Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 1 | /* USSD Filter Code */ |
| 2 | |
| 3 | /* |
Holger Hans Peter Freyther | a18b116 | 2011-04-01 17:32:21 +0200 | [diff] [blame] | 4 | * (C) 2010-2011 by Holger Hans Peter Freyther <zecke@selfish.org> |
| 5 | * (C) 2010-2011 by On-Waves |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 6 | * All Rights Reserved |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 9 | * it under the terms of the GNU Affero General Public License as published by |
| 10 | * the Free Software Foundation; either version 3 of the License, or |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 11 | * (at your option) any later version. |
| 12 | * |
| 13 | * This program is distributed in the hope that it will be useful, |
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 16 | * GNU Affero General Public License for more details. |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 17 | * |
Harald Welte | 9af6ddf | 2011-01-01 15:25:50 +0100 | [diff] [blame] | 18 | * You should have received a copy of the GNU Affero General Public License |
| 19 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 20 | * |
| 21 | */ |
| 22 | |
| 23 | #include <openbsc/bsc_nat.h> |
| 24 | #include <openbsc/bsc_nat_sccp.h> |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 25 | #include <openbsc/ipaccess.h> |
| 26 | #include <openbsc/socket.h> |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 27 | |
Harald Welte | d36ff76 | 2011-03-23 18:26:56 +0100 | [diff] [blame] | 28 | #include <osmocom/gsm/protocol/gsm_08_08.h> |
| 29 | #include <osmocom/gsm/gsm0480.h> |
Pablo Neira Ayuso | 136f453 | 2011-03-22 16:47:59 +0100 | [diff] [blame] | 30 | #include <osmocom/core/talloc.h> |
Harald Welte | d36ff76 | 2011-03-23 18:26:56 +0100 | [diff] [blame] | 31 | #include <osmocom/gsm/tlv.h> |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 32 | |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 33 | #include <osmocom/sccp/sccp.h> |
| 34 | |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 35 | #include <sys/socket.h> |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 36 | #include <string.h> |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 37 | #include <unistd.h> |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 38 | |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 39 | struct bsc_nat_ussd_con { |
| 40 | struct write_queue queue; |
| 41 | struct bsc_nat *nat; |
| 42 | int authorized; |
| 43 | |
| 44 | struct timer_list auth_timeout; |
| 45 | }; |
| 46 | |
| 47 | static void ussd_auth_con(struct tlv_parsed *, struct bsc_nat_ussd_con *); |
| 48 | |
| 49 | static struct bsc_nat_ussd_con *bsc_nat_ussd_alloc(struct bsc_nat *nat) |
| 50 | { |
| 51 | struct bsc_nat_ussd_con *con; |
| 52 | |
| 53 | con = talloc_zero(nat, struct bsc_nat_ussd_con); |
| 54 | if (!con) |
| 55 | return NULL; |
| 56 | |
| 57 | con->nat = nat; |
| 58 | return con; |
| 59 | } |
| 60 | |
| 61 | static void bsc_nat_ussd_destroy(struct bsc_nat_ussd_con *con) |
| 62 | { |
Holger Hans Peter Freyther | 54f5352 | 2010-10-27 11:01:55 +0200 | [diff] [blame] | 63 | if (con->nat->ussd_con == con) { |
| 64 | bsc_close_ussd_connections(con->nat); |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 65 | con->nat->ussd_con = NULL; |
Holger Hans Peter Freyther | 54f5352 | 2010-10-27 11:01:55 +0200 | [diff] [blame] | 66 | } |
| 67 | |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 68 | close(con->queue.bfd.fd); |
| 69 | bsc_unregister_fd(&con->queue.bfd); |
| 70 | bsc_del_timer(&con->auth_timeout); |
| 71 | write_queue_clear(&con->queue); |
| 72 | talloc_free(con); |
| 73 | } |
| 74 | |
Holger Hans Peter Freyther | 90bbccf | 2010-10-16 17:34:37 +0200 | [diff] [blame] | 75 | static int forward_sccp(struct bsc_nat *nat, struct msgb *msg) |
| 76 | { |
| 77 | struct sccp_connections *con; |
| 78 | struct bsc_nat_parsed *parsed; |
| 79 | |
| 80 | |
| 81 | parsed = bsc_nat_parse(msg); |
| 82 | if (!parsed) { |
| 83 | LOGP(DNAT, LOGL_ERROR, "Can not parse msg from USSD.\n"); |
| 84 | msgb_free(msg); |
| 85 | return -1; |
| 86 | } |
| 87 | |
| 88 | if (!parsed->dest_local_ref) { |
| 89 | LOGP(DNAT, LOGL_ERROR, "No destination local reference.\n"); |
| 90 | msgb_free(msg); |
| 91 | return -1; |
| 92 | } |
| 93 | |
| 94 | con = bsc_nat_find_con_by_bsc(nat, parsed->dest_local_ref); |
| 95 | if (!con || !con->bsc) { |
| 96 | LOGP(DNAT, LOGL_ERROR, "No active connection found.\n"); |
| 97 | msgb_free(msg); |
| 98 | return -1; |
| 99 | } |
| 100 | |
| 101 | talloc_free(parsed); |
| 102 | bsc_write_msg(&con->bsc->write_queue, msg); |
| 103 | return 0; |
| 104 | } |
| 105 | |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 106 | static int ussd_read_cb(struct bsc_fd *bfd) |
| 107 | { |
| 108 | int error; |
| 109 | struct bsc_nat_ussd_con *conn = bfd->data; |
| 110 | struct msgb *msg = ipaccess_read_msg(bfd, &error); |
| 111 | struct ipaccess_head *hh; |
| 112 | |
| 113 | if (!msg) { |
| 114 | LOGP(DNAT, LOGL_ERROR, "USSD Connection was lost.\n"); |
| 115 | bsc_nat_ussd_destroy(conn); |
| 116 | return -1; |
| 117 | } |
| 118 | |
| 119 | LOGP(DNAT, LOGL_NOTICE, "MSG from USSD: %s proto: %d\n", |
| 120 | hexdump(msg->data, msg->len), msg->l2h[0]); |
| 121 | hh = (struct ipaccess_head *) msg->data; |
| 122 | |
| 123 | if (hh->proto == IPAC_PROTO_IPACCESS) { |
| 124 | if (msg->l2h[0] == IPAC_MSGT_ID_RESP) { |
| 125 | struct tlv_parsed tvp; |
| 126 | ipaccess_idtag_parse(&tvp, |
| 127 | (unsigned char *) msg->l2h + 2, |
| 128 | msgb_l2len(msg) - 2); |
| 129 | if (TLVP_PRESENT(&tvp, IPAC_IDTAG_UNITNAME)) |
| 130 | ussd_auth_con(&tvp, conn); |
| 131 | } |
| 132 | |
| 133 | msgb_free(msg); |
| 134 | } else if (hh->proto == IPAC_PROTO_SCCP) { |
Holger Hans Peter Freyther | 90bbccf | 2010-10-16 17:34:37 +0200 | [diff] [blame] | 135 | forward_sccp(conn->nat, msg); |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 136 | } else { |
| 137 | msgb_free(msg); |
| 138 | } |
| 139 | |
| 140 | return 0; |
| 141 | } |
| 142 | |
| 143 | static void ussd_auth_cb(void *_data) |
| 144 | { |
| 145 | LOGP(DNAT, LOGL_ERROR, "USSD module didn't authenticate\n"); |
| 146 | bsc_nat_ussd_destroy((struct bsc_nat_ussd_con *) _data); |
| 147 | } |
| 148 | |
| 149 | static void ussd_auth_con(struct tlv_parsed *tvp, struct bsc_nat_ussd_con *conn) |
| 150 | { |
| 151 | const char *token; |
| 152 | int len; |
| 153 | if (!conn->nat->ussd_token) { |
| 154 | LOGP(DNAT, LOGL_ERROR, "No USSD token set. Closing\n"); |
| 155 | bsc_nat_ussd_destroy(conn); |
| 156 | return; |
| 157 | } |
| 158 | |
| 159 | token = (const char *) TLVP_VAL(tvp, IPAC_IDTAG_UNITNAME); |
| 160 | len = TLVP_LEN(tvp, IPAC_IDTAG_UNITNAME); |
| 161 | if (strncmp(conn->nat->ussd_token, token, len) != 0) { |
| 162 | LOGP(DNAT, LOGL_ERROR, "Wrong USSD token by client: %d\n", |
| 163 | conn->queue.bfd.fd); |
| 164 | bsc_nat_ussd_destroy(conn); |
| 165 | return; |
| 166 | } |
| 167 | |
| 168 | /* it is authenticated now */ |
| 169 | if (conn->nat->ussd_con && conn->nat->ussd_con != conn) |
| 170 | bsc_nat_ussd_destroy(conn->nat->ussd_con); |
| 171 | |
| 172 | LOGP(DNAT, LOGL_ERROR, "USSD token specified. USSD provider is connected.\n"); |
| 173 | bsc_del_timer(&conn->auth_timeout); |
| 174 | conn->authorized = 1; |
| 175 | conn->nat->ussd_con = conn; |
| 176 | } |
| 177 | |
| 178 | static void ussd_start_auth(struct bsc_nat_ussd_con *conn) |
| 179 | { |
| 180 | struct msgb *msg; |
| 181 | |
| 182 | conn->auth_timeout.data = conn; |
| 183 | conn->auth_timeout.cb = ussd_auth_cb; |
| 184 | bsc_schedule_timer(&conn->auth_timeout, conn->nat->auth_timeout, 0); |
| 185 | |
| 186 | msg = msgb_alloc_headroom(4096, 128, "auth message"); |
| 187 | if (!msg) { |
| 188 | LOGP(DNAT, LOGL_ERROR, "Failed to allocate auth msg\n"); |
| 189 | return; |
| 190 | } |
| 191 | |
| 192 | msgb_v_put(msg, IPAC_MSGT_ID_GET); |
| 193 | bsc_do_write(&conn->queue, msg, IPAC_PROTO_IPACCESS); |
| 194 | } |
| 195 | |
| 196 | static int ussd_listen_cb(struct bsc_fd *bfd, unsigned int what) |
| 197 | { |
| 198 | struct bsc_nat_ussd_con *conn; |
| 199 | struct bsc_nat *nat; |
| 200 | struct sockaddr_in sa; |
| 201 | socklen_t sa_len = sizeof(sa); |
| 202 | int fd; |
| 203 | |
| 204 | if (!(what & BSC_FD_READ)) |
| 205 | return 0; |
| 206 | |
| 207 | fd = accept(bfd->fd, (struct sockaddr *) &sa, &sa_len); |
| 208 | if (fd < 0) { |
| 209 | perror("accept"); |
| 210 | return fd; |
| 211 | } |
| 212 | |
| 213 | nat = (struct bsc_nat *) bfd->data; |
| 214 | counter_inc(nat->stats.ussd.reconn); |
| 215 | |
| 216 | conn = bsc_nat_ussd_alloc(nat); |
| 217 | if (!conn) { |
| 218 | LOGP(DNAT, LOGL_ERROR, "Failed to allocate USSD con struct.\n"); |
| 219 | close(fd); |
| 220 | return -1; |
| 221 | } |
| 222 | |
| 223 | write_queue_init(&conn->queue, 10); |
| 224 | conn->queue.bfd.data = conn; |
| 225 | conn->queue.bfd.fd = fd; |
| 226 | conn->queue.bfd.when = BSC_FD_READ; |
| 227 | conn->queue.read_cb = ussd_read_cb; |
| 228 | conn->queue.write_cb = bsc_write_cb; |
| 229 | |
| 230 | if (bsc_register_fd(&conn->queue.bfd) < 0) { |
| 231 | LOGP(DNAT, LOGL_ERROR, "Failed to register USSD fd.\n"); |
| 232 | bsc_nat_ussd_destroy(conn); |
| 233 | return -1; |
| 234 | } |
| 235 | |
| 236 | LOGP(DNAT, LOGL_NOTICE, "USSD Connection on %d with IP: %s\n", |
| 237 | fd, inet_ntoa(sa.sin_addr)); |
| 238 | |
| 239 | /* do authentication */ |
| 240 | ussd_start_auth(conn); |
| 241 | return 0; |
| 242 | } |
| 243 | |
| 244 | int bsc_ussd_init(struct bsc_nat *nat) |
| 245 | { |
| 246 | struct in_addr addr; |
| 247 | |
| 248 | addr.s_addr = INADDR_ANY; |
| 249 | if (nat->ussd_local) |
| 250 | inet_aton(nat->ussd_local, &addr); |
| 251 | |
| 252 | nat->ussd_listen.data = nat; |
| 253 | return make_sock(&nat->ussd_listen, IPPROTO_TCP, |
Pablo Neira Ayuso | 165fe56 | 2011-04-05 18:33:24 +0200 | [diff] [blame^] | 254 | ntohl(addr.s_addr), 5001, 0, ussd_listen_cb, NULL); |
Holger Hans Peter Freyther | c16c2dc | 2010-10-13 20:22:36 +0200 | [diff] [blame] | 255 | } |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 256 | |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 257 | static int forward_ussd(struct sccp_connections *con, const struct ussd_request *req, |
| 258 | struct msgb *input) |
| 259 | { |
Holger Hans Peter Freyther | 90bbccf | 2010-10-16 17:34:37 +0200 | [diff] [blame] | 260 | struct msgb *msg, *copy; |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 261 | struct ipac_msgt_sccp_state *state; |
| 262 | struct bsc_nat_ussd_con *ussd; |
| 263 | |
| 264 | if (!con->bsc->nat->ussd_con) |
| 265 | return -1; |
| 266 | |
| 267 | msg = msgb_alloc_headroom(4096, 128, "forward ussd"); |
| 268 | if (!msg) { |
| 269 | LOGP(DNAT, LOGL_ERROR, "Allocation failed, not forwarding.\n"); |
| 270 | return -1; |
| 271 | } |
| 272 | |
Holger Hans Peter Freyther | 90bbccf | 2010-10-16 17:34:37 +0200 | [diff] [blame] | 273 | copy = msgb_alloc_headroom(4096, 128, "forward bts"); |
| 274 | if (!copy) { |
| 275 | LOGP(DNAT, LOGL_ERROR, "Allocation failed, not forwarding.\n"); |
| 276 | msgb_free(msg); |
| 277 | return -1; |
| 278 | } |
| 279 | |
| 280 | copy->l2h = msgb_put(copy, msgb_l2len(input)); |
| 281 | memcpy(copy->l2h, input->l2h, msgb_l2len(input)); |
| 282 | |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 283 | msg->l2h = msgb_put(msg, 1); |
Holger Hans Peter Freyther | 368a0a7 | 2011-01-07 16:54:46 +0100 | [diff] [blame] | 284 | msg->l2h[0] = IPAC_MSGT_SCCP_OLD; |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 285 | |
| 286 | /* fill out the data */ |
| 287 | state = (struct ipac_msgt_sccp_state *) msgb_put(msg, sizeof(*state)); |
| 288 | state->trans_id = req->transaction_id; |
| 289 | state->invoke_id = req->invoke_id; |
| 290 | memcpy(&state->src_ref, &con->remote_ref, sizeof(con->remote_ref)); |
| 291 | memcpy(&state->dst_ref, &con->real_ref, sizeof(con->real_ref)); |
| 292 | memcpy(state->imsi, con->imsi, strlen(con->imsi)); |
| 293 | |
| 294 | ussd = con->bsc->nat->ussd_con; |
| 295 | bsc_do_write(&ussd->queue, msg, IPAC_PROTO_IPACCESS); |
Holger Hans Peter Freyther | 90bbccf | 2010-10-16 17:34:37 +0200 | [diff] [blame] | 296 | bsc_do_write(&ussd->queue, copy, IPAC_PROTO_SCCP); |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 297 | |
| 298 | return 0; |
| 299 | } |
| 300 | |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 301 | int bsc_check_ussd(struct sccp_connections *con, struct bsc_nat_parsed *parsed, |
| 302 | struct msgb *msg) |
| 303 | { |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 304 | uint32_t len; |
| 305 | uint8_t msg_type; |
| 306 | struct gsm48_hdr *hdr48; |
| 307 | struct bsc_nat_acc_lst *lst; |
| 308 | struct ussd_request req; |
| 309 | |
| 310 | /* |
| 311 | * various checks to avoid the decoding work. Right now we only want to |
| 312 | * decode if the connection was created for USSD, we do have a USSD access |
| 313 | * list, a query, a IMSI and such... |
| 314 | */ |
| 315 | if (con->con_type != NAT_CON_TYPE_SSA) |
| 316 | return 0; |
| 317 | |
| 318 | if (!con->imsi) |
| 319 | return 0; |
| 320 | |
| 321 | if (!con->bsc->nat->ussd_lst_name) |
| 322 | return 0; |
| 323 | if (!con->bsc->nat->ussd_query) |
| 324 | return 0; |
| 325 | |
| 326 | if (parsed->bssap != BSSAP_MSG_DTAP) |
| 327 | return 0; |
| 328 | |
| 329 | if (strlen(con->imsi) > GSM_IMSI_LENGTH) |
| 330 | return 0; |
| 331 | |
| 332 | hdr48 = bsc_unpack_dtap(parsed, msg, &len); |
| 333 | if (!hdr48) |
| 334 | return 0; |
| 335 | |
| 336 | msg_type = hdr48->msg_type & 0xbf; |
| 337 | if (hdr48->proto_discr != GSM48_PDISC_NC_SS || msg_type != GSM0480_MTYPE_REGISTER) |
| 338 | return 0; |
| 339 | |
| 340 | /* now check if it is a IMSI we care about */ |
| 341 | lst = bsc_nat_acc_lst_find(con->bsc->nat, con->bsc->nat->ussd_lst_name); |
| 342 | if (!lst) |
| 343 | return 0; |
| 344 | |
| 345 | if (bsc_nat_lst_check_allow(lst, con->imsi) != 0) |
| 346 | return 0; |
| 347 | |
| 348 | /* now decode the message and see if we really want to handle it */ |
| 349 | memset(&req, 0, sizeof(req)); |
| 350 | if (gsm0480_decode_ussd_request(hdr48, len, &req) != 1) |
| 351 | return 0; |
| 352 | if (req.text[0] == 0xff) |
| 353 | return 0; |
| 354 | |
Holger Hans Peter Freyther | a18b116 | 2011-04-01 17:32:21 +0200 | [diff] [blame] | 355 | if (regexec(&con->bsc->nat->ussd_query_re, req.text, 0, NULL, 0) == REG_NOMATCH) |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 356 | return 0; |
| 357 | |
| 358 | /* found a USSD query for our subscriber */ |
| 359 | LOGP(DNAT, LOGL_NOTICE, "Found USSD query for %s\n", con->imsi); |
Holger Hans Peter Freyther | 4c401e7 | 2010-10-15 10:09:31 +0200 | [diff] [blame] | 360 | if (forward_ussd(con, &req, msg) != 0) |
| 361 | return 0; |
Holger Hans Peter Freyther | 3229f44 | 2010-10-11 10:07:37 +0200 | [diff] [blame] | 362 | return 1; |
Holger Hans Peter Freyther | 17870cf | 2010-09-29 19:32:55 +0800 | [diff] [blame] | 363 | } |