paulmataruso/openbts
1
0
Fork 0
mirror of https://github.com/RangeNetworks/openbts.git synced 2025-10-22 23:32:00 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
openbts/SGSNGGSN/Sgsn.cpp
Michael Iedema 49087580a0 merge 5.0 preview from commercial
2014-07-16 23:57:22 +02:00

1690 lines
58 KiB
C++
Raw Permalink Blame History

/*
* Copyright 2011, 2014 Range Networks, Inc.
*
* This software is distributed under multiple licenses;
* see the COPYING file in the main directory for licensing
* information for this specific distribution.
*
* This use of this software may be subject to additional restrictions.
* See the LEGAL file in the main directory for details.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/
#include <list>
#if RN_UMTS
#include <SIPInterface.h>
#include <SIPUtility.h>
#include <SIPMessage.h>
#include <SIPEngine.h>
using namespace SIP;
#endif
//#include "RList.h"
#include "LLC.h"
//#include "MSInfo.h"
#include "GPRSL3Messages.h"
#include "Ggsn.h"
#include "Sgsn.h"
#include "Utils.h"
#include "Globals.h"
//#include "MAC.h"
#include "miniggsn.h"
using namespace Utils;
#define CASENAME(x) case x: return #x;
#define SRB3 3
namespace SGSN {
typedef std::list<SgsnInfo*> SgsnInfoList_t;
static SgsnInfoList_t sSgsnInfoList;
typedef std::list<GmmInfo*> GmmInfoList_t;
static GmmInfoList_t sGmmInfoList;
static Mutex sSgsnListMutex; // One lock sufficient for all lists maintained by SGSN.
static void dumpGmmInfo();
#if RN_UMTS
static void sendAuthenticationRequest(SgsnInfo *si, string IMSI);
#endif
//static void killOtherTlli(SgsnInfo *si,uint32_t newTlli);
static SgsnInfo *sgsnGetSgsnInfoByHandle(uint32_t mshandle, bool create);
static int getNMO();
bool sgsnDebug()
{
return (gConfig.getBool("SGSN.Debug") || gConfig.getBool("GPRS.Debug"));
}
bool enableMultislot()
{
return gConfig.getNum(SQL_MULTISLOTMAXDOWNLINK) > 1 ||
gConfig.getNum(SQL_MULTISLOTMAXUPLINK) > 1;
}
const char *GmmCause::name(unsigned mt, bool ornull)
{
switch (mt) {
CASENAME(IMSI_unknown_in_HLR)
CASENAME(Illegal_MS)
CASENAME(IMEI_not_accepted)
CASENAME(Illegal_ME)
CASENAME(GPRS_services_not_allowed)
CASENAME(GPRS_services_and_non_GPRS_services_not_allowed)
CASENAME(MS_identity_cannot_be_derived_by_the_network)
CASENAME(Implicitly_detached)
CASENAME(PLMN_not_allowed)
CASENAME(Location_Area_not_allowed)
CASENAME(Roaming_not_allowed_in_this_location_area)
CASENAME(GPRS_services_not_allowed_in_this_PLMN)
CASENAME(No_Suitable_Cells_In_Location_Area)
CASENAME(MSC_temporarily_not_reachable)
CASENAME(Network_failure)
CASENAME(MAC_failure)
CASENAME(Synch_failure)
CASENAME(Congestion)
CASENAME(GSM_authentication_unacceptable)
CASENAME(Not_authorized_for_this_CSG)
CASENAME(No_PDP_context_activated)
// 0x30 to 0x3f - retry upon entry into a new cell?
CASENAME(Semantically_incorrect_message)
CASENAME(Invalid_mandatory_information)
CASENAME(Message_type_nonexistent_or_not_implemented)
CASENAME(Message_type_not_compatible_with_the_protocol_state)
CASENAME(Information_element_nonexistent_or_not_implemented)
CASENAME(Conditional_IE_error)
CASENAME(Message_not_compatible_with_the_protocol_state)
CASENAME(Protocol_error_unspecified)
default:
return ornull ? 0 : "unrecognized GmmCause type";
}
}
SgsnInfo::SgsnInfo(uint32_t wMsHandle) :
//mState(GmmState::GmmNotOurTlli),
mGmmp(0),
mLlcEngine(0),
mMsHandle(wMsHandle),
mT3310FinishAttach(15000), // 15 seconds
mT3370ImsiRequest(6000) // 6 seconds
// mSuspended(0),
{
//memset(mOldMcc,0,sizeof(mOldMcc));
//memset(mOldMnc,0,sizeof(mOldMnc));
time(&mLastUseTime);
#if RN_UMTS == 0
mLlcEngine = new LlcEngine(this);
#endif
sSgsnInfoList.push_back(this);
}
SgsnInfo::~SgsnInfo()
{
if (mLlcEngine) {delete mLlcEngine;}
}
void SgsnInfo::sirm()
{
std::ostringstream ss;
sgsnInfoDump(this,ss);
SGSNLOG("Removing SgsnInfo:"<<ss);
sSgsnInfoList.remove(this);
delete this;
}
// This is for use by the Command Line Interface
// Return true on success.
bool cliSgsnInfoDelete(SgsnInfo *si)
{
ScopedLock lock(sSgsnListMutex);
GmmInfo *gmm = si->getGmm();
if (gmm && gmm->getSI() == si) {
// You cannot delete this si by itself. Must delete the GmmInfo instead.
return false;
}
si->sirm();
return true;
}
// This is the generalized printer to identify an SgsnInfo.
// The alternate sgsnInfoDump is used only for gmmDump and prints
// only that info that is not duplicated in the Gmm.
std::ostream& operator<<(std::ostream& os, const SgsnInfo*si)
{
MSUEAdapter *ms = si->getMS();
if (ms) {
os << ms->msid();
} else {
#if RN_UMTS
os << LOGHEX2("URNTI", si->mMsHandle);
#else
os << LOGHEX2("TLLI", si->mMsHandle);
#endif
}
if (si->getGmm()) { os << LOGVAR2("imsi",si->getGmm()->mImsi.hexstr()); }
return os;
}
// Reset this connection, for example, because it is doing a GmmDetach or a new GmmAttach.
void SgsnInfo::sgsnReset()
{
freePdpAll(true);
if (mLlcEngine) { mLlcEngine->getLlcGmm()->reset(); }
}
// The operator is allowed to choose the P-TMSI allocation strategy, subject to the constraints
// that they should not collide in the same routing area, must not be all 1s, and we dont allow all 0s either.
// Note that the MS sends RA [Routing Area] along with TMSI.
// The MS creates a local TLLI from the P-TMSI by setting the top two bits,
// so the P-TMSI is really limited to 30 bits.
// For UMTS, the URNTI consists of a 20-bit (really 16-bit, because it must fit in that) UE id
// plus a 12 bit SRNC id.
static uint32_t gPTmsiNext = 0;
static uint32_t allocatePTmsi()
{
if (gPTmsiNext == 0) {
// Add in the time to the starting TMSI so if the BTS is restarted there is a better chance
// of not using the same tmsis over again.
time_t now;
time(&now);
gPTmsiNext = ((now&0xff)<<12) + 1;
}
if (gPTmsiNext == 0 || gPTmsiNext >= (1<<30)) { gPTmsiNext = 1; }
return gPTmsiNext++;
//return Tlli::makeLocalTlli(gPTmsiNext++);
}
MSUEAdapter *SgsnInfo::getMS() const
{
// The MSInfo struct disappears after a period of time, so look it up.
//return GPRS::gL2MAC.macFindMSByTLLI(mMsHandle,0);
return SgsnAdapter::findMs(mMsHandle);
}
GmmInfo::GmmInfo(ByteVector &imsi):
mImsi(imsi), mState(GmmState::GmmDeregistered), msi(0)
{
memset(mPdps,0,sizeof(mPdps));
mPTmsi = allocatePTmsi();
mGprsMultislotClass = -1; // -1 means invalid.
mAttachTime = 0;
// Must set activityTime to prevent immediate removal from list by another phone simultaneously connection.
setActivity();
ScopedLock lock(sSgsnListMutex);
sGmmInfoList.push_back(this);
}
GmmInfo::~GmmInfo()
{
freePdpAll(true);
}
// Assumes sSgsnListMutex is locked on entry.
static void GmmRemove(GmmInfo *gmm)
{
std::ostringstream ss;
gmmInfoDump(gmm,ss,0);
SGSNLOG("Removing gmm:"<<ss);
SgsnInfo *si;
RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,si) {
// The second test here should be redundant.
if (si->getGmm() == gmm || gmm->getSI() == si) {
si->sirm(); // yes this is suboptimal, but list is short
}
}
#if 0
for (SgsnInfoList_t::iterator itr = sSgsnInfoList.begin(); itr != sSgsnInfoList.end(); ) {
SgsnInfo *si = *itr;
if (si->getGmm() == gmm) {
itr = sSgsnInfoList.erase(itr);
delete si;
} else {
itr++;
}
}
#endif
sGmmInfoList.remove(gmm);
delete gmm;
}
// This is for use by the Command Line Interface
void cliGmmDelete(GmmInfo *gmm)
{
ScopedLock lock(sSgsnListMutex);
GmmRemove(gmm);
}
PdpContext *GmmInfo::getPdp(unsigned nsapi)
{
//return mSndcp[nsapi] ? mSndcp[nsapi]->mPdp : 0;
assert(nsapi < sNumPdps);
setActivity();
return mPdps[nsapi];
}
// True if the pdpcontext is not in state PDP-INACTIVE
bool GmmInfo::isNSapiActive(unsigned nsapi)
{
assert(nsapi < sNumPdps);
return !(mPdps[nsapi] == 0 || mPdps[nsapi]->isPdpInactive());
}
// This status is sent back to the MS in messages to indicate what the Network thinks
// what PDPContexts are currently in use.
PdpContextStatus GmmInfo::getPdpContextStatus()
{
PdpContextStatus result;
for (int i = 0; i <= 7; i++) {
if (isNSapiActive(i)) { result.mStatus[0] |= (1<<i); }
if (isNSapiActive(i+8)) { result.mStatus[1] |= (1<<i); }
}
return result;
}
void GmmInfo::connectPdp(PdpContext *pdp, mg_con_t *mgp)
{
// Order may be important here.
// We dont want to hook the mgp up until the stack is all connected and prepared
// to receive packets, because they could come blasting in any time,
// even before any outgoing packets are sent.
assert(pdp->mNSapi >= 0 && pdp->mNSapi < (int)sNumPdps);
mPdps[pdp->mNSapi] = pdp;
// getSI() should never NULL. The mLlcEngine is null in umts.
SgsnInfo *si = getSI();
assert(si);
if (si->mLlcEngine) { si->mLlcEngine->allocSndcp(si,pdp->mNSapi,pdp->mLlcSapi); }
mg_con_open(mgp,pdp);
}
// Return TRUE if the pdp was allocated.
bool GmmInfo::freePdp(unsigned nsapi)
{
assert(nsapi < sNumPdps);
PdpContext *pdp = mPdps[nsapi];
mPdps[nsapi] = 0;
if (pdp) delete pdp; // This disconnects the mgp also.
// getSI() should never be NULL. The mLlcEngine is null in umts.
#if SNDCP_IN_PDP
// sndcp is in the PdpContext and deleted automatically.
// Do we want to reset the LLC Sapi? Doubt it because it is shared.
#else
LlcEngine *llc = getSI() ? getSI()->mLlcEngine : NULL;
if (llc) { llc->freeSndcp(nsapi); }
#endif
return !!pdp;
}
void SgsnInfo::deactivateRabs(unsigned nsapiMask)
{
#if RN_UMTS
MSUEAdapter *ms = getMS();
if (ms) {
ms->msDeactivateRabs(nsapiMask);
} else {
SGSNERROR("ggsn: DeactivatePdpContextRequest: MS not found "<<this);
}
#endif
}
// Return a mask of RABs that were freed.
unsigned GmmInfo::freePdpAll(bool freeRabsToo)
{
unsigned rabMask = 0;
for (unsigned nsapi = 0; nsapi < sNumPdps; nsapi++) {
if (freePdp(nsapi)) { rabMask |= 1<<nsapi; }
}
if (freeRabsToo && rabMask) {
// It would be a serious internal error for getSI() to fail, but check anyway.
if (getSI()) { getSI()->deactivateRabs(rabMask); }
}
if (rabMask) addShellRequest("PdpDeactivateAll",this);
return rabMask;
}
void SgsnInfo::sgsnSend2PdpLowSide(int nsapi, ByteVector &packet)
{
PdpContext *pdp = getPdp(nsapi);
assert(pdp);
pdp->pdpWriteLowSide(packet);
}
// The rbid is not used by GPRS, and is just 0.
void SgsnInfo::sgsnSend2MsHighSide(ByteVector &pdu,const char *descr, int rbid)
{
MSUEAdapter *ms = getMS();
#if RN_UMTS
// TODO: It would be safer not to call getMS, but just send the dlpdu through
// an InterthreadQueue and let the UMTS or GPRS L2 handle that part in its own thread.
// In that case we have to add oldTlli to the message also.
if (!ms) {
SGSNWARN("no corresponding MS for URNTI " << mMsHandle);
return;
}
// For UMTS we pass the rbid which is an intrinsic part of this channel.
// TODO: Update UMTS to use DownlinkPdu too.
ms->msWriteHighSide(pdu,rbid,descr);
#else
GmmInfo *gmm = getGmm();
uint32_t tlli, aliasTlli = 0;
if (gmm && gmm->isRegistered()) {
tlli = gmm->getTlli(); // The TLLI based on the assigned P-TMSI.
} else {
// We send the message using the TLLI of the SgsnInfo,
// which is the one the MS used to talk to us.
tlli = mMsHandle;
// If we know the P-TMSI that will be used for the local TLLI
// for this MS after the attach procedure, notify L2.
if (gmm) { aliasTlli = gmm->getTlli(); }
if (aliasTlli == tlli) { aliasTlli = 0; } // Be tidy; but dont think this can happen.
}
if (!ms) {
LOG(WARNING) << "no corresponding MS for TLLI " << mMsHandle;
return;
}
GprsSgsnDownlinkPdu *dlpdu = new GprsSgsnDownlinkPdu(pdu,tlli,aliasTlli,descr);
//ms->msWriteHighSide(dlpdu);
// This is thread safe:
// Go ahead and enqueue it even if there is no MS
SgsnAdapter::saWriteHighSide(dlpdu);
#endif
}
void SgsnInfo::sgsnWriteHighSideMsg(L3GprsDlMsg &msg)
{
#if RN_UMTS
// bypass llc
ByteVector bv(1000);
bv.setAppendP(0,0);
msg.gWrite(bv);
SGSNLOG("Sending "<<msg.str() <<this);
sgsnSend2MsHighSide(bv,msg.mtname(),SRB3); // TODO: Is SRB3 correct?
#else
LlcDlFrame lframe(1000);
lframe.setAppendP(0,0);
msg.gWrite(lframe);
SGSNLOG("Sending "<<msg.str() <<this<<" frame(first20)="<<lframe.head(MIN(20,lframe.size())));
mLlcEngine->getLlcGmm()->lleWriteHighSide(lframe,msg.isSenseCmd(),msg.mtname());
#endif
}
// Incoming packets on a PdpContext come here.
void SgsnInfo::sgsnWriteHighSide(ByteVector &sdu,int nsapi)
{
#if RN_UMTS
// The PDCP is a complete no-op.
sgsnSend2MsHighSide(sdu,"userdata",nsapi);
#else
mLlcEngine->llcWriteHighSide(sdu,nsapi);
#endif
}
// TLLI 03.03 2.6, Specified in binary:
// starts with 11 - local tlli
// starts with 10 - foreign tlli
// starts with 01111 - random tlli
// starts with 01110 - auxiliary tlli.
// TLLI may not be all 1s, and if it starts with one of the above, cant be all 0s either.
//struct Tlli {
// enum Type { Unused, LocalTlli, ForeignTlli, RandomTlli, AuxTlli, UnknownTlli };
// static Type tlli2Type(uint32_t tlli) {
// unsigned toptwo = tlli >> (32-2); // It is unsigned, dont have to mask.
// if (toptwo == 0x3) return LocalTlli;
// if (toptwo == 0x2) return ForeignTlli;
// unsigned topfive = tlli >> (32-5); // It is unsigned, dont have to mask.
// if (topfive == 0x0f) return RandomTlli;
// if (topfive == 0x0e) return AuxTlli;
// return UnknownTlli;
// }
// //static uint32_t tlli2ptmsi(uint32_t tlli) { return tlli & ~sLocalTlliMask; }
// // Make a local TLLI
// //static uint32_t makeLocalTlli(uint32_t tmsi) { return tmsi | sLocalTlliMask; }
//};
// Return Network Mode of Operation 1,2,3
static int getNMO()
{
return gConfig.getNum("GPRS.NMO");
}
void sendAttachAccept(SgsnInfo *si)
{
si->mT3310FinishAttach.reset();
GmmInfo *gmm = si->getGmm();
assert(gmm);
//L3GmmMsgAttachAccept aa(si->attachResult(),gmm->getPTmsi(),si->mAttachMobileId);
uint32_t ptmsi = gmm->getPTmsi();
L3GmmMsgAttachAccept aa(si->attachResult(),ptmsi);
// We are finished with the attach procedure now.
// Note that we are using the si (and TLLI) that the message was sent on.
// If the BTS and the MS disagreed on the attach state at the start of this procedure,
// we reset the MS registration to match what the MS thinks to make sure we will
// use the old TLLI in the si, not the new one based on the PTMSI.
si->sgsnWriteHighSideMsg(aa);
}
static void handleAttachStep(SgsnInfo *si)
{
GmmInfo *gmm = si->getGmm();
if (!gmm) { // This cannot happen.
SGSNERROR("No imsi found for MS during Attach procedure"<<si);
return;
}
#if RN_UMTS
// Must do the Security Proecedure first, message flow like this:
// L3 AttachRequest
// MS ---------------------------------> Network
// RRC SecurityModeCommand
// MS <--------------------------------- Network
// RRC SecurityModeComplete
// MS ---------------------------------> Network
// L3 AttachAccept
// MS <--------------------------------- Network
// (pat) Update: Havind added the authentication for NMO I in here,
// so the above procedure is now moved to
// If we are in NMO 2, authentication was allegedly already done by
// the Mobility Management protocol layer, in which case there is
// a Kc sitting in the TMSI table.
// We need to pass it a nul-terminated IMSI string.
string IMSI = gmm->mImsi.hexstr();
//int len = gmm->mImsi.size();
//char imsi[len+2];
//memcpy(imsi,gmm->mImsi.hexstr().c_str(),len);
//imsi[len] = 0;
LOG(INFO) << "Looking up Kc for imsi " << IMSI;
string Kcs = gTMSITable.getKc(IMSI.c_str());
if (Kcs.length() <= 1) {
SGSNERROR("No Kc found for MS in TMSI table during Attach procedure"<<si);
// need to do authentication, send authentication request
//sendAuthenticationRequest(si);
}
sendAuthenticationRequest(si,IMSI);
#else
// We must use the TLLI that the MS used, not the PTMSI.
// To do that, reset the registered status.
gmm->setGmmState(GmmState::GmmDeregistered);
sendAttachAccept(si);
#endif
}
#if RN_UMTS
// Called from UMTS when it receives the SecurityModeComplete or SecurityModeFailure msg.
void MSUEAdapter::sgsnHandleSecurityModeComplete(bool success)
{
SgsnInfo *si = sgsnGetSgsnInfo();
// The si would only be null if the UE sent us a spurious SecurityModeComplete command.
if (si == NULL) {
SGSNERROR("Received spurious SecurityMode completion command for UE:"<<msid());
return;
}
if (! si->mT3310FinishAttach.active()) {
SGSNERROR("Received security response after T3310 expiration for UE:"<<si);
return;
}
if (success) {
sendAttachAccept(si); // happiness
} else {
SGSNERROR("Integrity Protection failed for UE:"<<si);
// Oops! We could send an attach reject, but why bother?
// The UE already knows it failed, no recovery is possible,
// and it will timeout shortly anyway.
}
}
#endif
#if RN_UMTS
static void sendAuthenticationRequest(SgsnInfo *si, string IMSI)
{
SIPEngine engine(gConfig.getStr("SIP.Proxy.Registration").c_str(),IMSI.c_str());
string RAND;
//bool success =
engine.Register(SIPEngine::SIPRegister, &RAND);
// Stick new UE into TMSI table if its not already there
if (!gTMSITable.TMSI(IMSI.c_str())) gTMSITable.assign(IMSI.c_str());
ByteVector rand(RAND.size()/2); // Leave it random.
for (unsigned i = 0; i < RAND.size(); i++) {
char ch = (RAND.c_str())[i];
ch = (ch > '9') ? ((ch & 0x0f) + 9) : (ch & 0x0f);
rand.setField(i*4,ch,4);
}
L3GmmMsgAuthentication amsg(rand);
si->sgsnWriteHighSideMsg(amsg);
si->mRAND = rand;
}
#endif
static void handleAuthenticationResponse(SgsnInfo *si, L3GmmMsgAuthenticationResponse &armsg)
{
#if RN_UMTS
if (Sgsn::isUmts()) {
GmmInfo *gmm = si->getGmm();
if (!gmm) {
SGSNERROR("No imsi found for MS during Attach procedure"<<si);
return;
}
string IMSI = gmm->mImsi.hexstr();
string RAND = si->mRAND.hexstr();
// verify SRES
bool success = false;
try {
SIPEngine engine(gConfig.getStr("SIP.Proxy.Registration").c_str(),IMSI.c_str());
SGSNLOG("waiting for registration on IMSI: " << IMSI);
string SRESstr = armsg.mSRES.hexstr();
success = engine.Register(SIPEngine::SIPRegister, &RAND, IMSI.c_str(), SRESstr.c_str());
}
catch(SIPTimeout) {
SGSNLOG("SIP authentication timed out. Is the proxy running at " << gConfig.getStr("SIP.Proxy.Registration"));
// TODO: Reject
return;
}
if (!success) return;
LOG(INFO) << "Looking up Kc for imsi " << IMSI;
string Kcs = gTMSITable.getKc(IMSI.c_str());
if (Kcs.length() <= 1) {
SGSNERROR("No Kc found for MS in TMSI table during Attach procedure"<<si);
// need to do authentication, send authentication request
//sendAuthenticationRequest(si);
}
SgsnAdapter::startIntegrityProtection(si->mMsHandle,Kcs);
}
#endif
}
static void handleIdentityResponse(SgsnInfo *si, L3GmmMsgIdentityResponse &irmsg)
{
if (! si->mT3310FinishAttach.active()) {
// Well that is interesting. We got a spurious identity response.
SGSNERROR("unexpected message:"<<irmsg.str());
return;
} else {
// The MS sent an attach request. Try to send the response using the new IMSI.
if (! irmsg.mMobileId.isImsi()) {
SGSNERROR("Identity Response message does not include imsi:"<<irmsg.str());
return;
}
ByteVector passbyreftmp = irmsg.mMobileId.getImsi(); // c++ foo bar
findGmmByImsi(passbyreftmp,si); // Always succeeds - creates if necessary, sets si->mGmmp.
// Use the imsi as the mobileId in the AttachAccept.
//si->mAttachMobileId = irmsg.mMobileId;
handleAttachStep(si);
//si->mT3310FinishAttach.reset();
//GmmInfo *gmm = findGmmByImsi(passbyreftmp,si); // Always succeeds - creates if necessary.
// TODO: Why do we send the mobileid? It seems to Work this way, just wondering, because
// the message is delivered to the MS based on the L2 connection as defined by si.
//L3GmmMsgAttachAccept aa(si->attachResult(),gmm->getPTmsi(),irmsg.mMobileId);
//si->sgsnWriteHighSideMsg(aa);
}
}
void AttachInfo::stashMsgInfo(GMMAttach &msgIEs,
bool isAttach) // true: attach request; false: RAUpdate
{
// Save the MCC and MNC from which the MS drifted in on for reporting.
// We only save them the first time we see them, because I am afraid
// after that they will revert to our own MCC and MNC.
if (! mPrevRaId.valid()) { mPrevRaId = msgIEs.mOldRaId; }
//if (mOldMcc[0] == 0 && mOldMcc[1] == 0) {
// for (int i = 0; i < 3; i++) { mOldMcc[i] = DEHEXIFY(msgIEs.mOldRaId.mMCC[i]); }
//}
//if (mOldMnc[0] == 0 && mOldMnc[1] == 0) {
// for (int i = 0; i < 3; i++) { mOldMnc[i] = DEHEXIFY(msgIEs.mOldRaId.mMNC[i]); }
//}
// If a PTMSI was specified in the AttachRequest we need to remember it.
if (isAttach && msgIEs.mMobileId.isTmsi()) {
mAttachReqPTmsi = msgIEs.mMobileId.getTmsi();
}
if (msgIEs.mMsRadioAccessCapability.size()) {
mMsRadioAccessCap = msgIEs.mMsRadioAccessCapability;
}
//mAttachMobileId = msgIEs.mMobileId;
}
void AttachInfo::copyFrom(AttachInfo &other)
{
if (! mPrevRaId.valid()) { mPrevRaId = other.mPrevRaId; }
if (! mAttachReqPTmsi) { mAttachReqPTmsi = other.mAttachReqPTmsi; }
if (! mAttachReqType) { mAttachReqType = other.mAttachReqType; }
if (other.mMsRadioAccessCap.size()) {
mMsRadioAccessCap = other.mMsRadioAccessCap;
}
}
void sendImplicitlyDetached(SgsnInfo *si)
{
L3GmmMsgGmmStatus statusMsg(GmmCause::Implicitly_detached);
si->sgsnWriteHighSideMsg(statusMsg);
// The above didn't do it, so try sending one of these too:
// Detach type 1 means re-attach required.
//L3GmmMsgDetachRequest dtr(1,GmmCause::Implicitly_detached);
// 7-2012: Tried taking out the cause to stop the Multitech modem
// sending 'invalid mandatory information'.
// The only reason obvious to send that is in 24.008 8.5 is an unexpected IE,
// so maybe it is the cause. But it did not help.
L3GmmMsgDetachRequest dtr(1,0);
si->sgsnWriteHighSideMsg(dtr);
}
// The ms may send a P-TMSI or IMSI in the mobile id.
static void handleAttachRequest(SgsnInfo *si, L3GmmMsgAttachRequest &armsg)
{
switch ((AttachType) (unsigned) armsg.mAttachType) {
case AttachTypeGprsWhileImsiAttached:
SGSNLOG("NOTICE attach type "<<(int)armsg.mAttachType <<si);
// Fall through
case AttachTypeGprs:
si->mtAttachInfo.mAttachReqType = AttachTypeGprs;
break;
case AttachTypeCombined:
if (getNMO() != 1) {
// The MS should not have done this.
LOG(ERR)<<"Combined Attach attempt incompatible with NMO 1 "<<si;
} else {
SGSNLOG("NOTICE attach type "<<(int)armsg.mAttachType <<si);
}
si->mtAttachInfo.mAttachReqType = AttachTypeCombined;
break;
}
//uint32_t newptmsi;
// Save info from the message:
si->mtAttachInfo.stashMsgInfo(armsg,true);
// Re-init the state machine.
// If the MS does a re-attach, we may have an existing SgsnInfo from earlier, so we must reset it now:
// si->sgsnReset(); // 6-3-2012: changed to just freePdpAll.
si->freePdpAll(true);
GmmInfo *gmm = si->getGmm();
// 7-1-2012: Working on multitech modem failure to reattach bug.
// I tried taking this out to send an extra identity request,
// but then the modem did not respond to that identity request,
// just like before it did not respond to the second attach request.
// Even after deleting all but that single SgsnInfo, and modifying the msid
// to print both tllis, and looking at pat.log the message is definitely
// sent on the correct TLLi.
// But if you tell the modem to detach and then try attach again,
// then the modem uses a new TLLI and sends an IMSI, so it thinks
// it was attached, but it is sending an attach request anyway, with a PTMSI.
// But the first attach used a PTMSI, and it succeeded.
// Things to try: send protocol incompabible blah blah.
// Try converting to local tlli (0xc...); I tried that before but maybe
// the tlli change procedure was wrong back then.
// Send a detach, although I think the modem ignores this.
if (gmm) {
// We already have an IMSI for this MS, where the MS was identified by some TLLI
// associated with this SgsnInfo, which means we already did
// the IdentityResponse challenge. Just use it.
} else {
// We need an imsi. If it is not in the message, we will need to ask for it.
ByteVector imsi;
// There is a slight problem that we only have 6 seconds to register the MS,
// which may not be enough time to do the IdentityResponse Challenge.
// Therefore we save the IMSI associated with the TLLI that we got from the Identity response
// challenge in the SgsnInfo, and when the MS tries again with the same TLLI,
// we can skip the IdentityRequest phase.
//if (si->mImsi.size()) {
// // Already did the identity challange; use the previously queried imsi from this ms.
// imsi = si->mImsi;
//} else {
// If the MS did not send us an IMSI already, ask for one.
if (armsg.mMobileId.isImsi()) {
// The MS included the IMSI in the attach request
imsi = armsg.mMobileId.getImsi();
findGmmByImsi(imsi,si); // Create the gmm and associate with si.
} else {
// 3GPP 24.008 11.2.2 When T3370 expires we can send another Identity Request.
// However we are also going to use it inverted, and send Identity Requests
// no closer together than T3370.
// If this expires, the MS will try again.
if (! si->mT3370ImsiRequest.active() || si->mT3370ImsiRequest.expired()) {
// Send off a request for the imsi.
L3GmmMsgIdentityRequest irmsg;
si->mT3370ImsiRequest.set();
// We only use the timer in this case, so we only set it in this case, instead
// of at the top of this function.
si->mT3310FinishAttach.set();
si->sgsnWriteHighSideMsg(irmsg);
}
return;
}
//}
//SgsnInfo *si2 = Sgsn::findAssignedSgsnInfoByImsi(imsi);
//newptmsi = si2->mMsHandle;
}
#if 0
// We dont care if the MS already had a P-TMSI.
// If it is doing an attach, go ahead and assign a new one.
if (!si->mAllocatedTmsiTlli) {
si->mAllocatedTmsiTlli = Sgsn::allocateTlli();
}
// We cant set the tlli in the MS until it has received the new tlli,
// because we have to use the previous tlli to talk to it.
#endif
// This was for testing:
//L3GmmMsgIdentityRequest irmsg;
//si->sgsnWriteHighSideMsg(irmsg);
// We are assigning this ptmsi to the MS.
handleAttachStep(si);
//si->mT3310FinishAttach.reset();
//L3GmmMsgAttachAccept aa(si->attachResult(),gmm->getPTmsi(),armsg.mMobileId);
//si->sgsnWriteHighSideMsg(aa);
}
static void handleAttachComplete(SgsnInfo *si, L3GmmMsgAttachComplete &acmsg)
{
// The ms is acknowledging receipt of the new tlli.
GmmInfo *gmm = si->getGmm();
if (! gmm) {
// The attach complete does not match this ms state.
// Happens, for example, when you first turn on the bts and the ms
// is still trying to complete a previous attach. Ignore it.
// The MS will timeout and try to attach again.
SGSNLOG("Ignoring spurious Attach Complete" << si);
// Dont send a reject because we did not reject anything.
return;
}
//SGSNLOG("attach complete gmm="<<((uint32_t)gmm));
gmm->setGmmState(GmmState::GmmRegisteredNormal);
gmm->setAttachTime();
#if RN_UMTS
#else
// Start using the tlli associated with this imsi/ptmsi when we talk to the ms.
si->changeTlli(true);
#endif
addShellRequest("GprsAttach",gmm);
#if 0 // nope, we are going to pass the TLLI down with each message and let GPRS deal with it.
//if (! Sgsn::isUmts()) {
// // Update the TLLI in all the known MS structures.
// // Only the SGSN knows that the MSInfo with these various TLLIs
// // are in fact the same MS. But GPRS needs to know because
// // the MS will continue to use the old TLLIs, and it will botch
// // up if, for example, it is in the middle of a procedure on one TLLI
// // and the MS is using another TLLI, which is easy to happen given the
// // extremely long lag times in message flight.
// // The BSSG spec assumes there only two TLLIs, but I have seen
// // the Blackberry use three simultaneously.
// SgsnInfo *sip;
// uint32_t newTlli = gmm->getTlli();
// RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,sip) {
// if (sip->getGmm == gmm) {
// UEAdapter *ms = sip->getMS();
// // or should we set the ptmsi??
// if (ms) ms->changeTlli(newTlli);
// }
// }
//}
#endif
}
static void handleDetachRequest(SgsnInfo *si)
{
L3GmmMsgDetachAccept detachAccept(0);
GmmInfo *gmm = si->getGmm();
if (!gmm) {
// Hmm, but fall through, because it is certainly detached.
} else {
gmm->setGmmState(GmmState::GmmDeregistered);
}
si->sgsnWriteHighSideMsg(detachAccept);
si->sgsnReset();
if (gmm) addShellRequest("GprsDetach",gmm);
}
static void sendRAUpdateReject(SgsnInfo *si,unsigned cause)
{
L3GmmMsgRAUpdateReject raur(cause);
si->sgsnWriteHighSideMsg(raur);
}
// TODO: Need to follow 4.7.13 of 24.008
static void handleServiceRequest(SgsnInfo *si, L3GmmMsgServiceRequest &srmsg)
{
GmmInfo *gmm = si->getGmm();
// TODO: Should we check the PTmsi and the PDP context status???
if (!gmm) {
L3GmmMsgServiceReject sr(GmmCause::Implicitly_detached);
si->sgsnWriteHighSideMsg(sr);
return;
} else {
gmm->setActivity();
L3GmmMsgServiceAccept sa(si->getPdpContextStatus());
si->sgsnWriteHighSideMsg(sa);
}
}
// 24.008 4.7.5, and I quote:
// "The routing area updating procedure is always initiated by the MS.
// It is only invoked in state GMM-REGISTERED."
// The MS may send an mMobileId containing a P-TMSI, and it sends TmsiStatus
// telling if it has a valid TMSI.
static void handleRAUpdateRequest(SgsnInfo *si, L3GmmMsgRAUpdateRequest &raumsg)
{
bool sendTmsi = 0;
RAUpdateType updatetype = (RAUpdateType) (unsigned)raumsg.mUpdateType;
switch (updatetype) {
case RAUpdated:
case PeriodicUpdating:
updatetype = RAUpdated;
if (getNMO() == 1) {
updatetype = CombinedRALAUpdated;
}
break;
case CombinedRALAUpdated:
case CombinedRALAWithImsiAttach: // As of 4-29-2012, we dont even save the imsi.
if (getNMO() != 1) {
// TODO: Should we send a reject, or an accept with a different updatetype?
// I think the type should have matched the NMO broadcast in the beacon,
// so we should reject.
// Warning: This reject is saved in the MS semi-permanently,
// and it will not try again.
// DEBUG: Try just accepting the LAUpdate unconditionally...
//sendRAUpdateReject(si,GmmCause::Location_Area_not_allowed);
//return;
LOG(ERR)<<"Routing Area combined Location Area Update request incompatible with NMO 1 "<<si;
}
updatetype = CombinedRALAUpdated;
if (! raumsg.mTmsiStatus) {
// We must assign a tmsi, so make one up.
// Just use the tlli, but lop off some bits so we can tell what it is.
sendTmsi = true;
}
break;
}
si->mtAttachInfo.stashMsgInfo(raumsg,false);
GmmInfo *gmm = si->getGmm();
if (! gmm) {
// The MS has not registered with us yet, so reject the RAUpdate.
// Doesnt seem like this should be always needed, because we want to accept anyone.
// But this seems to work, and it didnt work when I didnt do this.
// This makes the MS come back with an AttachRequest message.
// I have seen the Blackberry trying RAUpdate with the same foreign TLLI about 10 times,
// and getting rejects before coming back with the AttachRequest, but it eventually did.
// TODO: Maybe use a different cause for foreign TLLI.
// And I quote, from 24.008 Annex G.6:
// "Cause value = 9 MS identity cannot be derived by the network
// "This cause is sent to the MS when the network cannot derive the MS's identity from
// "the P-TMSI in case of inter-SGSN routing area update.
// "Cause value = 10 Implicitly detached
// "This cause is sent to the MS either if the network has implicitly detached the MS,
// "e.g. some while after the Mobile reachable timer has expired,
// "or if the GMM context data related to the subscription dose not exist in the
// "SGSN e.g. because of a SGSN restart.
// Also, see 4.7.1.5.4 which gives the specific behavior the MS to each of these causes.
// Specifically, cause 10 is the correct one to make the MS reregister and get new contexts.
// I did not try just assigning a new TMSI in the RAUpdateAccept message.
// Also have not tried just echoing back the TLLI that the MS used in L2 as
// the allocated-TMSI in this response, which might work,
// but is not procedurally correct if the TMSI came from a different routing area.
if (raumsg.mPdpContextStatus.anyDefined()) {
// If the MS thinks it has PDP contexts, we need to explicitly release them.
// TODO: We do that in the raaccept message...
// Let MS establish a session, then turn BTS off and on; the MS continues to
// use the old IP addresses with its new pdp contexts.
// Not exactly sure why, maybe my bug somewhere.
// 4-30: I tried putting this back in but it did not work -
// The blackberry continued to send RAUpdateRequest that indicated it
// did not tear them down.
// 24.008 4.7.5.1.3 Indicates all you have to do is send an RaUpdateAccept
// with the pdpstatus zeroed out.
//sendSmStatus(si,SmCause::Unknown_PDP_address_or_PDP_type);
//sendPdpDeactivateAll(si, SmCause::Unknown_PDP_address_or_PDP_type);
}
// 4.7.5.1.4 says that 'cause 9' shall make the MS delete its P-TMSI,
// enter state GMM-DEREGISTERED, and subsequently automatically initiate GPRS attach.
// However, it didnt work for me on the blackberry after a test that ended in TBF failure.
// Had to turn off the MS and turn it back on, then ok.
// Maybe it had entered state LIMITED.SERVICE,
// which prevents attaches, or maybe NO.CELL.AVAILABLE.
// It was trying to register with the mobile-id set to no value.
// Cause 10 looks like it might be better: MS releases PDP contexts,
// enters GMM-DEREGISTERED.NORMAL, and forces a new attach.
sendRAUpdateReject(si,GmmCause::Implicitly_detached);
return;
} else {
gmm->setActivity();
/** wrong
if (si->getState() != GmmState::GmmDeregistered) {
//sendRAUpdateReject(si,GmmCause::MessageNotCompatibleWithProtocolState);
// This is the cause that the opensgsn sends:
sendRAUpdateReject(si,GmmCause::MS_identity_cannot_be_derived_by_the_network);
return;
}
***/
// The RAUpdate result is yes only if the MS has attached to us.
// Note that this message gets back to the originating MS guaranteed at layer2,
// regardless of whatever tmsi/mobile-id we put in this message.
// TODO: Do we need to set the allocated P-TMSI or not? Not sure.
// The blackberry did not work without it, but it may have been sql open-registration was wrong.
// DONT DO THIS:
//if (gConfig.defines("SGSN.RAUpdateIncludeTmsi") && gConfig.getNum("SGSN.RAUpdateIncludeTmsi")) {
// tmsi = si->mTlli;
//}
//if (updatetype == CombinedRALAUpdated) {
// DEBUG: try this
// Send an authentication request to make the MS happy about this.
//sendAuthenticationRequest(si);
//}
// We are not integrated with the OpenBTS stack yet,
// so if we need a tmsi just make one up.
uint32_t ptmsi = gmm->getPTmsi();
L3GmmMsgRAUpdateAccept raa(updatetype, si->getPdpContextStatus(),ptmsi,
sendTmsi ? ptmsi : 0);
si->sgsnWriteHighSideMsg(raa);
}
}
static void handleRAUpdateComplete(SgsnInfo *si, L3GmmMsgRAUpdateComplete &racmsg)
{
// Do not need to do anything.
}
// This message may arrive on a DCCH channel via the GSM RR stack, rather than a GPRS message,
// and as such, could be running in a separate thread.
// We queue the message for processing.
// The suspension may be user initiated or by the MS doing some RR messages,
// most often, Location Area Update. The spec says we are supposed to freeze
// the LLC state and continue after resume. But in the permanent case any incoming packets
// will be hopelessly stale after resumption, so we just toss them. Note that web sites chatter
// incessantly with keepalives even when they look quiescent to the user, and we dont want
// all that crap to back up in the downlink queue.
// In the temporary case, which is only a second or two, we will attempt to preserve the packets
// to prevent a temporary loss of service. I have observed that the MS first stops responding
// to the BSS for about a second before sending the RACH to initiate the RR procedure,
// so there is no warning at all. However, we MUST cancel the TBFs. If we dont, and after
// finishing the RR procedure the MS gets back to GPRS before the previous TBFs timeout,
// it assumes they are new TBFs, which creates havoc, because the acknacks do not correspond
// to the previous TBF. This generates the "STUCK" condition, up to a 10 second loss of service,
// and I even saw the Blackberry detach and reattach to recover.
// In either case the MS signals resumption by sending us anything on the uplink.
// WARNING: This runs in a different thread.
bool Sgsn::handleGprsSuspensionRequest(uint32_t wTlli,
const ByteVector &wraid) // The Routing Area id.
{
SGSNLOG("Received GPRS SuspensionRequest for"<<LOGHEX2("tlli",wTlli));
return false; // Not handled yet.
// TODO:
// if sgsn not enabled, return false.
// save the channel?
// Send the resumption ie in the RR channel release afterward.
}
// WARNING: This runs in a different thread.
void Sgsn::notifyGsmActivity(const char *imsi)
{
}
static void handleL3GmmMsg(SgsnInfo *si,ByteVector &frame1)
{
L3GmmFrame frame(frame1);
// Standard L3 header is 2 bytes:
unsigned mt = frame.getMsgType(); // message type
//SGSNLOG("CRACKING GMM MSG TYPE "<<mt);
MSUEAdapter *ms = si->getMS();
if (ms == NULL) {
// This is a serious internal error.
SGSNERROR("L3 message "<<L3GmmMsg::name(mt)
<<" for non-existent MS Info struct" <<LOGHEX2("tlli",si->mMsHandle));
return;
}
switch (mt) {
case L3GmmMsg::AttachRequest: {
L3GmmMsgAttachRequest armsg;
armsg.gmmParse(frame);
SGSNLOG("Received "<<armsg.str()<<si);
handleAttachRequest(si,armsg);
dumpGmmInfo();
break;
}
case L3GmmMsg::AttachComplete: {
L3GmmMsgAttachComplete acmsg;
//acmsg.gmmParse(frame); // not needed, nothing in it.
SGSNLOG("Received "<<acmsg.str()<<si);
handleAttachComplete(si,acmsg);
dumpGmmInfo();
break;
}
case L3GmmMsg::IdentityResponse: {
L3GmmMsgIdentityResponse irmsg;
irmsg.gmmParse(frame);
SGSNLOG("Received "<<irmsg.str()<<si);
handleIdentityResponse(si,irmsg);
break;
}
case L3GmmMsg::DetachRequest: {
SGSNLOG("Received DetachRequest");
handleDetachRequest(si);
break;
}
case L3GmmMsg::DetachAccept:
SGSNLOG("Received DetachAccept");
//TODO...
break;
case L3GmmMsg::RoutingAreaUpdateRequest: {
L3GmmMsgRAUpdateRequest raumsg;
raumsg.gmmParse(frame);
SGSNLOG("Received "<<raumsg.str()<<si);
handleRAUpdateRequest(si,raumsg);
break;
}
case L3GmmMsg::RoutingAreaUpdateComplete: {
L3GmmMsgRAUpdateComplete racmsg;
//racmsg.gmmParse(frame); not needed
SGSNLOG("Received RAUpdateComplete "<<si);
handleRAUpdateComplete(si,racmsg);
break;
}
case L3GmmMsg::GMMStatus: {
L3GmmMsgGmmStatus stmsg;
stmsg.gmmParse(frame);
SGSNLOG("Received GMMStatus: "<<stmsg.mCause<<"=" <<GmmCause::name(stmsg.mCause)<<si);
break;
}
case L3GmmMsg::AuthenticationAndCipheringResp: {
L3GmmMsgAuthenticationResponse armsg;
armsg.gmmParse(frame);
SGSNLOG("Received AuthenticationAndCipheringResp message "<<si);
handleAuthenticationResponse(si,armsg);
break;
}
case L3GmmMsg::ServiceRequest: {
L3GmmMsgServiceRequest srmsg;
srmsg.gmmParse(frame);
SGSNLOG("Received ServiceRequest message" << si);
handleServiceRequest(si,srmsg);
break;
}
// Downlink direction messages:
//RoutingAreaUpdateAccept = 0x09,
//AttachAccept = 0x02,
//AttachReject = 0x04,
//RoutingAreaUpdateReject = 0x0b,
// Other: TODO?
//ServiceAccept = 0x0d,
//ServiceReject = 0x0e,
//PTMSIReallocationCommand = 0x10,
//PTMSIReallocationComplete = 0x11,
//AuthenticationAndCipheringRej = 0x14,
//AuthenticationAndCipheringFailure = 0x1c,
//GMMInformation = 0x21,
default:
//SGSNWARN("Ignoring GPRS GMM message type "<<mt <<L3GmmMsg::name(mt));
return;
}
}
// This is the old UMTS-centric entry point
//void Sgsn::sgsnWriteLowSide(ByteVector &payload,SgsnInfo *si, unsigned rbid)
//{
// // No Pdcp, so just send it off.
// si->sgsnSend2PdpLowSide(rbid, payload);
//}
// The handle is the URNTI and the rbid specfies the rab.
// In gprs, the handle is the TLLI and all the rab info is encoded into the
// payload with LLC headers so rbid is not used, which was a pretty dopey design.
void MSUEAdapter::sgsnWriteLowSide(ByteVector &payload, uint32_t handle, unsigned rbid)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(handle,true); // Create if necessary.
#if RN_UMTS
// No Pdcp, so just send it off.
si->sgsnSend2PdpLowSide(rbid, payload);
#else
si->mLlcEngine->llcWriteLowSide(payload,si);
#endif
}
#if RN_UMTS
void MSUEAdapter::sgsnHandleL3Msg(uint32_t handle, ByteVector &msgFrame)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(handle,true); // Create if necessary.
handleL3Msg(si,msgFrame);
}
#endif
void handleL3Msg(SgsnInfo *si, ByteVector &bv)
{
unsigned pd = 0;
try {
L3GprsFrame frame(bv);
if (frame.size() == 0) { // David saw this happen.
//SGSNWARN("completely empty L3 uplink message "<<si);
return;
}
pd = frame.getNibble(0,0); // protocol descriminator
switch ((GSM::L3PD) pd) {
case GSM::L3GPRSMobilityManagementPD: { // Couldnt we shorten this?
handleL3GmmMsg(si,frame);
break;
}
case GSM::L3GPRSSessionManagementPD: { // Couldnt we shorten this?
Ggsn::handleL3SmMsg(si,frame);
break;
}
// TODO: Send GSM messages somewhere
default:
SGSNERROR("unsupported L3 Message PD:"<<pd);
}
} catch(SgsnError) {
return; // Handled already
} catch(ByteVectorError) { // oops!
SGSNERROR("internal error assembling SGSN message, pd="<<pd); // not much to go on.
}
}
// Forces the SgsnInfo to exist.
// For GPRS the handle is a TLLI.
// From GSM03.03 sec 2.6 Structure of TLLI; and reproduced at class MSInfo comments.
// The top bits of the TLLI encode where it came from.
// A local TLLI has top 2 bits 11, and low 30 bits are the P-TMSI.
// For UMTS, the handle is the invariant URNTI.
SgsnInfo *findSgsnInfoByHandle(uint32_t handle, bool create)
{
// Update: the lock is needed because the suspension request is sent by the GSM RR stack
// running in a separate thread.
ScopedLock lock(sSgsnListMutex); // I dont think this is necessary, but be safe.
SgsnInfo *si, *result = NULL;
// We can delete unused SgsnInfo as soon as the attach procedure is over,
// which is 15s, but let them hang around a bit longer so the user can see them.
int idletime = gConfig.getNum("SGSN.Timer.MS.Idle");
time_t now; time(&now);
RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,si) {
if (si->mMsHandle == handle) {result=si; continue;}
#if RN_UMTS
#else
#if NEW_TLLI_ASSIGN_PROCEDURE
if (si->mAltTlli == handle) {result=si;continue;}
#endif
#endif
// Kill off old ones, except ones that are the primary one for a gmm.
GmmInfo *gmm = si->getGmm();
if (gmm==NULL || gmm->getSI() != si) {
if (now - si->mLastUseTime > idletime) { si->sirm(); }
}
}
if (result) {
time(&result->mLastUseTime);
return result;
}
if (!create) { return NULL; }
// Make a new one.
SgsnInfo *sinew = new SgsnInfo(handle);
return sinew;
}
// Now we create the SgsnInfo for the assigned ptmsi as soon as the ptmsi is created,
// even if the MS has not used it yet.
//GmmInfo *SgsnInfo::findGmm()
//{
// if (mGmmp) { return mGmmp; } // Hooked up previously.
// return NULL;
// Old comment:
// For GPRS, the MS contacts with some random tlli, then we create a GmmInfo and a PTMSI,
// and send the PTMSI to the MS, but the GmmInfo is not yet hooked to any SgsnInfos.
// The MS will then call us again using a TLLI derived from the PTMSI,
// and we hook up that SgsnInfo to the GmmInfo right here.
// if (! Sgsn::isUmts()) {
// uint32_t tlli = mMsHandle;
// // Only a local TLLI can be converted to a P-TMSI to look up the Gmm context.
// if (Tlli::tlli2Type(tlli) == Tlli::LocalTlli) {
// uint32_t ptmsi = Tlli::tlli2ptmsi(tlli);
// GmmInfo *gmm;
// RN_FOR_ALL(GmmInfoList_t,sGmmInfoList,gmm) {
// if (gmm->mPTmsi == ptmsi) {
// SGSNLOG("Hooking up"<<LOGHEX2("tlli",tlli)<<" to"<<LOGHEX2("ptmsi",ptmsi));
// this->setGmm(gmm);
// gmm->msi = this;
// return gmm;
// }
// }
// }
// } else {
// // In UMTS the Gmm context is indexed by URNTI.
// // If this doesnt work right, we will need to look up the Gmm context
// // from the ptmsi in the L3 messages.
// }
// return NULL;
//}
// Works, but not currently used:
void MSUEAdapter::sgsnFreePdpAll(uint32_t mshandle)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(mshandle,false);
if (si) si->freePdpAll(true);
}
// Forces it to exist if it did not already.
static SgsnInfo *sgsnGetSgsnInfoByHandle(uint32_t mshandle, bool create)
{
// We cant cache this thing for GPRS because it changes
// during the TLLI assignment procedure.
// We could cache it for UMTS, but that assumes the lifetime of the SgsnInfo
// is greater than the UE, both of which are controlled by user parameters,
// so to be safe, we are just going to look it up every time.
// TODO: go back to caching it in UMTS only.
//if (! mSgsnInfo) {
//uint32_t mshandle = msGetHandle();
//mSgsnInfo = findSgsnInfoByHandle(mshandle,create);
//}
//return mSgsnInfo;
return findSgsnInfoByHandle(mshandle,create);
}
#if RN_UMTS
SgsnInfo *MSUEAdapter::sgsnGetSgsnInfo()
{
uint32_t mshandle = msGetHandle();
return findSgsnInfoByHandle(mshandle,false);
}
#else
void MSUEAdapter::sgsnSendKeepAlive()
{
// TODO
}
#endif
#if RN_UMTS
// not applicable
#else
static void parseCaps(GmmInfo *gmm)
{
if (/*gmm->mGprsMultislotClass == -1 &&*/ gmm->mgAttachInfo.mMsRadioAccessCap.size()) {
MsRaCapability caps(gmm->mgAttachInfo.mMsRadioAccessCap);
gmm->mGprsMultislotClass = caps.mCList[0].getCap(AccessCapabilities::GPRSMultislotClass);
gmm->mGprsGeranFeaturePackI = caps.mCList[0].getCap(AccessCapabilities::GERANFeaturePackage1);
}
}
int MSUEAdapter::sgsnGetMultislotClass(uint32_t mshandle)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(mshandle,false);
if (!si) { return -1; }
GmmInfo *gmm = si->getGmm(); // Must be non-null or we would not be here.
if (!gmm) { return -1; } // But dont crash if I'm mistaken.
parseCaps(gmm);
return gmm->mGprsMultislotClass;
}
bool MSUEAdapter::sgsnGetGeranFeaturePackI(uint32_t mshandle)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(mshandle,false);
if (!si) { return -1; }
GmmInfo *gmm = si->getGmm(); // Must be non-null or we would not be here.
if (!gmm) { return -1; } // But dont crash if I'm mistaken.
parseCaps(gmm);
return gmm->mGprsGeranFeaturePackI;
}
#endif
// If the MS is registered return the IMSI, otherwise return an empty string.
string MSUEAdapter::sgsnFindImsiByHandle(uint32_t handle)
{
ScopedLock lock(sSgsnListMutex); // Will be locked again recursively in findSgsnInfoByHandle.
if (SgsnInfo *si = findSgsnInfoByHandle(handle,false)) {
GmmInfo *gmm = si->getGmm();
if (gmm) return gmm->mImsi.hexstr();
}
return string("");
}
GmmState::state MSUEAdapter::sgsnGetRegistrationState(uint32_t mshandle)
{
SgsnInfo *si = sgsnGetSgsnInfoByHandle(mshandle,false);
if (!si) { return GmmState::GmmDeregistered; }
GmmInfo *gmm = si->getGmm(); // Must be non-null or we would not be here.
if (!gmm) { return GmmState::GmmDeregistered; }
return gmm->getGmmState();
}
#if RN_UMTS
void MSUEAdapter::sgsnHandleRabSetupResponse(unsigned rabId, bool success)
{
SgsnInfo *si = sgsnGetSgsnInfo();
if (si == NULL) {
// Dont think this can happen, but be safe.
SGSNERROR("Received spurious RabSetupResponse for UE:"<<msid());
return;
}
if (success) {
PdpContext *pdp = si->getPdp(rabId);
if (pdp==NULL) return; // FIXME: Not sure what to do here
if (pdp->mUmtsStatePending) {
pdp->update(pdp->mPendingPdpr);
pdp->mUmtsStatePending = false;
}
sendPdpContextAccept(si,pdp);
} else {
// We do NOT want to send a RAB teardown message - we got here because
// the RAB setup did not work in the first place. Just free it.
si->freePdp(rabId);
}
}
#endif
const char *GmmState::GmmState2Name(GmmState::state state)
{
switch (state) {
CASENAME(GmmDeregistered)
CASENAME(GmmRegistrationPending)
CASENAME(GmmRegisteredNormal)
CASENAME(GmmRegisteredSuspsended)
}
return "";
}
// The alternate sgsnInfoPrint is used only for gmmDump and prints
void sgsnInfoDump(SgsnInfo *si,std::ostream&os)
{
//if (si == gmm->getSI()) {continue;} // Already printed the main one.
uint32_t handle = si->mMsHandle;
os << "SgsnInfo"<<LOGHEX(handle)
<<" T3370:active="<<si->mT3370ImsiRequest.active()
<<" remaining=" << si->mT3370ImsiRequest.remaining();
MSUEAdapter *ms = si->getMS();
if (ms) { os << ms->msid(); }
else { os << " MS=not_active"; }
AttachInfo *ati = &si->mtAttachInfo;
if (ati->mPrevRaId.valid()) { os << " prev:"; ati->mPrevRaId.text(os); }
if (!si->getGmm()) { os << " no gmm"; }
os << endl;
}
void gmmInfoDump(GmmInfo *gmm,std::ostream&os,int options)
{
os << " GMM Context:";
os << LOGVAR2("imsi",gmm->mImsi.hexstr());
os << LOGHEX2("ptmsi",gmm->mPTmsi);
os << LOGHEX2("tlli",gmm->getTlli());
os << LOGVAR2("state",GmmState::GmmState2Name(gmm->getGmmState()));
time_t now; time(&now);
os << LOGVAR2("age",(gmm->mAttachTime ? now - gmm->mAttachTime : 0));
os << LOGVAR2("idle",now - gmm->mActivityTime);
SgsnInfo *si = gmm->getSI();
if (!(options & printNoMsId)) {
if (si) { // Can this be null? No, but dont crash.
// The mPrevRaId is generally invalid in the SgsnInfo for the GMM,
// because it is the one we assigned, and the routing info is in the SgsnInfo
// the MS initially called in on.
//os << LOGVAR2("oldMCC",si->mOldMcc);
//os << LOGVAR2("oldMNC",si->mOldMnc);
// The GPRS ms struct will disappear shortly after the MS stops communicating with us.
MSUEAdapter *ms = si->getMS();
if (ms) { os << ms->msid(); }
else { os << " MS=not_active"; }
}
}
os << " IPs=";
int pdpcnt = 0;
for (unsigned nsapi = 0; nsapi < GmmInfo::sNumPdps; nsapi++) {
if (gmm->isNSapiActive(nsapi)) {
// FIXME: Darn it, we need to lock the pdp contexts for this too.
// Go ahead and do it anyway, because collision is very low probability.
PdpContext *pdp = gmm->getPdp(nsapi);
mg_con_t *mgp; // Temp variable reduces probability of race; the mgp itself is immortal.
if (pdp && (mgp=pdp->mgp)) {
char buf[30];
if (pdpcnt) {os <<",";}
os << ip_ntoa(mgp->mg_ip,buf);
}
pdpcnt++;
}
}
if (pdpcnt == 0) { os <<"none"; }
os << endl;
if (options & printDebug) {
// Print out all the SgsnInfos associated with this GmmInfo.
RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,si) {
if (si->getGmm() != gmm) {continue;}
os <<"\t"; // this sgsn is associated with the GmmInfo just above it.
sgsnInfoDump(si,os);
}
}
// Now the caps:
if ((options & printCaps) && gmm->mgAttachInfo.mMsRadioAccessCap.size()) {
MsRaCapability caps(gmm->mgAttachInfo.mMsRadioAccessCap);
caps.text2(os,true);
}
//os << endl; // This is extra. There is one at the end of the caps.
}
void gmmDump(std::ostream &os)
{
// The sSgsnListMutex exists for this moment: to allow this cli list routine
// to run from a foreign thread.
ScopedLock lock(sSgsnListMutex);
int debug = sgsnDebug();
GmmInfo *gmm;
RN_FOR_ALL(GmmInfoList_t,sGmmInfoList,gmm) {
gmmInfoDump(gmm,os,debug ? printDebug : 0);
os << endl; // This is extra. There is one at the end of the caps.
}
// Finally, print out SgsnInfo that are not yet associated with a GmmInfo.
if (debug) {
SgsnInfo *si;
RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,si) {
if (! si->getGmm()) { sgsnInfoDump(si,os); }
}
}
}
void dumpGmmInfo()
{
if (sgsnDebug()) {
std::ostringstream ss;
gmmDump(ss);
SGSNLOG(ss.str());
}
}
void SgsnInfo::setGmm(GmmInfo *gmm)
{
// Copy pertinent info from the Routing Update or Attach Request message into the GmmInfo.
gmm->mgAttachInfo.copyFrom(mtAttachInfo);
this->mGmmp = gmm;
}
#if NEW_TLLI_ASSIGN_PROCEDURE
static void killOtherTlli(SgsnInfo *si,uint32_t newTlli)
{
SgsnInfo *othersi = findSgsnInfoByHandle(newTlli,false);
if (othersi && othersi != si) {
if (othersi->getGmm()) {
// This 'impossible' situation can happen if an MS that
// is already attached tries to attach again.
// Easy to reproduce by pulling the power on an MS. (Turning off may not be enough.)
// For example:
// MS -> attachrequest TLLI=80000001; creates new SgsnInfo 80000001
// MS <- attachaccept
// MS -> attachcomplete TLLI=c0000001; SgsnInfo 80000001 changed to c0000001
// MS gets confused (turn off or pull battery)
// MS -> attachrequest TLLI=80000001; creates new SgsnInfo 80000001
// MS <- attachaccept TLLI=80000001; <--- PROBLEM 1! See below.
// MS -> attachcomplete TLLI=c0000001; <--- PROBLEM 2: Both SgsnInfo exist.
// PROBLEM 1: We have already issued the TLLI change command so L2
// is now using the new TLLI. We will use the old TLLI (80000001)
// in the attachaccept, which will cause a 'change tlli' procedure in L2
// to switch back to TLLI 80000001 temporarily.
// PROBLEM 2: Solved by deleting the original registered SgsnInfo (c0000001 above)
// and then caller will change the TLLI of the unregistred one (80000001 above.)
SGSNWARN("Probable repeat attach request: TLLI change procedure"<<LOGVAR(newTlli)
<<" for SgsnInfo:"<<si
<<" found existing registered SgsnInfo:"<<othersi);
// I dont think any recovery is possible; sgsn is screwed up.
} else {
// We dont know or care where this old SgsnInfo came from.
// Destroy it with prejudice and use si, which is the
// SgsnInfo the MS is using to talk with us right now.
SGSNWARN("TLLI change procedure"<<LOGVAR(newTlli)
<<" for SgsnInfo:"<<si
<<" overwriting existing unregistered SgsnInfo:"<<othersi);
othersi->sirm();
}
}
}
#endif
// Switch to the new tlli. If now, do it now, otherwise, just allocate the new SgsnInfo,
#if NEW_TLLI_ASSIGN_PROCEDURE
// just set altTlli to the future TLLI we will be using after the attach procedure,
#endif
// which we do ahead of time so we can inform GPRS L2 that the new and old TLLIs are the same MS.
// Return the new si. In the new tlli procedure, it is the same as the old.
// ------------------
// Note the following sequence, easy to reproduce by pulling the power on an MS:
// MS -> attachrequest TLLI=80000001; creates new SgsnInfo 80000001
// MS <- attachaccept
// MS -> attachcomplete TLLI=c0000001; SgsnInfo 80000001 changed to c0000001
// MS gets confused (turn off or pull battery)
// MS -> attachrequest TLLI=80000001; creates new SgsnInfo 80000001
// MS <- attachaccept TLLI=80000001; <--- PROBLEM 1! See below.
// MS -> attachcomplete TLLI=c0000001; <--- PROBLEM 2: Both SgsnInfo exist.
// PROBLEM 1: We have already issued the TLLI change command so L2
// is now using the new TLLI. Easy fix is we use the old TLLI (80000001)
// in the attachaccept, which will cause a 'change tlli' procedure in L2
// to switch back to TLLI 80000001 temporarily until we receive attachcomplete.
// PROBLEM 2: The SgsnInfo for the new tlli will already exist.
// ???? Solved by deleting the original registered SgsnInfo (c0000001 above)
// ???? and then caller will change the TLLI of the unregistred one (80000001 above.)
SgsnInfo * SgsnInfo::changeTlli(bool now)
{
GmmInfo *gmm = getGmm();
uint32_t newTlli = gmm->getTlli();
#if NEW_TLLI_ASSIGN_PROCEDURE
SgsnInfo *si = this;
if (si->mMsHandle != newTlli) {
killOtherTlli(si,newTlli);
if (now) {
si->mAltTlli = si->mMsHandle;
si->mMsHandle = newTlli;
} else {
si->mAltTlli = newTlli;
}
}
return si;
#else
SgsnInfo *othersi = findSgsnInfoByHandle(newTlli,true);
// We will use the new tlli for downlink l3 messages, eg, pdp context messages,
// unless they use some other SI specifically, like AttachAccept
// must be sent on the SI that the AttachRequest arrived on.
othersi->setGmm(gmm);
if (now) { gmm->msi = othersi; }
return othersi;
#endif
}
// If si, forces the GmmInfo for this imsi to exist and associates it with that si.
// If si == NULL, return NULL if gmm not found - used for CLI.
GmmInfo *findGmmByImsi(ByteVector &imsi, SgsnInfo *si)
{
ScopedLock lock(sSgsnListMutex);
GmmInfo *gmm, *result = NULL;
// 24.008 11.2.2: Implicit Detach timer default is 4 min greater
// than T3323, which can be provided in AttachAccept, otherwise
// defaults to T3312, which defaults to 54 minutes.
int attachlimit = gConfig.getNum("SGSN.Timer.ImplicitDetach"); // expiration time in seconds.
time_t now; time(&now);
RN_FOR_ALL(GmmInfoList_t,sGmmInfoList,gmm) {
if (now - gmm->mActivityTime > attachlimit) {
GmmRemove(gmm);
continue;
}
if (gmm->mImsi == imsi) { result = gmm; }
}
if (result) {
if (si) si->setGmm(result);
return result;
}
if (!si) { return NULL; }
// Not found. Make a new one in state Registration Pending.
gmm = new GmmInfo(imsi);
gmm->setGmmState(GmmState::GmmRegistrationPending);
si->setGmm(gmm);
gmm->msi = si;
#if RN_UMTS
// For UMTS, the si is indexed by URNTI, which is invariant, so hook up and we are finished.
#else
// We hook up the GMM context to the SgsnInfo corresponding to the assigned P-TMSI,
// even if that SgsnInfo does not exist yet,
// rather than the SgsnInfo corresponding to the current TLLI, which could be anything.
// The MS will use the SgsnInfo for the P-TMSI to talk to us after a successful attach.
si->changeTlli(false);
//#if NEW_TLLI_ASSIGN_PROCEDURE
// // 3GPP 04.64 7.2.1.1 and 8.3: Perform the TLLI reassignment procedure.
// // Change the TLLI in the SgsnInfo the MS is currently using.
// // The important point is that the LLC state does not change.
// uint32_t newTlli = gmm->getTlli();
// killOtherTlli(si,newTlli);
// // Do the TLLI reassignment.
// if (si->mMsHandle != newTlli) { // Any other case is extremely unlikely.
// // We must continue using the existing MsHandle until we
// // receive the AttachComplete message from the MS, but mark
// // that the new tlli is an alias for this TLLI.
// si->mAltTlli = newTlli;
// }
//#else
// SgsnInfo *newsi = findSgsnInfoByTlli(gmm->getTlli(),true);
// newsi->setGmm(gmm);
// // NO, not until attachComplete: gmm->msi = newsi; // Use this one instead.
//#endif
#endif
return gmm;
}
void RabStatus::text(std::ostream &os) const
{
os <<"RabStatus(mStatus=";
switch (mStatus) {
case RabIdle: os << "idle"; break;
case RabFailure: os << "failure"; break;
case RabPending: os << "pending"; break;
case RabAllocated: os << "allocated"; break;
case RabDeactPending: os << "deactPending"; break;
}
os<<LOGVAR2("mFailCode",SmCause::name(mFailCode));
os<<LOGVAR(mRateDownlink)<<LOGVAR(mRateUplink);
os<<")";
}
void MSUEAdapter::sgsnPrint(uint32_t mshandle, int options, std::ostream &os)
{
ScopedLock lock(sSgsnListMutex); // Probably not needed.
SgsnInfo *si = sgsnGetSgsnInfoByHandle(mshandle,false);
if (!si) { os << " GMM state unknown\n"; return; }
GmmInfo *gmm = si->getGmm(); // Must be non-null or we would not be here.
if (!gmm) { os << " GMM state unknown\n"; return; }
gmmInfoDump(gmm,os,options);
}
}; // namespace
Reference in New Issue View Git Blame Copy Permalink