ctrl: add subscriber.by-*.imsi GET-able variable

There may be a need in various OsmoCNI-attached entities (for example,
external SMSC implementations) to perform a mapping from known MSISDN
to unknown IMSI, querying OsmoHLR subscriber db for it.  Querying for
subscriber.by-msisdn-*.imsi will be much more efficient (and easier on
client-side implementors) than querying for subscriber.by-msisdn-*.info
and fishing the IMSI out of the long multiline response, discarding all
other irrelevant info.

Related: OS#6312
Change-Id: Icea1a74d0c664047f46758ab4ad75508782f3d12

include/osmocom/hlr/Makefile.am

@@ -6,6 +6,7 @@ noinst_HEADERS = \
 	gsup_router.h \
 	gsup_server.h \
 	hlr.h \
+	hlr_sms.h \
 	hlr_ussd.h \
 	hlr_vty.h \
 	hlr_vty_subscr.h \

include/osmocom/hlr/hlr.h

@@ -66,6 +66,10 @@ struct hlr {
 
 	struct llist_head ss_sessions;
 
+	struct llist_head smsc_list;
+	struct llist_head smsc_routes;
+	struct hlr_smsc *smsc_default;
+
 	bool store_imei;
 
 	bool subscr_create_on_demand;

include/osmocom/hlr/hlr_sms.h

@@ -0,0 +1,33 @@
+#pragma once
+
+#include <osmocom/core/linuxlist.h>
+
+struct hlr_smsc {
+	/* g_hlr->smsc_list */
+	struct llist_head list;
+	struct hlr *hlr;
+	/* name (must match the IPA ID tag) */
+	const char *name;
+	/* human-readable description */
+	const char *description;
+};
+
+struct hlr_smsc *smsc_find(struct hlr *hlr, const char *name);
+struct hlr_smsc *smsc_alloc(struct hlr *hlr, const char *name);
+void smsc_del(struct hlr_smsc *smsc);
+
+struct hlr_smsc_route {
+	/* g_hlr->smsc_routes */
+	struct llist_head list;
+	const char *num_addr;
+	struct hlr_smsc *smsc;
+};
+
+struct hlr_smsc_route *smsc_route_find(struct hlr *hlr, const char *num_addr);
+struct hlr_smsc_route *smsc_route_alloc(struct hlr *hlr, const char *num_addr,
+					struct hlr_smsc *smsc);
+void smsc_route_del(struct hlr_smsc_route *rt);
+
+void forward_mo_sms(struct osmo_gsup_req *req);
+void forward_mt_sms(struct osmo_gsup_req *req);
+void rx_ready_for_sm_req(struct osmo_gsup_req *req);

include/osmocom/hlr/hlr_vty.h

@@ -31,6 +31,7 @@ enum hlr_vty_node {
 	HLR_NODE = _LAST_OSMOVTY_NODE + 1,
 	GSUP_NODE,
 	EUSE_NODE,
+	SMSC_NODE,
 	MSLOOKUP_NODE,
 	MSLOOKUP_SERVER_NODE,
 	MSLOOKUP_SERVER_MSC_NODE,

src/Makefile.am

@@ -52,6 +52,7 @@ osmo_hlr_SOURCES = \
 	hlr_vty.c \
 	hlr_vty_subscr.c \
 	gsup_send.c \
+	hlr_sms.c \
 	hlr_ussd.c \
 	proxy.c \
 	dgsm.c \

src/ctrl.c

@@ -426,6 +426,20 @@ static int set_subscr_cs_enabled(struct ctrl_cmd *cmd, void *data)
 	return set_subscr_cs_ps_enabled(cmd, data, false);
 }
 
+CTRL_CMD_DEFINE_RO(subscr_imsi, "imsi");
+static int get_subscr_imsi(struct ctrl_cmd *cmd, void *data)
+{
+	struct hlr_subscriber subscr;
+	struct hlr *hlr = data;
+	const char *by_selector = cmd->node;
+
+	if (!get_subscriber(hlr->dbc, by_selector, &subscr, cmd))
+		return CTRL_CMD_ERROR;
+
+	cmd->reply = talloc_strdup(cmd, subscr.imsi);
+	return CTRL_CMD_REPLY;
+}
+
 CTRL_CMD_DEFINE(subscr_msisdn, "msisdn");
 static int verify_subscr_msisdn(struct ctrl_cmd *cmd, const char *value, void *data)
 {
@@ -761,6 +775,7 @@ static int hlr_ctrl_cmds_install(void)
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_info_all);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_ps_enabled);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_cs_enabled);
+	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_imsi);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_msisdn);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_aud2g);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_aud3g);

src/hlr.c

@@ -49,6 +49,7 @@
 #include <osmocom/hlr/rand.h>
 #include <osmocom/hlr/hlr_vty.h>
 #include <osmocom/hlr/hlr_ussd.h>
+#include <osmocom/hlr/hlr_sms.h>
 #include <osmocom/hlr/dgsm.h>
 #include <osmocom/hlr/proxy.h>
 #include <osmocom/hlr/lu_fsm.h>
@@ -422,13 +423,9 @@ static int rx_check_imei_req(struct osmo_gsup_req *req)
 			return -1;
 		}
 	} else {
-		/* Check if subscriber exists and print IMEI */
-		LOGP(DMAIN, LOGL_INFO, "IMSI='%s': has IMEI = %s (consider setting 'store-imei')\n", gsup->imsi, imei);
-		struct hlr_subscriber subscr;
-		if (db_subscr_get_by_imsi(g_hlr->dbc, gsup->imsi, &subscr) < 0) {
-			osmo_gsup_req_respond_err(req, GMM_CAUSE_INV_MAND_INFO, "IMSI unknown");
-			return -1;
-		}
+		/* ThemWi change: report IMSI-IMEI correspondence in syslog */
+		LOGP(DMAIN, LOGL_NOTICE, "IMEI REPORT: IMSI=%s has IMEI=%s\n",
+			gsup->imsi, imei);
 	}
 
 	/* Accept all IMEIs */
@@ -559,6 +556,15 @@ static int read_cb(struct osmo_gsup_conn *conn, struct msgb *msg)
 	case OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST:
 		rx_check_imei_req(req);
 		break;
+	case OSMO_GSUP_MSGT_MO_FORWARD_SM_REQUEST:
+		forward_mo_sms(req);
+		break;
+	case OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST:
+		forward_mt_sms(req);
+		break;
+	case OSMO_GSUP_MSGT_READY_FOR_SM_REQUEST:
+		rx_ready_for_sm_req(req);
+		break;
 	default:
 		LOGP(DMAIN, LOGL_DEBUG, "Unhandled GSUP message type %s\n",
 		     osmo_gsup_message_type_name(req->gsup.message_type));
@@ -753,8 +759,10 @@ int main(int argc, char **argv)
 
 	g_hlr = talloc_zero(hlr_ctx, struct hlr);
 	INIT_LLIST_HEAD(&g_hlr->euse_list);
+	INIT_LLIST_HEAD(&g_hlr->smsc_list);
 	INIT_LLIST_HEAD(&g_hlr->ss_sessions);
 	INIT_LLIST_HEAD(&g_hlr->ussd_routes);
+	INIT_LLIST_HEAD(&g_hlr->smsc_routes);
 	INIT_LLIST_HEAD(&g_hlr->mslookup.server.local_site_services);
 	g_hlr->db_file_path = talloc_strdup(g_hlr, HLR_DEFAULT_DB_FILE_PATH);
 	g_hlr->mslookup.server.mdns.domain_suffix = talloc_strdup(g_hlr, OSMO_MDNS_DOMAIN_SUFFIX_DEFAULT);

src/hlr_sms.c

@@ -0,0 +1,277 @@
+/* OsmoHLR SMS-over-GSUP routing implementation */
+
+/* Author: Mychaela N. Falconia <falcon@freecalypso.org>, 2023 - however,
+ * Mother Mychaela's contributions are NOT subject to copyright.
+ * No rights reserved, all rights relinquished.
+ *
+ * Based on earlier unmerged work by Vadim Yanitskiy, 2019.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/gsm/gsm48_ie.h>
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#include <osmocom/hlr/hlr.h>
+#include <osmocom/hlr/hlr_sms.h>
+#include <osmocom/hlr/gsup_server.h>
+#include <osmocom/hlr/gsup_router.h>
+#include <osmocom/hlr/logging.h>
+#include <osmocom/hlr/db.h>
+
+/***********************************************************************
+ * core data structures expressing config from VTY
+ ***********************************************************************/
+
+struct hlr_smsc *smsc_find(struct hlr *hlr, const char *name)
+{
+	struct hlr_smsc *smsc;
+
+	llist_for_each_entry(smsc, &hlr->smsc_list, list) {
+		if (!strcmp(smsc->name, name))
+			return smsc;
+	}
+	return NULL;
+}
+
+struct hlr_smsc *smsc_alloc(struct hlr *hlr, const char *name)
+{
+	struct hlr_smsc *smsc = smsc_find(hlr, name);
+	if (smsc)
+		return NULL;
+
+	smsc = talloc_zero(hlr, struct hlr_smsc);
+	smsc->name = talloc_strdup(smsc, name);
+	smsc->hlr = hlr;
+	llist_add_tail(&smsc->list, &hlr->smsc_list);
+
+	return smsc;
+}
+
+void smsc_del(struct hlr_smsc *smsc)
+{
+	llist_del(&smsc->list);
+	talloc_free(smsc);
+}
+
+struct hlr_smsc_route *smsc_route_find(struct hlr *hlr, const char *num_addr)
+{
+	struct hlr_smsc_route *rt;
+
+	llist_for_each_entry(rt, &hlr->smsc_routes, list) {
+		if (!strcmp(rt->num_addr, num_addr))
+			return rt;
+	}
+	return NULL;
+}
+
+struct hlr_smsc_route *smsc_route_alloc(struct hlr *hlr, const char *num_addr,
+					struct hlr_smsc *smsc)
+{
+	struct hlr_smsc_route *rt;
+
+	if (smsc_route_find(hlr, num_addr))
+		return NULL;
+
+	rt = talloc_zero(hlr, struct hlr_smsc_route);
+	rt->num_addr = talloc_strdup(rt, num_addr);
+	rt->smsc = smsc;
+	llist_add_tail(&rt->list, &hlr->smsc_routes);
+
+	return rt;
+}
+
+void smsc_route_del(struct hlr_smsc_route *rt)
+{
+	llist_del(&rt->list);
+	talloc_free(rt);
+}
+
+/***********************************************************************
+ * forwarding of MO SMS to SMSCs based on SM-RP-DA
+ ***********************************************************************/
+
+static const struct hlr_smsc *find_smsc_route(const char *smsc_addr)
+{
+	const struct hlr_smsc_route *rt;
+
+	rt = smsc_route_find(g_hlr, smsc_addr);
+	if (rt)
+		return rt->smsc;
+	return g_hlr->smsc_default;
+}
+
+static void respond_with_sm_rp_cause(struct osmo_gsup_req *req,
+				     uint8_t sm_rp_cause)
+{
+	struct osmo_gsup_message rsp_msg = { };
+
+	rsp_msg.sm_rp_cause = &sm_rp_cause;
+	osmo_gsup_req_respond(req, &rsp_msg, true, true);
+}
+
+/* Short Message from MSC/VLR towards SMSC */
+void forward_mo_sms(struct osmo_gsup_req *req)
+{
+	/* The length limit on the SMSC address is 20 digits, stated
+	 * indirectly in GSM 04.11 section 8.2.5.2. */
+	uint8_t gsm48_decode_buffer[11];
+	char smsc_addr[21];
+	const struct hlr_smsc *smsc;
+	struct osmo_cni_peer_id dest_peer;
+
+	/* Make sure SM-RP-DA (SMSC address) is present */
+	if (req->gsup.sm_rp_da == NULL || !req->gsup.sm_rp_da_len) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_INV_MAND_INFO,
+					  "missing SM-RP-DA");
+		return;
+	}
+
+	if (req->gsup.sm_rp_da_type != OSMO_GSUP_SMS_SM_RP_ODA_SMSC_ADDR) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_INV_MAND_INFO,
+					  "SM-RP-DA type is not SMSC");
+		return;
+	}
+
+	/* Enforce the length constrainst on SM-RP-DA, as specified in
+	 * GSM 04.11 section 8.2.5.2.  Also enforce absence of ToN/NPI
+	 * extension octets at the same time. */
+	if (req->gsup.sm_rp_da_len < 2 || req->gsup.sm_rp_da_len > 11 ||
+	    !(req->gsup.sm_rp_da[0] & 0x80)) {
+		/* This form of bogosity originates from the MS,
+		 * not from OsmoMSC or any other Osmocom network elements! */
+		LOGP(DLSMS, LOGL_NOTICE,
+		     "Rx '%s' (IMSI-%s) contains invalid SM-RP-DA from MS\n",
+		     osmo_gsup_message_type_name(req->gsup.message_type),
+		     req->gsup.imsi);
+		respond_with_sm_rp_cause(req, GSM411_RP_CAUSE_SEMANT_INC_MSG);
+		return;
+	}
+
+	/* Decode SMSC address from SM-RP-DA */
+	gsm48_decode_buffer[0] = req->gsup.sm_rp_da_len - 1;
+	memcpy(gsm48_decode_buffer + 1, req->gsup.sm_rp_da + 1,
+		req->gsup.sm_rp_da_len - 1);
+	gsm48_decode_bcd_number2(smsc_addr, sizeof(smsc_addr),
+				 gsm48_decode_buffer,
+				 req->gsup.sm_rp_da_len, 0);
+
+	/* Look for a route to this SMSC */
+	smsc = find_smsc_route(smsc_addr);
+	if (smsc == NULL) {
+		LOGP(DLSMS, LOGL_NOTICE,
+		     "Failed to find a route for '%s' (IMSI-%s, SMSC-Addr-%s)\n",
+		     osmo_gsup_message_type_name(req->gsup.message_type),
+		     req->gsup.imsi, smsc_addr);
+		respond_with_sm_rp_cause(req,
+					 GSM411_RP_CAUSE_MO_NUM_UNASSIGNED);
+		return;
+	}
+
+	/* We got the IPA name of our SMSC - forward the message */
+	osmo_cni_peer_id_set(&dest_peer, OSMO_CNI_PEER_ID_IPA_NAME,
+			     (const uint8_t *) smsc->name,
+			     strlen(smsc->name) + 1);
+	osmo_gsup_forward_to_local_peer(req->cb_data, &dest_peer, req, NULL);
+}
+
+/***********************************************************************
+ * forwarding of MT SMS from SMSCs to MSC/VLR based on IMSI
+ ***********************************************************************/
+
+void forward_mt_sms(struct osmo_gsup_req *req)
+{
+	struct hlr_subscriber subscr;
+	struct osmo_cni_peer_id dest_peer;
+	int rc;
+
+	rc = db_subscr_get_by_imsi(g_hlr->dbc, req->gsup.imsi, &subscr);
+	if (rc < 0) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_IMSI_UNKNOWN,
+					  "IMSI unknown");
+		return;
+	}
+	/* is this subscriber currently attached to a VLR? */
+	if (!subscr.vlr_number[0]) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_IMPL_DETACHED,
+					  "subscriber not attached to a VLR");
+		return;
+	}
+	osmo_cni_peer_id_set(&dest_peer, OSMO_CNI_PEER_ID_IPA_NAME,
+			     (const uint8_t *) subscr.vlr_number,
+			     strlen(subscr.vlr_number) + 1);
+	osmo_gsup_forward_to_local_peer(req->cb_data, &dest_peer, req, NULL);
+}
+
+/***********************************************************************
+ * READY-FOR-SM handling
+ *
+ * An MSC indicates that an MS is ready to receive messages.  If one
+ * or more SMSCs have previously tried to send MT SMS to this MS and
+ * failed, we should pass this READY-FOR-SM message to them so they
+ * can resend their queued SMS right away.  But which SMSC do we
+ * forward the message to?  3GPP specs call for a complicated system
+ * where the HLR remembers which SMSCs have tried and failed to deliver
+ * MT SMS, and those SMSCs then get notified - but that design is too
+ * much complexity for the current state of Osmocom.  So we keep it
+ * simple: we iterate over all configured SMSCs and forward a copy
+ * of the READY-FOR-SM.req message to each.
+ *
+ * Routing of responses is another problem: the MSC that sent
+ * READY-FOR-SM.req expects only one response, and one can even argue
+ * that the operation is a "success" from the perspective of the MS
+ * irrespective of whether each given SMSC handled the notification
+ * successfully or not.  Hence our approach: we always return success
+ * to the MS, and when we forward copies of READY-FOR-SM.req to SMSCs,
+ * we list the HLR as the message source - this way SMSC responses
+ * will terminate at this HLR and won't be forwarded to the MSC.
+ ***********************************************************************/
+
+static void forward_req_copy_to_smsc(const struct osmo_gsup_req *req,
+				     const struct hlr_smsc *smsc)
+{
+	const char *my_ipa_name = g_hlr->gsup_unit_name.serno;
+	struct osmo_gsup_message forward = req->gsup;
+	struct osmo_ipa_name smsc_ipa_name;
+
+	/* set the source to this HLR */
+	forward.source_name = (const uint8_t *) my_ipa_name;
+	forward.source_name_len = strlen(my_ipa_name) + 1;
+
+	/* send it off */
+	LOG_GSUP_REQ(req, LOGL_INFO, "Forwarding source-reset copy to %s\n",
+		     smsc->name);
+	osmo_ipa_name_set(&smsc_ipa_name, (const uint8_t *) smsc->name,
+			  strlen(smsc->name) + 1);
+	osmo_gsup_enc_send_to_ipa_name(g_hlr->gs, &smsc_ipa_name, &forward);
+}
+
+void rx_ready_for_sm_req(struct osmo_gsup_req *req)
+{
+	struct hlr_smsc *smsc;
+
+	/* fan request msg out to all SMSCs */
+	llist_for_each_entry(smsc, &g_hlr->smsc_list, list)
+		forward_req_copy_to_smsc(req, smsc);
+
+	/* send OK response to the MSC and the MS */
+	osmo_gsup_req_respond_msgt(req, OSMO_GSUP_MSGT_READY_FOR_SM_RESULT,
+				   true);
+}

src/hlr_ussd.c

@@ -355,7 +355,7 @@ static int handle_ussd_own_msisdn(struct ss_session *ss,
 		if (strlen(subscr.msisdn) == 0)
 			snprintf(buf, sizeof(buf), "You have no MSISDN!");
 		else
-			snprintf(buf, sizeof(buf), "Your extension is %s", subscr.msisdn);
+			snprintf(buf, sizeof(buf), "Your phone number is %s", subscr.msisdn);
 		ss_tx_to_ms_ussd_7bit(ss, req->invoke_id, buf);
 		break;
 	case -ENOENT:

src/hlr_vty.c

@@ -41,6 +41,7 @@
 #include <osmocom/hlr/hlr_vty.h>
 #include <osmocom/hlr/hlr_vty_subscr.h>
 #include <osmocom/hlr/hlr_ussd.h>
+#include <osmocom/hlr/hlr_sms.h>
 #include <osmocom/hlr/gsup_server.h>
 
 static const struct value_string gsm48_gmm_cause_vty_names[] = {
@@ -212,8 +213,6 @@ DEFUN(cfg_hlr_gsup_ipa_name,
  * USSD Entity
  ***********************************************************************/
 
-#include <osmocom/hlr/hlr_ussd.h>
-
 #define USSD_STR "USSD Configuration\n"
 #define UROUTE_STR "Routing Configuration\n"
 #define PREFIX_STR "Prefix-Matching Route\n" "USSD Prefix\n"
@@ -400,6 +399,160 @@ DEFUN(cfg_ncss_guard_timeout, cfg_ncss_guard_timeout_cmd,
 	return CMD_SUCCESS;
 }
 
+/***********************************************************************
+ * Routing of SM-RL to GSUP-attached SMSCs
+ ***********************************************************************/
+
+#define SMSC_STR "Configuration of GSUP routing to SMSCs\n"
+
+struct cmd_node smsc_node = {
+	SMSC_NODE,
+	"%s(config-hlr-smsc)# ",
+	1,
+};
+
+DEFUN(cfg_smsc_entity, cfg_smsc_entity_cmd,
+	"smsc entity NAME",
+	SMSC_STR
+	"Configure a particular external SMSC\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc;
+	const char *id = argv[0];
+
+	smsc = smsc_find(g_hlr, id);
+	if (!smsc) {
+		smsc = smsc_alloc(g_hlr, id);
+		if (!smsc)
+			return CMD_WARNING;
+	}
+	vty->index = smsc;
+	vty->index_sub = &smsc->description;
+	vty->node = SMSC_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_entity, cfg_no_smsc_entity_cmd,
+	"no smsc entity NAME",
+	NO_STR SMSC_STR "Remove a particular external SMSC\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc = smsc_find(g_hlr, argv[0]);
+	if (!smsc) {
+		vty_out(vty, "%% Cannot remove non-existent SMSC %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (g_hlr->smsc_default == smsc) {
+		vty_out(vty,
+			"%% Cannot remove SMSC %s, it is the default route%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_del(smsc);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_smsc_route, cfg_smsc_route_cmd,
+	"smsc route NUMBER NAME",
+	SMSC_STR
+	"Configure GSUP route to a particular SMSC\n"
+	"Numeric address of this SMSC, must match EF.SMSP programming in SIMs\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc = smsc_find(g_hlr, argv[1]);
+	struct hlr_smsc_route *rt = smsc_route_find(g_hlr, argv[0]);
+	if (rt) {
+		vty_out(vty,
+			"%% Cannot add [another?] route for SMSC address %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (!smsc) {
+		vty_out(vty, "%% Cannot find SMSC '%s'%s", argv[1],
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_route_alloc(g_hlr, argv[0], smsc);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_route, cfg_no_smsc_route_cmd,
+	"no smsc route NUMBER",
+	NO_STR SMSC_STR "Remove GSUP route to a particular SMSC\n"
+	"Numeric address of the SMSC\n")
+{
+	struct hlr_smsc_route *rt = smsc_route_find(g_hlr, argv[0]);
+	if (!rt) {
+		vty_out(vty, "%% Cannot find route for SMSC address %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_route_del(rt);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_smsc_defroute, cfg_smsc_defroute_cmd,
+	"smsc default-route NAME",
+	SMSC_STR
+	"Configure default SMSC route for unknown SMSC numeric addresses\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc;
+
+	smsc = smsc_find(g_hlr, argv[0]);
+	if (!smsc) {
+		vty_out(vty, "%% Cannot find SMSC %s%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (g_hlr->smsc_default != smsc) {
+		vty_out(vty, "Switching default route from %s to %s%s",
+			g_hlr->smsc_default ? g_hlr->smsc_default->name : "<none>",
+			smsc->name, VTY_NEWLINE);
+		g_hlr->smsc_default = smsc;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_defroute, cfg_no_smsc_defroute_cmd,
+	"no smsc default-route",
+	NO_STR SMSC_STR
+	"Remove default SMSC route for unknown SMSC numeric addresses\n")
+{
+	g_hlr->smsc_default = NULL;
+
+	return CMD_SUCCESS;
+}
+
+static void dump_one_smsc(struct vty *vty, struct hlr_smsc *smsc)
+{
+	vty_out(vty, " smsc entity %s%s", smsc->name, VTY_NEWLINE);
+}
+
+static int config_write_smsc(struct vty *vty)
+{
+	struct hlr_smsc *smsc;
+	struct hlr_smsc_route *rt;
+
+	llist_for_each_entry(smsc, &g_hlr->smsc_list, list)
+		dump_one_smsc(vty, smsc);
+
+	llist_for_each_entry(rt, &g_hlr->smsc_routes, list) {
+		vty_out(vty, " smsc route %s %s%s", rt->num_addr,
+			rt->smsc->name, VTY_NEWLINE);
+	}
+
+	if (g_hlr->smsc_default)
+		vty_out(vty, " smsc default-route %s%s",
+			g_hlr->smsc_default->name, VTY_NEWLINE);
+
+	return 0;
+}
 
 DEFUN(cfg_reject_cause, cfg_reject_cause_cmd,
       "reject-cause TYPE CAUSE", "") /* Dynamically Generated */
@@ -549,6 +702,15 @@ void hlr_vty_init(void *hlr_ctx)
 	install_element(HLR_NODE, &cfg_ussd_defaultroute_cmd);
 	install_element(HLR_NODE, &cfg_ussd_no_defaultroute_cmd);
 	install_element(HLR_NODE, &cfg_ncss_guard_timeout_cmd);
+
+	install_node(&smsc_node, config_write_smsc);
+	install_element(HLR_NODE, &cfg_smsc_entity_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_entity_cmd);
+	install_element(HLR_NODE, &cfg_smsc_route_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_route_cmd);
+	install_element(HLR_NODE, &cfg_smsc_defroute_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_defroute_cmd);
+
 	install_element(HLR_NODE, &cfg_reject_cause_cmd);
 	install_element(HLR_NODE, &cfg_store_imei_cmd);
 	install_element(HLR_NODE, &cfg_no_store_imei_cmd);