; |
Harald Welte | 231ad4f | 2008-12-27 11:15:38 +0000 | [diff] [blame] | 1157 | case GSM48_MT_MM_IMSI_DETACH_IND: |
Holger Hans Peter Freyther | 153b13b | 2012-07-10 08:53:27 +0200 | [diff] [blame] | 1158 | rc = gsm48_rx_mm_imsi_detach_ind(conn, msg); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1159 | break; |
| 1160 | case GSM48_MT_MM_CM_REEST_REQ: |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 1161 | rc = gsm48_rx_cm_reest_req(conn, msg); |
Harald Welte | 2a13937 | 2009-02-22 21:14:55 +0000 | [diff] [blame] | 1162 | break; |
| 1163 | case GSM48_MT_MM_AUTH_RESP: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1164 | rc = gsm48_rx_mm_auth_resp(conn, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1165 | break; |
Neels Hofmeyr | 22a735b | 2017-02-03 01:22:40 +0100 | [diff] [blame] | 1166 | case GSM48_MT_MM_AUTH_FAIL: |
| 1167 | rc = gsm48_rx_mm_auth_fail(conn, msg); |
| 1168 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1169 | default: |
Harald Welte | 5d24ba1 | 2009-12-24 12:13:17 +0100 | [diff] [blame] | 1170 | LOGP(DMM, LOGL_NOTICE, "Unknown GSM 04.08 MM msg type 0x%02x\n", |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1171 | gh->msg_type); |
| 1172 | break; |
| 1173 | } |
| 1174 | |
| 1175 | return rc; |
| 1176 | } |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1177 | |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1178 | /* Receive a PAGING RESPONSE message from the MS */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1179 | static int gsm48_rx_rr_pag_resp(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1180 | { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1181 | struct gsm_network *net = conn->network; |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1182 | struct gsm48_hdr *gh = msgb_l3(msg); |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 1183 | struct gsm48_pag_resp *pr = |
| 1184 | (struct gsm48_pag_resp *)gh->data; |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1185 | uint8_t classmark2_len = gh->data[1]; |
| 1186 | uint8_t *classmark2 = gh->data+2; |
| 1187 | uint8_t *mi_lv = classmark2 + classmark2_len; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1188 | struct osmo_location_area_id lai; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1189 | bool is_utran; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1190 | |
Neels Hofmeyr | 379d579 | 2018-02-22 04:04:54 +0100 | [diff] [blame] | 1191 | lai.plmn = conn->network->plmn; |
Neels Hofmeyr | e2f24d5 | 2017-05-08 15:12:20 +0200 | [diff] [blame] | 1192 | lai.lac = conn->lac; |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1193 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1194 | if (ran_conn_is_establishing_auth_ciph(conn)) { |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1195 | LOGP(DMM, LOGL_ERROR, |
| 1196 | "Ignoring Paging Response, conn already busy establishing authenticity\n"); |
| 1197 | return 0; |
| 1198 | } |
| 1199 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1200 | if (ran_conn_is_accepted(conn)) { |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1201 | LOGP(DMM, LOGL_ERROR, "Ignoring Paging Response, conn already established\n"); |
| 1202 | return 0; |
| 1203 | } |
| 1204 | |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 1205 | conn->complete_layer3_type = COMPLETE_LAYER3_PAGING_RESP; |
| 1206 | ran_conn_update_id_from_mi(conn, mi_lv + 1, *mi_lv); |
| 1207 | LOG_RAN_CONN_CAT(conn, DRR, LOGL_DEBUG, "PAGING RESPONSE\n"); |
Neels Hofmeyr | 6d804b1 | 2017-02-18 22:20:46 +0100 | [diff] [blame] | 1208 | |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1209 | is_utran = (conn->via_ran == OSMO_RAT_UTRAN_IU); |
Neels Hofmeyr | 4d3a66b | 2018-03-31 18:45:59 +0200 | [diff] [blame] | 1210 | vlr_proc_acc_req(conn->fi, |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1211 | RAN_CONN_E_ACCEPTED, RAN_CONN_E_CN_CLOSE, NULL, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1212 | net->vlr, conn, |
| 1213 | VLR_PR_ARQ_T_PAGING_RESP, mi_lv, &lai, |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1214 | is_utran || conn->network->authentication_required, |
Harald Welte | 7b222aa | 2017-12-23 19:30:32 +0100 | [diff] [blame] | 1215 | is_utran || conn->network->a5_encryption_mask > 0x01, |
Sylvain Munaut | da9f37e | 2019-03-14 11:02:36 +0100 | [diff] [blame] | 1216 | pr->key_seq, |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1217 | classmark2_is_r99(classmark2, classmark2_len), |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1218 | is_utran); |
Holger Freyther | 053e09d | 2009-02-14 22:51:06 +0000 | [diff] [blame] | 1219 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1220 | /* From vlr_proc_acc_req() we expect an implicit dispatch of PR_ARQ_E_START we expect |
| 1221 | * msc_vlr_subscr_assoc() to already have been called and completed. Has an error occured? */ |
| 1222 | if (!conn->vsub) { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 1223 | LOG_RAN_CONN(conn, LOGL_ERROR, "subscriber not allowed to do a Paging Response\n"); |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1224 | return -EIO; |
| 1225 | } |
| 1226 | |
| 1227 | memcpy(conn->vsub->classmark.classmark2, classmark2, classmark2_len); |
| 1228 | conn->vsub->classmark.classmark2_len = classmark2_len; |
| 1229 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1230 | ran_conn_complete_layer_3(conn); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1231 | return 0; |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1232 | } |
| 1233 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1234 | static int gsm48_rx_rr_app_info(struct ran_conn *conn, struct msgb *msg) |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1235 | { |
| 1236 | struct gsm48_hdr *gh = msgb_l3(msg); |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 1237 | uint8_t apdu_id_flags; |
| 1238 | uint8_t apdu_len; |
| 1239 | uint8_t *apdu_data; |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1240 | |
| 1241 | apdu_id_flags = gh->data[0]; |
| 1242 | apdu_len = gh->data[1]; |
| 1243 | apdu_data = gh->data+2; |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1244 | |
Max | 8dc8f23 | 2017-02-09 19:13:02 +0100 | [diff] [blame] | 1245 | DEBUGP(DRR, "RX APPLICATION INFO id/flags=0x%02x apdu_len=%u apdu=%s\n", |
Pablo Neira Ayuso | c0d17f2 | 2011-05-07 12:12:48 +0200 | [diff] [blame] | 1246 | apdu_id_flags, apdu_len, osmo_hexdump(apdu_data, apdu_len)); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1247 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1248 | /* we're not using the app info blob anywhere, so ignore. */ |
| 1249 | #if 0 |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1250 | return db_apdu_blob_store(conn->subscr, apdu_id_flags, apdu_len, apdu_data); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1251 | #else |
| 1252 | return 0; |
| 1253 | #endif |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1254 | } |
| 1255 | |
Harald Welte | bf5e8df | 2009-02-03 12:59:45 +0000 | [diff] [blame] | 1256 | /* Receive a GSM 04.08 Radio Resource (RR) message */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1257 | static int gsm0408_rcv_rr(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1258 | { |
| 1259 | struct gsm48_hdr *gh = msgb_l3(msg); |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1260 | int rc = 0; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1261 | |
| 1262 | switch (gh->msg_type) { |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1263 | case GSM48_MT_RR_PAG_RESP: |
Holger Hans Peter Freyther | db4ef0d | 2010-06-21 10:46:44 +0800 | [diff] [blame] | 1264 | rc = gsm48_rx_rr_pag_resp(conn, msg); |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1265 | break; |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1266 | case GSM48_MT_RR_APP_INFO: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1267 | rc = gsm48_rx_rr_app_info(conn, msg); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1268 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1269 | default: |
Philipp | d37981e | 2016-10-10 15:11:41 +0200 | [diff] [blame] | 1270 | LOGP(DRR, LOGL_NOTICE, "MSC: Unimplemented %s GSM 04.08 RR " |
| 1271 | "message\n", gsm48_rr_msg_name(gh->msg_type)); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1272 | break; |
| 1273 | } |
| 1274 | |
Harald Welte | 2d35ae6 | 2009-02-06 12:02:13 +0000 | [diff] [blame] | 1275 | return rc; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1276 | } |
| 1277 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1278 | int gsm48_send_rr_app_info(struct ran_conn *conn, uint8_t apdu_id, |
Holger Hans Peter Freyther | c42ad8b | 2011-04-18 17:04:00 +0200 | [diff] [blame] | 1279 | uint8_t apdu_len, const uint8_t *apdu) |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1280 | { |
Holger Hans Peter Freyther | 8239e06 | 2016-01-25 22:03:25 +0100 | [diff] [blame] | 1281 | struct msgb *msg = gsm48_msgb_alloc_name("GSM 04.08 APP INF"); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1282 | struct gsm48_hdr *gh; |
| 1283 | |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1284 | DEBUGP(DRR, "TX APPLICATION INFO id=0x%02x, len=%u\n", |
| 1285 | apdu_id, apdu_len); |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1286 | |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1287 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 2 + apdu_len); |
| 1288 | gh->proto_discr = GSM48_PDISC_RR; |
| 1289 | gh->msg_type = GSM48_MT_RR_APP_INFO; |
| 1290 | gh->data[0] = apdu_id; |
| 1291 | gh->data[1] = apdu_len; |
| 1292 | memcpy(gh->data+2, apdu, apdu_len); |
| 1293 | |
Holger Hans Peter Freyther | 9ce1b27 | 2010-06-16 13:52:55 +0800 | [diff] [blame] | 1294 | return gsm48_conn_sendmsg(msg, conn, NULL); |
Harald Welte (local) | 6eef564 | 2009-08-15 23:32:44 +0200 | [diff] [blame] | 1295 | } |
| 1296 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1297 | static bool msg_is_initially_permitted(const struct gsm48_hdr *hdr) |
Holger Hans Peter Freyther | 02d39b2 | 2010-07-05 15:34:16 +0800 | [diff] [blame] | 1298 | { |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1299 | uint8_t pdisc = gsm48_hdr_pdisc(hdr); |
| 1300 | uint8_t msg_type = gsm48_hdr_msg_type(hdr); |
Holger Hans Peter Freyther | 02d39b2 | 2010-07-05 15:34:16 +0800 | [diff] [blame] | 1301 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1302 | switch (pdisc) { |
| 1303 | case GSM48_PDISC_MM: |
| 1304 | switch (msg_type) { |
| 1305 | case GSM48_MT_MM_LOC_UPD_REQUEST: |
| 1306 | case GSM48_MT_MM_CM_SERV_REQ: |
Harald Welte | 49f8fcb | 2018-01-24 21:40:19 +0100 | [diff] [blame] | 1307 | case GSM48_MT_MM_CM_REEST_REQ: |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1308 | case GSM48_MT_MM_AUTH_RESP: |
| 1309 | case GSM48_MT_MM_AUTH_FAIL: |
| 1310 | case GSM48_MT_MM_ID_RESP: |
| 1311 | case GSM48_MT_MM_TMSI_REALL_COMPL: |
| 1312 | case GSM48_MT_MM_IMSI_DETACH_IND: |
| 1313 | return true; |
| 1314 | default: |
| 1315 | break; |
| 1316 | } |
| 1317 | break; |
| 1318 | case GSM48_PDISC_RR: |
| 1319 | switch (msg_type) { |
Neels Hofmeyr | 325f106 | 2018-12-07 16:39:52 +0100 | [diff] [blame] | 1320 | /* GSM48_MT_RR_CIPH_M_COMPL is actually handled in bssmap_rx_ciph_compl() and gets redirected in the |
| 1321 | * BSSAP layer to ran_conn_cipher_mode_compl() (before this here is reached) */ |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1322 | case GSM48_MT_RR_PAG_RESP: |
| 1323 | return true; |
| 1324 | default: |
| 1325 | break; |
| 1326 | } |
| 1327 | break; |
| 1328 | default: |
| 1329 | break; |
Neels Hofmeyr | 42eb014 | 2016-05-20 17:15:44 +0200 | [diff] [blame] | 1330 | } |
| 1331 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1332 | return false; |
Neels Hofmeyr | 42eb014 | 2016-05-20 17:15:44 +0200 | [diff] [blame] | 1333 | } |
| 1334 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1335 | void cm_service_request_concludes(struct ran_conn *conn, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1336 | struct msgb *msg) |
| 1337 | { |
| 1338 | |
| 1339 | /* If a CM Service Request was received before, this is the request the |
| 1340 | * conn was opened for. No need to wait for further messages. */ |
| 1341 | |
| 1342 | if (!conn->received_cm_service_request) |
| 1343 | return; |
| 1344 | |
| 1345 | if (log_check_level(DMM, LOGL_DEBUG)) { |
| 1346 | struct gsm48_hdr *gh = msgb_l3(msg); |
| 1347 | uint8_t pdisc = gsm48_hdr_pdisc(gh); |
| 1348 | uint8_t msg_type = gsm48_hdr_msg_type(gh); |
| 1349 | |
Neels Hofmeyr | 78ada64 | 2017-03-10 02:15:20 +0100 | [diff] [blame] | 1350 | DEBUGP(DMM, "%s: rx msg %s:" |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1351 | " received_cm_service_request changes to false\n", |
| 1352 | vlr_subscr_name(conn->vsub), |
Neels Hofmeyr | 78ada64 | 2017-03-10 02:15:20 +0100 | [diff] [blame] | 1353 | gsm48_pdisc_msgtype_name(pdisc, msg_type)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1354 | } |
| 1355 | conn->received_cm_service_request = false; |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1356 | ran_conn_put(conn, RAN_CONN_USE_CM_SERVICE); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1357 | } |
| 1358 | |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1359 | /* TS 24.007 11.2.3.2.3 Message Type Octet / Duplicate Detection */ |
| 1360 | int gsm0407_pdisc_ctr_bin(uint8_t pdisc) |
| 1361 | { |
| 1362 | switch (pdisc) { |
| 1363 | case GSM48_PDISC_MM: |
| 1364 | case GSM48_PDISC_CC: |
| 1365 | case GSM48_PDISC_NC_SS: |
| 1366 | return 0; |
| 1367 | case GSM48_PDISC_GROUP_CC: |
| 1368 | return 1; |
| 1369 | case GSM48_PDISC_BCAST_CC: |
| 1370 | return 2; |
| 1371 | case GSM48_PDISC_LOC: |
| 1372 | return 3; |
| 1373 | default: |
| 1374 | return -1; |
| 1375 | } |
| 1376 | } |
| 1377 | |
| 1378 | /* extract the N(SD) and return the modulo value for a R98 message */ |
| 1379 | static uint8_t gsm0407_determine_nsd_ret_modulo_r99(uint8_t pdisc, uint8_t msg_type, uint8_t *n_sd) |
| 1380 | { |
| 1381 | switch (pdisc) { |
| 1382 | case GSM48_PDISC_MM: |
| 1383 | case GSM48_PDISC_CC: |
| 1384 | case GSM48_PDISC_NC_SS: |
| 1385 | *n_sd = (msg_type >> 6) & 0x3; |
| 1386 | return 4; |
| 1387 | case GSM48_PDISC_GROUP_CC: |
| 1388 | case GSM48_PDISC_BCAST_CC: |
| 1389 | case GSM48_PDISC_LOC: |
| 1390 | *n_sd = (msg_type >> 6) & 0x1; |
| 1391 | return 2; |
| 1392 | default: |
| 1393 | /* no sequence number, we cannot detect dups */ |
| 1394 | return 0; |
| 1395 | } |
| 1396 | } |
| 1397 | |
| 1398 | /* extract the N(SD) and return the modulo value for a R99 message */ |
| 1399 | static uint8_t gsm0407_determine_nsd_ret_modulo_r98(uint8_t pdisc, uint8_t msg_type, uint8_t *n_sd) |
| 1400 | { |
| 1401 | switch (pdisc) { |
| 1402 | case GSM48_PDISC_MM: |
| 1403 | case GSM48_PDISC_CC: |
| 1404 | case GSM48_PDISC_NC_SS: |
| 1405 | case GSM48_PDISC_GROUP_CC: |
| 1406 | case GSM48_PDISC_BCAST_CC: |
| 1407 | case GSM48_PDISC_LOC: |
| 1408 | *n_sd = (msg_type >> 6) & 0x1; |
| 1409 | return 2; |
| 1410 | default: |
| 1411 | /* no sequence number, we cannot detect dups */ |
| 1412 | return 0; |
| 1413 | } |
| 1414 | } |
| 1415 | |
| 1416 | /* TS 24.007 11.2.3.2 Message Type Octet / Duplicate Detection */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1417 | static bool gsm0407_is_duplicate(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1418 | { |
| 1419 | struct gsm48_hdr *gh; |
| 1420 | uint8_t pdisc; |
Harald Welte | f640073 | 2018-10-21 12:55:11 +0200 | [diff] [blame] | 1421 | uint8_t n_sd, modulo; |
| 1422 | int bin; |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1423 | |
| 1424 | gh = msgb_l3(msg); |
| 1425 | pdisc = gsm48_hdr_pdisc(gh); |
| 1426 | |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1427 | if (conn->vsub && classmark_is_r99(&conn->vsub->classmark)) { |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1428 | modulo = gsm0407_determine_nsd_ret_modulo_r99(pdisc, gh->msg_type, &n_sd); |
Neels Hofmeyr | 986fe7e | 2018-09-13 03:05:52 +0200 | [diff] [blame] | 1429 | } else { /* pre R99 */ |
| 1430 | modulo = gsm0407_determine_nsd_ret_modulo_r98(pdisc, gh->msg_type, &n_sd); |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1431 | } |
| 1432 | if (modulo == 0) |
| 1433 | return false; |
| 1434 | bin = gsm0407_pdisc_ctr_bin(pdisc); |
| 1435 | if (bin < 0) |
| 1436 | return false; |
| 1437 | |
| 1438 | OSMO_ASSERT(bin < ARRAY_SIZE(conn->n_sd_next)); |
| 1439 | if (n_sd != conn->n_sd_next[bin]) { |
| 1440 | /* not what we expected: duplicate */ |
| 1441 | return true; |
| 1442 | } else { |
| 1443 | /* as expected: no dup; update expected counter for next message */ |
| 1444 | conn->n_sd_next[bin] = (n_sd + 1) % modulo; |
| 1445 | return false; |
| 1446 | } |
| 1447 | } |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1448 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1449 | extern int gsm0408_rcv_cc(struct ran_conn *conn, struct msgb *msg); |
Harald Welte | 27989d4 | 2018-06-21 20:39:20 +0200 | [diff] [blame] | 1450 | |
Neels Hofmeyr | 378a492 | 2016-05-09 21:07:43 +0200 | [diff] [blame] | 1451 | /* Main entry point for GSM 04.08/44.008 Layer 3 data (e.g. from the BSC). */ |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1452 | int gsm0408_dispatch(struct ran_conn *conn, struct msgb *msg) |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1453 | { |
Philipp Maier | 91f10c7 | 2017-04-20 18:40:37 +0200 | [diff] [blame] | 1454 | struct gsm48_hdr *gh; |
| 1455 | uint8_t pdisc; |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 1456 | int rc = 0; |
Harald Welte | 5100877 | 2009-12-29 11:49:12 +0100 | [diff] [blame] | 1457 | |
Neels Hofmeyr | 0906a39 | 2017-09-19 14:36:06 +0200 | [diff] [blame] | 1458 | OSMO_ASSERT(msg->l3h); |
Neels Hofmeyr | ffaed9e | 2016-05-09 21:38:51 +0200 | [diff] [blame] | 1459 | OSMO_ASSERT(conn); |
| 1460 | OSMO_ASSERT(msg); |
| 1461 | |
Philipp Maier | 91f10c7 | 2017-04-20 18:40:37 +0200 | [diff] [blame] | 1462 | gh = msgb_l3(msg); |
| 1463 | pdisc = gsm48_hdr_pdisc(gh); |
| 1464 | |
Harald Welte | c200785 | 2018-02-03 21:08:26 +0100 | [diff] [blame] | 1465 | if (gsm0407_is_duplicate(conn, msg)) { |
| 1466 | LOGP(DRLL, LOGL_NOTICE, "%s: Discarding duplicate L3 message\n", |
| 1467 | (conn && conn->vsub) ? vlr_subscr_name(conn->vsub) : "UNKNOWN"); |
| 1468 | return 0; |
| 1469 | } |
| 1470 | |
Neels Hofmeyr | 78ada64 | 2017-03-10 02:15:20 +0100 | [diff] [blame] | 1471 | LOGP(DRLL, LOGL_DEBUG, "Dispatching 04.08 message %s (0x%x:0x%x)\n", |
| 1472 | gsm48_pdisc_msgtype_name(pdisc, gsm48_hdr_msg_type(gh)), |
| 1473 | pdisc, gsm48_hdr_msg_type(gh)); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1474 | |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1475 | if (!ran_conn_is_accepted(conn) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1476 | && !msg_is_initially_permitted(gh)) { |
| 1477 | LOGP(DRLL, LOGL_ERROR, |
Neels Hofmeyr | 78ada64 | 2017-03-10 02:15:20 +0100 | [diff] [blame] | 1478 | "subscr %s: Message not permitted for initial conn: %s\n", |
| 1479 | vlr_subscr_name(conn->vsub), |
| 1480 | gsm48_pdisc_msgtype_name(pdisc, gsm48_hdr_msg_type(gh))); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1481 | return -EACCES; |
| 1482 | } |
| 1483 | |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1484 | if (conn->vsub && conn->vsub->cs.attached_via_ran != conn->via_ran) { |
| 1485 | LOGP(DMM, LOGL_ERROR, |
| 1486 | "%s: Illegal situation: RAN type mismatch:" |
| 1487 | " attached via %s, received message via %s\n", |
| 1488 | vlr_subscr_name(conn->vsub), |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1489 | osmo_rat_type_name(conn->vsub->cs.attached_via_ran), |
| 1490 | osmo_rat_type_name(conn->via_ran)); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1491 | return -EACCES; |
| 1492 | } |
| 1493 | |
Philipp Maier | e0d5caa | 2017-02-27 16:56:59 +0100 | [diff] [blame] | 1494 | #if 0 |
Holger Hans Peter Freyther | 758f4df | 2010-06-21 10:34:03 +0800 | [diff] [blame] | 1495 | if (silent_call_reroute(conn, msg)) |
| 1496 | return silent_call_rx(conn, msg); |
Philipp Maier | e0d5caa | 2017-02-27 16:56:59 +0100 | [diff] [blame] | 1497 | #endif |
Alexander Couzens | fbd96f5 | 2016-08-29 18:40:02 +0200 | [diff] [blame] | 1498 | |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1499 | switch (pdisc) { |
| 1500 | case GSM48_PDISC_CC: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1501 | rc = gsm0408_rcv_cc(conn, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1502 | break; |
| 1503 | case GSM48_PDISC_MM: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1504 | rc = gsm0408_rcv_mm(conn, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1505 | break; |
| 1506 | case GSM48_PDISC_RR: |
Holger Hans Peter Freyther | 3f122be | 2010-06-17 17:14:35 +0800 | [diff] [blame] | 1507 | rc = gsm0408_rcv_rr(conn, msg); |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1508 | break; |
Harald Welte | bcae43f | 2008-12-27 21:45:37 +0000 | [diff] [blame] | 1509 | case GSM48_PDISC_SMS: |
Holger Hans Peter Freyther | 9764331 | 2010-06-17 16:41:25 +0800 | [diff] [blame] | 1510 | rc = gsm0411_rcv_sms(conn, msg); |
Harald Welte | bcae43f | 2008-12-27 21:45:37 +0000 | [diff] [blame] | 1511 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1512 | case GSM48_PDISC_MM_GPRS: |
Harald Welte | bcae43f | 2008-12-27 21:45:37 +0000 | [diff] [blame] | 1513 | case GSM48_PDISC_SM_GPRS: |
Harald Welte | 5d24ba1 | 2009-12-24 12:13:17 +0100 | [diff] [blame] | 1514 | LOGP(DRLL, LOGL_NOTICE, "Unimplemented " |
| 1515 | "GSM 04.08 discriminator 0x%02x\n", pdisc); |
Neels Hofmeyr | ffaed9e | 2016-05-09 21:38:51 +0200 | [diff] [blame] | 1516 | rc = -ENOTSUP; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1517 | break; |
Harald Welte | 6eafe91 | 2009-10-16 08:32:58 +0200 | [diff] [blame] | 1518 | case GSM48_PDISC_NC_SS: |
Vadim Yanitskiy | 5b860fa | 2018-06-12 05:24:52 +0700 | [diff] [blame] | 1519 | rc = gsm0911_rcv_nc_ss(conn, msg); |
Harald Welte | 6eafe91 | 2009-10-16 08:32:58 +0200 | [diff] [blame] | 1520 | break; |
Harald Welte | eac38c3 | 2017-05-29 18:02:53 +0200 | [diff] [blame] | 1521 | case GSM48_PDISC_TEST: |
| 1522 | rc = gsm0414_rcv_test(conn, msg); |
| 1523 | break; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1524 | default: |
Harald Welte | 5d24ba1 | 2009-12-24 12:13:17 +0100 | [diff] [blame] | 1525 | LOGP(DRLL, LOGL_NOTICE, "Unknown " |
| 1526 | "GSM 04.08 discriminator 0x%02x\n", pdisc); |
Neels Hofmeyr | ffaed9e | 2016-05-09 21:38:51 +0200 | [diff] [blame] | 1527 | rc = -EINVAL; |
Harald Welte | 52b1f98 | 2008-12-23 20:25:15 +0000 | [diff] [blame] | 1528 | break; |
| 1529 | } |
| 1530 | |
| 1531 | return rc; |
| 1532 | } |
Harald Welte | 8470bf2 | 2008-12-25 23:28:35 +0000 | [diff] [blame] | 1533 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1534 | /*********************************************************************** |
| 1535 | * VLR integration |
| 1536 | ***********************************************************************/ |
| 1537 | |
| 1538 | /* VLR asks us to send an authentication request */ |
Neels Hofmeyr | 8b6e536 | 2018-11-30 02:57:33 +0100 | [diff] [blame] | 1539 | static int msc_vlr_tx_auth_req(void *msc_conn_ref, struct vlr_auth_tuple *at, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1540 | bool send_autn) |
| 1541 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1542 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1543 | return gsm48_tx_mm_auth_req(conn, at->vec.rand, |
| 1544 | send_autn? at->vec.autn : NULL, |
| 1545 | at->key_seq); |
| 1546 | } |
| 1547 | |
| 1548 | /* VLR asks us to send an authentication reject */ |
| 1549 | static int msc_vlr_tx_auth_rej(void *msc_conn_ref) |
| 1550 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1551 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1552 | return gsm48_tx_mm_auth_rej(conn); |
| 1553 | } |
| 1554 | |
| 1555 | /* VLR asks us to transmit an Identity Request of given type */ |
| 1556 | static int msc_vlr_tx_id_req(void *msc_conn_ref, uint8_t mi_type) |
| 1557 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1558 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1559 | return mm_tx_identity_req(conn, mi_type); |
| 1560 | } |
| 1561 | |
| 1562 | /* VLR asks us to transmit a Location Update Accept */ |
| 1563 | static int msc_vlr_tx_lu_acc(void *msc_conn_ref, uint32_t send_tmsi) |
| 1564 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1565 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1566 | return gsm0408_loc_upd_acc(conn, send_tmsi); |
| 1567 | } |
| 1568 | |
| 1569 | /* VLR asks us to transmit a Location Update Reject */ |
Neels Hofmeyr | 1580959 | 2018-04-06 02:57:51 +0200 | [diff] [blame] | 1570 | static int msc_vlr_tx_lu_rej(void *msc_conn_ref, enum gsm48_reject_value cause) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1571 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1572 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1573 | return gsm0408_loc_upd_rej(conn, cause); |
| 1574 | } |
| 1575 | |
| 1576 | /* VLR asks us to transmit a CM Service Accept */ |
| 1577 | static int msc_vlr_tx_cm_serv_acc(void *msc_conn_ref) |
| 1578 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1579 | struct ran_conn *conn = msc_conn_ref; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1580 | return msc_gsm48_tx_mm_serv_ack(conn); |
| 1581 | } |
| 1582 | |
| 1583 | static int msc_vlr_tx_common_id(void *msc_conn_ref) |
| 1584 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1585 | struct ran_conn *conn = msc_conn_ref; |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1586 | return msc_tx_common_id(conn); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1587 | } |
| 1588 | |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1589 | /* VLR asks us to transmit MM info. */ |
| 1590 | static int msc_vlr_tx_mm_info(void *msc_conn_ref) |
| 1591 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1592 | struct ran_conn *conn = msc_conn_ref; |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1593 | if (!conn->network->send_mm_info) |
| 1594 | return 0; |
| 1595 | return gsm48_tx_mm_info(conn); |
| 1596 | } |
| 1597 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1598 | /* VLR asks us to transmit a CM Service Reject */ |
Neels Hofmeyr | 1580959 | 2018-04-06 02:57:51 +0200 | [diff] [blame] | 1599 | static int msc_vlr_tx_cm_serv_rej(void *msc_conn_ref, enum gsm48_reject_value cause) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1600 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1601 | struct ran_conn *conn = msc_conn_ref; |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1602 | int rc; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1603 | |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1604 | rc = msc_gsm48_tx_mm_serv_rej(conn, cause); |
| 1605 | |
| 1606 | if (conn->received_cm_service_request) { |
| 1607 | conn->received_cm_service_request = false; |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1608 | ran_conn_put(conn, RAN_CONN_USE_CM_SERVICE); |
Neels Hofmeyr | e3d3dc6 | 2018-03-31 00:02:14 +0200 | [diff] [blame] | 1609 | } |
| 1610 | |
| 1611 | return rc; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1612 | } |
| 1613 | |
Neels Hofmeyr | 703638e | 2017-12-14 05:30:16 +0100 | [diff] [blame] | 1614 | /* For msc_vlr_set_ciph_mode() */ |
| 1615 | osmo_static_assert(sizeof(((struct gsm0808_encrypt_info*)0)->key) >= sizeof(((struct osmo_auth_vector*)0)->kc), |
| 1616 | gsm0808_encrypt_info_key_fits_osmo_auth_vec_kc); |
| 1617 | |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1618 | int ran_conn_geran_set_cipher_mode(struct ran_conn *conn, bool umts_aka, bool retrieve_imeisv) |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1619 | { |
Philipp Maier | ec5901c | 2019-01-08 12:29:49 +0100 | [diff] [blame] | 1620 | struct gsm_network *net; |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1621 | struct gsm0808_encrypt_info ei; |
| 1622 | int i, j = 0; |
| 1623 | int request_classmark = 0; |
| 1624 | int request_classmark_for_a5_n = 0; |
Philipp Maier | ec5901c | 2019-01-08 12:29:49 +0100 | [diff] [blame] | 1625 | struct vlr_auth_tuple *tuple; |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1626 | |
| 1627 | if (!conn || !conn->vsub || !conn->vsub->last_tuple) { |
| 1628 | /* This should really never happen, because we checked this in msc_vlr_set_ciph_mode() |
| 1629 | * already. */ |
| 1630 | LOGP(DMM, LOGL_ERROR, "Internal error: missing state during Ciphering Mode Command\n"); |
| 1631 | return -EINVAL; |
| 1632 | } |
| 1633 | |
Philipp Maier | ec5901c | 2019-01-08 12:29:49 +0100 | [diff] [blame] | 1634 | net = conn->network; |
| 1635 | tuple = conn->vsub->last_tuple; |
| 1636 | |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1637 | for (i = 0; i < 8; i++) { |
| 1638 | int supported; |
| 1639 | |
| 1640 | /* A5/n permitted by osmo-msc.cfg? */ |
| 1641 | if (!(net->a5_encryption_mask & (1 << i))) |
| 1642 | continue; |
| 1643 | |
| 1644 | /* A5/n supported by MS? */ |
| 1645 | supported = classmark_supports_a5(&conn->vsub->classmark, i); |
| 1646 | if (supported == 1) { |
| 1647 | ei.perm_algo[j++] = vlr_ciph_to_gsm0808_alg_id(i); |
| 1648 | /* A higher A5/n is supported, so no need to request a Classmark |
| 1649 | * for support of a lesser A5/n. */ |
| 1650 | request_classmark = 0; |
| 1651 | } else if (supported < 0) { |
| 1652 | request_classmark = -supported; |
| 1653 | request_classmark_for_a5_n = i; |
| 1654 | } |
| 1655 | } |
| 1656 | ei.perm_algo_len = j; |
| 1657 | |
| 1658 | if (request_classmark) { |
| 1659 | /* The highest A5/n as from osmo-msc.cfg might be available, but we are |
| 1660 | * still missing the Classmark information for that from the MS. First |
| 1661 | * ask for that. */ |
| 1662 | LOGP(DMM, LOGL_DEBUG, "%s: to determine whether A5/%d is supported," |
| 1663 | " first ask for a Classmark Update to obtain Classmark %d\n", |
| 1664 | vlr_subscr_name(conn->vsub), request_classmark_for_a5_n, |
| 1665 | request_classmark); |
| 1666 | |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1667 | return ran_conn_classmark_request_then_cipher_mode_cmd(conn, umts_aka, retrieve_imeisv); |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1668 | } |
| 1669 | |
| 1670 | if (ei.perm_algo_len == 0) { |
| 1671 | LOGP(DMM, LOGL_ERROR, "%s: cannot start ciphering, no intersection " |
Neels Hofmeyr | 5769d36 | 2018-12-18 03:13:51 +0100 | [diff] [blame] | 1672 | "between MSC-configured and MS-supported A5 algorithms. MSC: %x MS: %s\n", |
| 1673 | vlr_subscr_name(conn->vsub), net->a5_encryption_mask, |
| 1674 | classmark_a5_name(&conn->vsub->classmark)); |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1675 | return -ENOTSUP; |
| 1676 | } |
| 1677 | |
| 1678 | DEBUGP(DMM, "-> CIPHER MODE COMMAND %s\n", vlr_subscr_name(conn->vsub)); |
| 1679 | |
| 1680 | tuple = conn->vsub->last_tuple; |
| 1681 | |
| 1682 | /* In case of UMTS AKA, the Kc for ciphering must be derived from the 3G auth |
| 1683 | * tokens. tuple->vec.kc was calculated from the GSM algorithm and is not |
| 1684 | * necessarily a match for the UMTS AKA tokens. */ |
| 1685 | if (umts_aka) |
| 1686 | osmo_auth_c3(ei.key, tuple->vec.ck, tuple->vec.ik); |
| 1687 | else |
| 1688 | memcpy(ei.key, tuple->vec.kc, sizeof(tuple->vec.kc)); |
| 1689 | ei.key_len = sizeof(tuple->vec.kc); |
| 1690 | |
Neels Hofmeyr | f41658d | 2018-11-30 04:35:50 +0100 | [diff] [blame] | 1691 | conn->geran_encr = (struct geran_encr){}; |
| 1692 | if (ei.key_len <= sizeof(conn->geran_encr.key)) { |
| 1693 | memcpy(conn->geran_encr.key, ei.key, ei.key_len); |
| 1694 | conn->geran_encr.key_len = ei.key_len; |
Neels Hofmeyr | b0779bb | 2018-11-29 23:37:19 +0100 | [diff] [blame] | 1695 | } |
Neels Hofmeyr | f41658d | 2018-11-30 04:35:50 +0100 | [diff] [blame] | 1696 | /* conn->geran_encr.alg_id remains unknown until we receive a Cipher Mode Complete from the BSC */ |
Neels Hofmeyr | b0779bb | 2018-11-29 23:37:19 +0100 | [diff] [blame] | 1697 | |
Neels Hofmeyr | 3117b70 | 2018-09-13 03:23:07 +0200 | [diff] [blame] | 1698 | return a_iface_tx_cipher_mode(conn, &ei, retrieve_imeisv); |
| 1699 | } |
| 1700 | |
Neels Hofmeyr | da21a52 | 2018-03-02 01:50:09 +0100 | [diff] [blame] | 1701 | /* VLR asks us to start using ciphering. |
| 1702 | * (Keep non-static to allow regression testing on this function.) */ |
| 1703 | int msc_vlr_set_ciph_mode(void *msc_conn_ref, |
| 1704 | bool umts_aka, |
| 1705 | bool retrieve_imeisv) |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1706 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1707 | struct ran_conn *conn = msc_conn_ref; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1708 | struct vlr_subscr *vsub; |
Neels Hofmeyr | 8b6e536 | 2018-11-30 02:57:33 +0100 | [diff] [blame] | 1709 | struct vlr_auth_tuple *tuple; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1710 | |
| 1711 | if (!conn || !conn->vsub) { |
| 1712 | LOGP(DMM, LOGL_ERROR, "Cannot send Ciphering Mode Command to" |
| 1713 | " NULL conn/subscriber"); |
| 1714 | return -EINVAL; |
| 1715 | } |
| 1716 | |
| 1717 | vsub = conn->vsub; |
| 1718 | tuple = vsub->last_tuple; |
| 1719 | |
| 1720 | if (!tuple) { |
| 1721 | LOGP(DMM, LOGL_ERROR, "subscr %s: Cannot send Ciphering Mode" |
| 1722 | " Command: no auth tuple available\n", |
| 1723 | vlr_subscr_name(vsub)); |
| 1724 | return -EINVAL; |
| 1725 | } |
| 1726 | |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1727 | switch (conn->via_ran) { |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1728 | case OSMO_RAT_GERAN_A: |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1729 | return ran_conn_geran_set_cipher_mode(conn, umts_aka, retrieve_imeisv); |
Neels Hofmeyr | 703638e | 2017-12-14 05:30:16 +0100 | [diff] [blame] | 1730 | |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1731 | case OSMO_RAT_UTRAN_IU: |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1732 | #ifdef BUILD_IU |
| 1733 | DEBUGP(DMM, "-> SECURITY MODE CONTROL %s\n", |
| 1734 | vlr_subscr_name(conn->vsub)); |
Neels Hofmeyr | 00e82d6 | 2017-07-05 15:19:52 +0200 | [diff] [blame] | 1735 | return ranap_iu_tx_sec_mode_cmd(conn->iu.ue_ctx, &tuple->vec, 0, 1); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1736 | #else |
Neels Hofmeyr | 7814a83 | 2018-12-26 00:40:18 +0100 | [diff] [blame] | 1737 | LOGP(DMM, LOGL_ERROR, "Cannot send Security Mode Control over OSMO_RAT_UTRAN_IU," |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1738 | " built without Iu support\n"); |
| 1739 | return -ENOTSUP; |
| 1740 | #endif |
| 1741 | |
| 1742 | default: |
| 1743 | break; |
| 1744 | } |
| 1745 | LOGP(DMM, LOGL_ERROR, |
| 1746 | "%s: cannot start ciphering, unknown RAN type %d\n", |
| 1747 | vlr_subscr_name(conn->vsub), conn->via_ran); |
| 1748 | return -ENOTSUP; |
| 1749 | } |
| 1750 | |
Neels Hofmeyr | 3c20a5e | 2018-11-30 01:08:36 +0100 | [diff] [blame] | 1751 | void ran_conn_rx_sec_mode_compl(struct ran_conn *conn) |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1752 | { |
| 1753 | struct vlr_ciph_result vlr_res = {}; |
| 1754 | |
| 1755 | if (!conn || !conn->vsub) { |
| 1756 | LOGP(DMM, LOGL_ERROR, |
| 1757 | "Rx Security Mode Complete for invalid conn\n"); |
| 1758 | return; |
| 1759 | } |
| 1760 | |
| 1761 | DEBUGP(DMM, "<- SECURITY MODE COMPLETE %s\n", |
| 1762 | vlr_subscr_name(conn->vsub)); |
| 1763 | |
| 1764 | vlr_res.cause = VLR_CIPH_COMPL; |
| 1765 | vlr_subscr_rx_ciph_res(conn->vsub, &vlr_res); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1766 | } |
| 1767 | |
| 1768 | /* VLR informs us that the subscriber data has somehow been modified */ |
| 1769 | static void msc_vlr_subscr_update(struct vlr_subscr *subscr) |
| 1770 | { |
Max | a263bb2 | 2017-12-27 13:23:44 +0100 | [diff] [blame] | 1771 | LOGVSUBP(LOGL_NOTICE, subscr, "VLR: update for IMSI=%s (MSISDN=%s, used=%d)\n", |
| 1772 | subscr->imsi, subscr->msisdn, subscr->use_count); |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 1773 | ran_conn_update_id_for_vsub(subscr); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1774 | } |
| 1775 | |
Neels Hofmeyr | 68cf957 | 2018-09-18 15:52:58 +0200 | [diff] [blame] | 1776 | static void update_classmark(const struct gsm_classmark *src, struct gsm_classmark *dst) |
| 1777 | { |
| 1778 | if (src->classmark1_set) { |
| 1779 | dst->classmark1 = src->classmark1; |
| 1780 | dst->classmark1_set = true; |
| 1781 | } |
| 1782 | if (src->classmark2_len) { |
| 1783 | dst->classmark2_len = src->classmark2_len; |
| 1784 | memcpy(dst->classmark2, src->classmark2, sizeof(dst->classmark2)); |
| 1785 | } |
| 1786 | if (src->classmark3_len) { |
| 1787 | dst->classmark3_len = src->classmark3_len; |
| 1788 | memcpy(dst->classmark3, src->classmark3, sizeof(dst->classmark3)); |
| 1789 | } |
| 1790 | } |
| 1791 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1792 | /* VLR informs us that the subscriber has been associated with a conn */ |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1793 | static int msc_vlr_subscr_assoc(void *msc_conn_ref, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1794 | struct vlr_subscr *vsub) |
| 1795 | { |
Neels Hofmeyr | c036b79 | 2018-11-29 22:37:51 +0100 | [diff] [blame] | 1796 | struct ran_conn *conn = msc_conn_ref; |
Max | 48d4ec0 | 2018-02-12 16:51:03 +0100 | [diff] [blame] | 1797 | OSMO_ASSERT(vsub); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1798 | if (conn->vsub) { |
| 1799 | if (conn->vsub == vsub) |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 1800 | LOG_RAN_CONN(conn, LOGL_NOTICE, "msc_vlr_subscr_assoc(): conn already associated with %s\n", |
| 1801 | vlr_subscr_name(vsub)); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1802 | else { |
Neels Hofmeyr | 46c06e2 | 2019-01-04 17:42:05 +0100 | [diff] [blame] | 1803 | LOG_RAN_CONN(conn, LOGL_ERROR, "msc_vlr_subscr_assoc(): conn already associated with a subscriber," |
| 1804 | " cannot associate with %s\n", vlr_subscr_name(vsub)); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1805 | return -EINVAL; |
| 1806 | } |
| 1807 | } |
| 1808 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1809 | conn->vsub = vlr_subscr_get(vsub); |
Max | 48d4ec0 | 2018-02-12 16:51:03 +0100 | [diff] [blame] | 1810 | OSMO_ASSERT(conn->vsub); |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1811 | conn->vsub->cs.attached_via_ran = conn->via_ran; |
Neels Hofmeyr | 68cf957 | 2018-09-18 15:52:58 +0200 | [diff] [blame] | 1812 | |
| 1813 | /* In case we have already received Classmark Information before the VLR Subscriber was |
| 1814 | * associated with the conn: merge the new Classmark into vsub->classmark. Don't overwrite valid |
| 1815 | * vsub->classmark with unset classmark, though. */ |
| 1816 | update_classmark(&conn->temporary_classmark, &conn->vsub->classmark); |
Neels Hofmeyr | 361e571 | 2019-01-03 02:32:14 +0100 | [diff] [blame] | 1817 | ran_conn_update_id(conn); |
Neels Hofmeyr | 1035d90 | 2018-12-28 21:22:32 +0100 | [diff] [blame] | 1818 | return 0; |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1819 | } |
| 1820 | |
Vadim Yanitskiy | 8a0e258 | 2018-06-14 03:54:33 +0700 | [diff] [blame] | 1821 | static int msc_vlr_route_gsup_msg(struct vlr_subscr *vsub, |
| 1822 | struct osmo_gsup_message *gsup_msg) |
| 1823 | { |
| 1824 | switch (gsup_msg->message_type) { |
Vadim Yanitskiy | 8a6ef55 | 2018-06-12 08:21:20 +0700 | [diff] [blame] | 1825 | /* GSM 09.11 code implementing SS/USSD */ |
| 1826 | case OSMO_GSUP_MSGT_PROC_SS_REQUEST: |
| 1827 | case OSMO_GSUP_MSGT_PROC_SS_RESULT: |
| 1828 | case OSMO_GSUP_MSGT_PROC_SS_ERROR: |
| 1829 | DEBUGP(DMSC, "Routed to GSM 09.11 SS/USSD handler\n"); |
| 1830 | return gsm0911_gsup_handler(vsub, gsup_msg); |
| 1831 | |
Vadim Yanitskiy | 76ef72d | 2018-11-07 05:08:18 +0700 | [diff] [blame] | 1832 | /* GSM 04.11 code implementing MO SMS */ |
| 1833 | case OSMO_GSUP_MSGT_MO_FORWARD_SM_ERROR: |
| 1834 | case OSMO_GSUP_MSGT_MO_FORWARD_SM_RESULT: |
| 1835 | case OSMO_GSUP_MSGT_READY_FOR_SM_ERROR: |
| 1836 | case OSMO_GSUP_MSGT_READY_FOR_SM_RESULT: |
| 1837 | DEBUGP(DMSC, "Routed to GSM 04.11 MO handler\n"); |
| 1838 | return gsm411_gsup_mo_handler(vsub, gsup_msg); |
| 1839 | |
Vadim Yanitskiy | 82cc8a5 | 2018-11-15 01:05:53 +0700 | [diff] [blame] | 1840 | /* GSM 04.11 code implementing MT SMS */ |
| 1841 | case OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST: |
| 1842 | DEBUGP(DMSC, "Routed to GSM 04.11 MT handler\n"); |
| 1843 | return gsm411_gsup_mt_handler(vsub, gsup_msg); |
| 1844 | |
Vadim Yanitskiy | 8a0e258 | 2018-06-14 03:54:33 +0700 | [diff] [blame] | 1845 | default: |
| 1846 | LOGP(DMM, LOGL_ERROR, "No handler found for %s, dropping message...\n", |
| 1847 | osmo_gsup_message_type_name(gsup_msg->message_type)); |
| 1848 | return -GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL; |
| 1849 | } |
| 1850 | } |
| 1851 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1852 | /* operations that we need to implement for libvlr */ |
| 1853 | static const struct vlr_ops msc_vlr_ops = { |
| 1854 | .tx_auth_req = msc_vlr_tx_auth_req, |
| 1855 | .tx_auth_rej = msc_vlr_tx_auth_rej, |
| 1856 | .tx_id_req = msc_vlr_tx_id_req, |
| 1857 | .tx_lu_acc = msc_vlr_tx_lu_acc, |
| 1858 | .tx_lu_rej = msc_vlr_tx_lu_rej, |
| 1859 | .tx_cm_serv_acc = msc_vlr_tx_cm_serv_acc, |
| 1860 | .tx_cm_serv_rej = msc_vlr_tx_cm_serv_rej, |
| 1861 | .set_ciph_mode = msc_vlr_set_ciph_mode, |
Neels Hofmeyr | 84da6b1 | 2016-05-20 21:59:55 +0200 | [diff] [blame] | 1862 | .tx_common_id = msc_vlr_tx_common_id, |
Stefan Sperling | 3a74128 | 2018-03-13 21:11:49 +0100 | [diff] [blame] | 1863 | .tx_mm_info = msc_vlr_tx_mm_info, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1864 | .subscr_update = msc_vlr_subscr_update, |
| 1865 | .subscr_assoc = msc_vlr_subscr_assoc, |
Vadim Yanitskiy | 8a0e258 | 2018-06-14 03:54:33 +0700 | [diff] [blame] | 1866 | .forward_gsup_msg = msc_vlr_route_gsup_msg, |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1867 | }; |
| 1868 | |
| 1869 | /* Allocate net->vlr so that the VTY may configure the VLR's data structures */ |
| 1870 | int msc_vlr_alloc(struct gsm_network *net) |
| 1871 | { |
| 1872 | net->vlr = vlr_alloc(net, &msc_vlr_ops); |
| 1873 | if (!net->vlr) |
| 1874 | return -ENOMEM; |
| 1875 | net->vlr->user_ctx = net; |
| 1876 | return 0; |
| 1877 | } |
| 1878 | |
| 1879 | /* Launch the VLR, i.e. its GSUP connection */ |
| 1880 | int msc_vlr_start(struct gsm_network *net) |
| 1881 | { |
Stefan Sperling | afa030d | 2018-12-06 12:06:59 +0100 | [diff] [blame] | 1882 | struct ipaccess_unit *ipa_dev; |
| 1883 | |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1884 | OSMO_ASSERT(net->vlr); |
Stefan Sperling | afa030d | 2018-12-06 12:06:59 +0100 | [diff] [blame] | 1885 | |
| 1886 | ipa_dev = talloc_zero(net->vlr, struct ipaccess_unit); |
| 1887 | ipa_dev->unit_name = "MSC"; |
| 1888 | ipa_dev->serno = net->msc_ipa_name; /* NULL unless configured via VTY */ |
Stefan Sperling | 36dedee | 2018-12-06 13:16:24 +0100 | [diff] [blame] | 1889 | ipa_dev->swversion = PACKAGE_NAME "-" PACKAGE_VERSION; |
Stefan Sperling | afa030d | 2018-12-06 12:06:59 +0100 | [diff] [blame] | 1890 | |
| 1891 | return vlr_start(ipa_dev, net->vlr, net->gsup_server_addr_str, net->gsup_server_port); |
Harald Welte | 2483f1b | 2016-06-19 18:06:02 +0200 | [diff] [blame] | 1892 | } |
Neels Hofmeyr | 79e580b | 2018-03-22 16:48:22 +0100 | [diff] [blame] | 1893 | |
| 1894 | struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value) |
| 1895 | { |
| 1896 | struct msgb *msg; |
| 1897 | struct gsm48_hdr *gh; |
| 1898 | |
| 1899 | msg = gsm48_msgb_alloc_name("GSM 04.08 SERV REJ"); |
| 1900 | if (!msg) |
| 1901 | return NULL; |
| 1902 | |
| 1903 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 1904 | gh->proto_discr = GSM48_PDISC_MM; |
| 1905 | gh->msg_type = GSM48_MT_MM_CM_SERV_REJ; |
| 1906 | gh->data[0] = value; |
| 1907 | |
| 1908 | return msg; |
| 1909 | } |
| 1910 | |
| 1911 | struct msgb *gsm48_create_loc_upd_rej(uint8_t cause) |
| 1912 | { |
| 1913 | struct gsm48_hdr *gh; |
| 1914 | struct msgb *msg; |
| 1915 | |
| 1916 | msg = gsm48_msgb_alloc_name("GSM 04.08 LOC UPD REJ"); |
| 1917 | if (!msg) |
| 1918 | return NULL; |
| 1919 | |
| 1920 | gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1); |
| 1921 | gh->proto_discr = GSM48_PDISC_MM; |
| 1922 | gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT; |
| 1923 | gh->data[0] = cause; |
| 1924 | return msg; |
| 1925 | } |
| 1926 | |
| 1927 | int gsm48_extract_mi(uint8_t *classmark2_lv, int length, char *mi_string, uint8_t *mi_type) |
| 1928 | { |
| 1929 | /* Check the size for the classmark */ |
| 1930 | if (length < 1 + *classmark2_lv) |
| 1931 | return -1; |
| 1932 | |
| 1933 | uint8_t *mi_lv = classmark2_lv + *classmark2_lv + 1; |
| 1934 | if (length < 2 + *classmark2_lv + mi_lv[0]) |
| 1935 | return -2; |
| 1936 | |
| 1937 | *mi_type = mi_lv[1] & GSM_MI_TYPE_MASK; |
| 1938 | return gsm48_mi_to_string(mi_string, GSM48_MI_SIZE, mi_lv+1, *mi_lv); |
| 1939 | } |
| 1940 | |
| 1941 | int gsm48_paging_extract_mi(struct gsm48_pag_resp *resp, int length, |
| 1942 | char *mi_string, uint8_t *mi_type) |
| 1943 | { |
| 1944 | static const uint32_t classmark_offset = |
| 1945 | offsetof(struct gsm48_pag_resp, classmark2); |
| 1946 | uint8_t *classmark2_lv = (uint8_t *) &resp->classmark2; |
| 1947 | return gsm48_extract_mi(classmark2_lv, length - classmark_offset, |
| 1948 | mi_string, mi_type); |
| 1949 | } |