Split REJect cause by CN DOMAIN

Allow using a distinct Reject Cause for CS and PS Domain. This breaks any existing config that defines custom reject-cause TODO: Add Alias or Hidden function or whatever to handle old config.
Add the VLR to the subscribers last-seen vty command
2025-11-02 13:13:29 +00:00 · 2024-09-05 05:35:53 +01:00 · 2024-09-05 05:35:53 +01:00 · 2024-09-05 05:35:53 +01:00 · 2024-09-05 05:35:53 +01:00 · 2024-09-05 05:35:53 +01:00
65 changed files with 1912 additions and 601 deletions
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -0,0 +1 @@
+open_collective: osmocom
--- a/Makefile.am
+++ b/Makefile.am
@@ -11,8 +11,9 @@ SUBDIRS = \

 EXTRA_DIST = \
 	.version \
-	contrib/osmo-hlr.spec.in \
+	README.md \
 	debian \
+	git-version-gen \
 	$(NULL)

 AM_DISTCHECK_CONFIGURE_FLAGS = \
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 osmo-hlr - Osmocom HLR Implementation
 =====================================

-This repository contains a C-language implementation of a GSM Home
-Location Register (HLR). It is part of the
+This repository contains a C-language implementation of a GSM *Home
+Location Register (HLR)*. It is part of the
 [Osmocom](https://osmocom.org/) Open Source Mobile Communications
 project.

@@ -10,13 +10,14 @@ Warning: While the HLR logical functionality is implemented, OsmoHLR
 does not use the ETSI/3GPP TCAP/MAP protocol stack. Instead, a much
 simpler custom protocol (GSUP) is used.  This means, OsmoHLR is of
 no use outside the context of an Osmocom core network.  You can use
-it with OsmoMSC, OsmoSGSN etc. - but not with third party components.
+it with [OsmoMSC](https://osmocom.org/projects/osmomsc/wiki),
+[OsmoSGSN](https://osmocom.org/projects/osmosgsn/wiki) etc. -
+but not directly with third party components.

 Homepage
 --------

-The official homepage of the project is
-https://osmocom.org/projects/osmo-hlr/wiki
+The official homepage of the project is <https://osmocom.org/projects/osmo-hlr/wiki>.

 GIT Repository
 --------------
@@ -33,11 +34,18 @@ Documentation
 User Manuals and VTY reference manuals are [optionally] built in PDF form
 as part of the build process.

-Pre-rendered PDF version of the current "master" can be found at
-[User Manual](https://ftp.osmocom.org/docs/latest/osmohlr-usermanual.pdf)
-as well as the VTY reference manuals
+Pre-rendered PDF versions of the current `master` can be found at
+
+* [User Manual](https://ftp.osmocom.org/docs/latest/osmohlr-usermanual.pdf)
 * [VTY Reference Manual for osmo-hlr](https://ftp.osmocom.org/docs/latest/osmohlr-vty-reference.pdf)

+Forum
+-----
+
+We welcome any osmo-hlr related discussions in the
+[Cellular Network Infrastructure -> 2G/3G Core Network](https://discourse.osmocom.org/c/cni/2g-3g-cn)
+section of the osmocom discourse (web based Forum).
+
 Mailing List
 ------------

@@ -50,16 +58,23 @@ Please observe the [Osmocom Mailing List
 Rules](https://osmocom.org/projects/cellular-infrastructure/wiki/Mailing_List_Rules)
 when posting.

+Issue Tracker
+-------------
+
+We use the [issue tracker of the osmo-hlr project on osmocom.org](https://osmocom.org/projects/osmo-hlr/issues) for
+tracking the state of bug reports and feature requests.  Feel free to submit any issues you may find, or help
+us out by resolving existing issues.
+
 Contributing
 ------------

 Our coding standards are described at
-https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards
+<https://osmocom.org/projects/cellular-infrastructure/wiki/Coding_standards>

-We us a gerrit based patch submission/review process for managing
+We use a Gerrit based patch submission/review process for managing
 contributions.  Please see
-https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit for
+<https://osmocom.org/projects/cellular-infrastructure/wiki/Gerrit> for
 more details

 The current patch queue for osmo-hlr can be seen at
-https://gerrit.osmocom.org/#/q/project:osmo-hlr+status:open
+<https://gerrit.osmocom.org/#/q/project:osmo-hlr+status:open>
--- a/8
+++ b/8
@@ -1,9 +1,9 @@
 # When cleaning up this file: bump API version in corresponding Makefile.am and rename corresponding debian/lib*.install
-# according to https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info
-# In short:
+# according to https://osmocom.org/projects/cellular-infrastructure/wiki/Make_a_new_release
+# In short: https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html#Updating-version-info
 # LIBVERSION=c:r:a
 # If the library source code has changed at all since the last update, then increment revision: c:r + 1:a.
-# If any interfaces have been added, removed, or changed since the last update: c + 1:0:0.
+# If any interfaces have been added, removed, or changed since the last update: c + 1:0:a.
 # If any interfaces have been added since the last public release: c:r:a + 1.
 # If any interfaces have been removed or changed since the last public release: c:r:0.
-#library        what            description / commit summary line
+#library	what			description / commit summary line
--- a/configure.ac
+++ b/configure.ac
@@ -41,11 +41,11 @@ PKG_PROG_PKG_CONFIG([0.20])

 PKG_CHECK_MODULES(TALLOC, [talloc >= 2.0.1])

-PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.8.0)
-PKG_CHECK_MODULES(LIBOSMOABIS, libosmoabis >= 1.4.0)
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOCTRL, libosmoctrl >= 1.10.0)
+PKG_CHECK_MODULES(LIBOSMOABIS, libosmoabis >= 1.6.0)

 PKG_CHECK_MODULES(SQLITE3, sqlite3)

@@ -203,7 +203,6 @@ AC_OUTPUT(
 	contrib/Makefile
 	contrib/systemd/Makefile
 	contrib/dgsm/Makefile
-	contrib/osmo-hlr.spec
 	tests/Makefile
 	tests/auc/Makefile
 	tests/auc/gen_ts_55_205_test_sets/Makefile
--- a/contrib/osmo-hlr.spec.in
+++ b/contrib/osmo-hlr.spec.in
@@ -1,195 +0,0 @@
-#
-# spec file for package osmo-hlr
-#
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
-# Copyright (c) 2016, Martin Hauke <mardnh@gmx.de>
-#
-# All modifications and additions to the file contributed by third parties
-# remain the property of their copyright owners, unless otherwise agreed
-# upon. The license for this file, and modifications and additions to the
-# file, is the same license as for the pristine package itself (unless the
-# license for the pristine package is not an Open Source License, in which
-# case the license is the MIT License). An "Open Source License" is a
-# license that conforms to the Open Source Definition (Version 1.9)
-# published by the Open Source Initiative.
-
-Name:           osmo-hlr
-Version:        @VERSION@
-Release:        0
-Summary:        Osmocom Home Location Register for GSUP protocol towards OsmoSGSN and OsmoCSCN
-License:        AGPL-3.0-or-later AND GPL-2.0-or-later
-Group:          Productivity/Telephony/Servers
-URL:            https://osmocom.org/projects/osmo-hlr
-Source:         %{name}-%{version}.tar.xz
-BuildRequires:  autoconf
-BuildRequires:  automake
-BuildRequires:  libtool
-BuildRequires:  pkgconfig >= 0.20
-BuildRequires:  python3
-%if 0%{?suse_version}
-BuildRequires:  systemd-rpm-macros
-%endif
-BuildRequires:  pkgconfig(libosmoabis) >= 1.4.0
-BuildRequires:  pkgconfig(libosmocore) >= 1.8.0
-BuildRequires:  pkgconfig(libosmoctrl) >= 1.8.0
-BuildRequires:  pkgconfig(libosmogsm) >= 1.8.0
-BuildRequires:  pkgconfig(libosmovty) >= 1.8.0
-BuildRequires:  pkgconfig(sqlite3)
-BuildRequires:  pkgconfig(talloc) >= 2.0.1
-# only needed for populate_hlr_db.pl
-Requires:       libdbi-drivers-dbd-sqlite3
-%{?systemd_requires}
-
-%description
-The GSUP HLR is a stand-alone HLR (Home Location Register) for SIM
-and USIM based subscribers which exposes the GSUP protocol towards
-its users. OsmoSGSN supports this protocol.
-
-osmo-gsup-hlr is still very simplistic. It is a single-threaded
-architecture and uses only sqlite3 tables as back-end.  It is suitable
-for installations of the scale that OsmoNITB was able to handle.  It
-also lacks various features like fine-grained control of subscribed
-services (like supplementary services).
-
-%package -n libosmo-gsup-client0
-Summary:        Osmocom GSUP (General Subscriber Update Protocol) client library
-License:        GPL-2.0-or-later
-Group:          System/Libraries
-
-%description -n libosmo-gsup-client0
-This is a shared library that can be used to implement client programs for
-the GSUP protocol. The typical GSUP server is OsmoHLR, with OsmoMSC, OsmoSGSN
-and External USSD Entities (EUSEs) using this library to implement clients.
-
-%package -n libosmo-gsup-client-devel
-Summary:        Development files for the Osmocom GSUP client library
-License:        GPL-2.0-or-later
-Group:          Development/Libraries/C and C++
-Requires:       libosmo-gsup-client0 = %{version}
-
-%description -n libosmo-gsup-client-devel
-This is a shared library that can be used to implement client programs for
-the GSUP protocol. The typical GSUP server is OsmoHLR, with OsmoMSC, OsmoSGSN
-and External USSD Entities (EUSEs) using this library to implement clients.
-
-This subpackage contains libraries and header files for developing
-applications that want to make use of libosmo-gsup-client.
-
-%package -n libosmo-mslookup1
-Summary:        Osmocom MS lookup library
-License:        GPL-2.0-or-later
-Group:          System/Libraries
-
-%description -n libosmo-mslookup1
-This shared library contains routines for looking up mobile subscribers.
-
-%package -n libosmo-mslookup-devel
-Summary:        Development files for the Osmocom MS lookup library
-License:        GPL-2.0-or-later
-Group:          Development/Libraries/C and C++
-Requires:       libosmo-mslookup1 = %{version}
-
-%description -n libosmo-mslookup-devel
-This shared library contains routines for looking up mobile subscribers.
-
-This subpackage contains libraries and header files for developing
-applications that want to make use of libosmo-mslookup.
-
-
-%package -n osmo-mslookup-client
-Summary:        Standalone program using libosmo-mslookup
-License:        GPL-2.0-or-later
-Group:          Development/Libraries/C and C++
-
-%description -n osmo-mslookup-client
-Standalone program using libosmo-mslookup to easily integrate with programs
-that want to connect services (SIP, SMS,...) to the current location of a
-subscriber.
-
-%prep
-%setup -q
-
-%build
-echo "%{version}" >.tarball-version
-autoreconf -fi
-%configure \
-  --docdir="%{_docdir}/%{name}" \
-  --with-systemdsystemunitdir=%{_unitdir} \
-  --enable-shared \
-  --disable-static
-make V=1 %{?_smp_mflags}
-
-%install
-%make_install
-install -d "%{buildroot}/%{_localstatedir}/lib/osmocom"
-find %{buildroot} -type f -name "*.la" -delete -print
-
-%check
-make %{?_smp_mflags} check || (find . -name testsuite.log -exec cat {} +)
-
-%if 0%{?suse_version}
-%preun
-%service_del_preun %{name}.service
-
-%postun
-%service_del_postun %{name}.service
-
-%pre
-%service_add_pre %{name}.service
-%endif
-
-%post
-%if 0%{?suse_version}
-%service_add_post %{name}.service
-%endif
-/usr/share/osmocom/osmo-hlr-post-upgrade.sh
-
-%post   -n libosmo-gsup-client0 -p /sbin/ldconfig
-%postun -n libosmo-gsup-client0 -p /sbin/ldconfig
-%post   -n libosmo-mslookup1 -p /sbin/ldconfig
-%postun -n libosmo-mslookup1 -p /sbin/ldconfig
-
-%files
-%license COPYING
-%dir %{_docdir}/%{name}
-%dir %{_docdir}/%{name}/examples
-%{_docdir}/%{name}/examples/osmo-hlr.cfg
-%{_docdir}/%{name}/examples/osmo-hlr-dgsm.cfg
-%dir %{_docdir}/%{name}/sql
-%{_docdir}/%{name}/sql/hlr.sql
-%{_docdir}/%{name}/sql//hlr_data.sql
-%dir %{_sysconfdir}/osmocom
-%dir %{_localstatedir}/lib/osmocom
-%{_bindir}/osmo-hlr
-%{_bindir}/osmo-hlr-db-tool
-%dir %{_sysconfdir}/osmocom
-%config %{_sysconfdir}/osmocom/osmo-hlr.cfg
-%{_unitdir}/osmo-hlr.service
-%dir %{_datadir}/osmocom
-%{_datadir}/osmocom/osmo-hlr-post-upgrade.sh
-
-%files -n libosmo-gsup-client0
-%{_libdir}/libosmo-gsup-client.so.0*
-
-%files -n libosmo-gsup-client-devel
-%{_bindir}/osmo-euse-demo
-%dir %{_includedir}/osmocom
-%dir %{_includedir}/osmocom/gsupclient
-%{_includedir}/osmocom/gsupclient/*.h
-%{_libdir}/libosmo-gsup-client.so
-%{_libdir}/pkgconfig/libosmo-gsup-client.pc
-
-%files -n libosmo-mslookup1
-%{_libdir}/libosmo-mslookup.so.1*
-
-%files -n libosmo-mslookup-devel
-%dir %{_includedir}/osmocom
-%dir %{_includedir}/osmocom/mslookup
-%{_includedir}/osmocom/mslookup/*.h
-%{_libdir}/libosmo-mslookup.so
-%{_libdir}/pkgconfig/libosmo-mslookup.pc
-
-%files -n osmo-mslookup-client
-%{_bindir}/osmo-mslookup-client
-
-%changelog
--- a/contrib/systemd/osmo-hlr.service
+++ b/contrib/systemd/osmo-hlr.service
@@ -1,12 +1,16 @@
 [Unit]
 Description=Osmocom Home Location Register (OsmoHLR)
 Documentation=https://osmocom.org/projects/osmo-hlr/wiki/OsmoHLR
+After=network-online.target
+Wants=network-online.target

 [Service]
 Type=simple
 Restart=always
 StateDirectory=osmocom
 WorkingDirectory=%S/osmocom
+User=osmocom
+Group=osmocom
 ExecStart=/usr/bin/osmo-hlr -c /etc/osmocom/osmo-hlr.cfg -l /var/lib/osmocom/hlr.db
 RestartSec=2
 ProtectHome=true
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,70 @@
+osmo-hlr (1.8.0) unstable; urgency=medium
+
+  [ Vadim Yanitskiy ]
+  * hlr_vty.c: drop redundant include of hlr_ussd.h
+  * build: include {README.md,git-version-gen} into the release tarball
+  * README.md: cosmetic: fix a typo
+
+  [ Mychaela N. Falconia ]
+  * SMS over GSUP: implement vty config of SMSC routing
+  * SMS over GSUP: implement forwarding of MO SMS
+  * SMS over GSUP: implement forwarding of MT SMS
+  * SMS over GSUP: handle READY-FOR-SM.req from MSCs
+  * ctrl: add subscriber.by-*.imsi GET-able variable
+
+  [ Andreas Eversberg ]
+  * Use uniform log format for default config files
+
+  [ Harald Welte ]
+  * Add funding link to github mirror
+  * README.md: Improve mark-down formatting
+  * README.md: Add Forum and Issue Tracker sections
+
+  [ Max ]
+  * .deb/.rpm: add osmocom user during package install
+
+  [ Oliver Smith ]
+  * .deb/.rpm: various fixes related to non-root
+  * contrib: remove rpm spec file
+  * debian/postinst: add checks, be verbose
+  * mslookup: don't ignore return value of write()
+
+ -- Oliver Smith <osmith@sysmocom.de>  Wed, 24 Jul 2024 15:29:12 +0200
+
+osmo-hlr (1.7.0) unstable; urgency=medium
+
+  [ Oliver Smith ]
+  * Run struct_endianness.py
+  * tests/db/db_test.err: adjust to XOR-3G rename
+  * debian: set compat level to 10
+  * systemd: depend on networking-online.target
+
+  [ Pau Espin Pedrol ]
+  * mslookup: Call osmo_fd_unregister() before closing and changing bfd->fd
+
+  [ Vadim Yanitskiy ]
+  * tests/auc/Makefile.am: put object files to LDADD
+  * tests/*/Makefile.am: move -I to AM_CPPFLAGS
+  * lu_fsm: fix memleak in lu_fsm_wait_insert_data_result()
+  * ussd: fix GSUP memleaks in rx_proc_ss_{req,error}()
+  * gsup_server: fix msgb memleak in osmo_gsup_server_read_cb()
+  * USSD: fix handling of ussd-DataCodingScheme != 0x0f
+
+  [ Alexander Couzens ]
+  * hlr: use talloc for memory allocation in osmo_gsup_create_insert_subscriber_data_msg
+  * Add support for multiple APN profiles for subscriber data
+
+  [ Harald Welte ]
+  * Introduce support for XOR-2G algorithm
+  * cosmetic: gen_ts_55_205_test_sets/func_template.c: Use tab-indent
+  * cosmetic: gen_ts_55_205_test_sets/main_template tabs istead of spaces
+  * Port to new libosmogsm 'struct osmo_sub_auth_data2'
+  * src/db.c: Switch from "const char *statements" to "const char * const"
+  * db: extend database schema to support 256bit K and/or OP[c] values
+  * Add VTY support for TUAK algorithm
+
+ -- Pau Espin Pedrol <pespin@sysmocom.de>  Tue, 12 Sep 2023 14:41:33 +0200
+
 osmo-hlr (1.6.0) unstable; urgency=medium

  [ Vadim Yanitskiy ]
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-9
+10
--- a/debian/control
+++ b/debian/control
@@ -2,17 +2,17 @@ Source: osmo-hlr
 Section: net
 Priority: optional
 Maintainer: Osmocom team <openbsc@lists.osmocom.org>
-Build-Depends: debhelper (>= 9),
+Build-Depends: debhelper (>= 10),
               pkg-config,
               dh-autoreconf,
               autotools-dev,
               python3-minimal,
-               libosmocore-dev (>= 1.8.0),
-               libosmo-abis-dev (>= 1.4.0),
-               libosmo-netif-dev (>= 1.3.0),
+               libosmocore-dev (>= 1.10.0),
+               libosmo-abis-dev (>= 1.6.0),
+               libosmo-netif-dev (>= 1.5.0),
               libsqlite3-dev,
               sqlite3,
-               osmo-gsm-manuals-dev (>= 1.4.0)
+               osmo-gsm-manuals-dev (>= 1.6.0)
 Standards-Version: 3.9.6
 Vcs-Browser: https://gitea.osmocom.org/cellular-infrastructure/osmo-hlr
 Vcs-Git: https://gitea.osmocom.org/cellular-infrastructure/osmo-hlr
--- a/debian/postinst
+++ b/debian/postinst
@@ -3,3 +3,41 @@
 # post-upgrade script in both cases, it won't do anything if there is nothing
 # to do.
 /usr/share/osmocom/osmo-hlr-post-upgrade.sh
+
+case "$1" in
+	configure)
+		# Create the osmocom group and user (if it doesn't exist yet)
+		if ! getent group osmocom >/dev/null; then
+			groupadd --system osmocom
+		fi
+		if ! getent passwd osmocom >/dev/null; then
+			useradd \
+				--system \
+				--gid osmocom \
+				--home-dir /var/lib/osmocom \
+				--shell /sbin/nologin \
+				--comment "Open Source Mobile Communications" \
+				osmocom
+		fi
+
+		# Fix permissions of previous (root-owned) install (OS#4107)
+		if dpkg --compare-versions "$2" le "1.8.0"; then
+			if [ -e /etc/osmocom/osmo-hlr.cfg ]; then
+				chown -v osmocom:osmocom /etc/osmocom/osmo-hlr.cfg
+				chmod -v 0660 /etc/osmocom/osmo-hlr.cfg
+			fi
+
+			if [ -d /etc/osmocom ]; then
+				chown -v root:osmocom /etc/osmocom
+				chmod -v 2775 /etc/osmocom
+			fi
+
+			mkdir -p /var/lib/osmocom
+			chown -R -v osmocom:osmocom /var/lib/osmocom
+		fi
+		;;
+esac
+
+# dh_installdeb(1) will replace this with shell code automatically
+# generated by other debhelper scripts.
+#DEBHELPER#
--- a/doc/examples/osmo-hlr-dgsm.cfg
+++ b/doc/examples/osmo-hlr-dgsm.cfg
@@ -1,4 +1,12 @@
 # OsmoHLR example configuration for Distributed GSM (mslookup)
+log stderr
+ logging color 1
+ logging print category-hex 0
+ logging print category 1
+ logging timestamp 0
+ logging print file basename last
+ logging print level 1
+
 hlr
 gsup
  # For D-GSM roaming, osmo-hlr's GSUP must listen on a public IP:
--- a/doc/examples/osmo-hlr.cfg
+++ b/doc/examples/osmo-hlr.cfg
@@ -4,11 +4,11 @@
 log stderr
 logging filter all 1
 logging color 1
- logging print category 1
 logging print category-hex 0
- logging print level 1
+ logging print category 1
+ logging timestamp 0
 logging print file basename last
- logging print extended-timestamp 1
+ logging print level 1
 logging level main notice
 logging level db notice
 logging level auc notice
@@ -24,3 +24,9 @@ hlr
  bind ip 127.0.0.1
 ussd route prefix *#100# internal own-msisdn
 ussd route prefix *#101# internal own-imsi
+ ps
+  pdp-profiles default
+   profile 1
+    apn internet
+   profile 2
+    apn *
--- a/include/osmocom/hlr/Makefile.am
+++ b/include/osmocom/hlr/Makefile.am
@@ -6,6 +6,7 @@ noinst_HEADERS = \
 	gsup_router.h \
 	gsup_server.h \
 	hlr.h \
+	hlr_sms.h \
 	hlr_ussd.h \
 	hlr_vty.h \
 	hlr_vty_subscr.h \
--- a/include/osmocom/hlr/auc.h
+++ b/include/osmocom/hlr/auc.h
@@ -3,6 +3,6 @@
 #include <osmocom/crypt/auth.h>

 int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
-			struct osmo_sub_auth_data *aud2g,
-			struct osmo_sub_auth_data *aud3g,
+			struct osmo_sub_auth_data2 *aud2g,
+			struct osmo_sub_auth_data2 *aud3g,
 			const uint8_t *rand_auts, const uint8_t *auts);
--- a/include/osmocom/hlr/db.h
+++ b/include/osmocom/hlr/db.h
@@ -40,6 +40,8 @@ enum stmt_idx {
 	DB_STMT_SET_LAST_LU_SEEN,
 	DB_STMT_SET_LAST_LU_SEEN_PS,
 	DB_STMT_EXISTS_BY_IMSI,
+	DB_STMT_EXISTS_AUTHORIZED_BY_IMSI,
+	DB_STMT_IS_CREATED_ON_DEMAND_BY_IMSI,
 	DB_STMT_EXISTS_BY_MSISDN,
 	DB_STMT_IND_ADD,
 	DB_STMT_IND_SELECT,
@@ -70,8 +72,8 @@ struct db_context *db_open(void *ctx, const char *fname, bool enable_sqlite3_log

 /* obtain the authentication data for a given imsi */
 int db_get_auth_data(struct db_context *dbc, const char *imsi,
-		     struct osmo_sub_auth_data *aud2g,
-		     struct osmo_sub_auth_data *aud3g,
+		     struct osmo_sub_auth_data2 *aud2g,
+		     struct osmo_sub_auth_data2 *aud3g,
 		     int64_t *subscr_id);

 int db_update_sqn(struct db_context *dbc, int64_t id,
@@ -121,7 +123,7 @@ struct hlr_subscriber {
 * See https://sqlite.org/lang_datefunc.html, function datetime(). */
 #define DB_LAST_LU_SEEN_FMT "%Y-%m-%d %H:%M:%S"

-/* Like struct osmo_sub_auth_data, but the keys are in hexdump representation.
+/* Like struct osmo_sub_auth_data2, but the keys are in hexdump representation.
 * This is useful because SQLite requires them in hexdump format, and callers
 * like the VTY and CTRL interface also have them available as hexdump to begin
 * with. In the binary format, a VTY command would first need to hexparse,
@@ -157,6 +159,8 @@ int db_subscr_update_aud_by_id(struct db_context *dbc, int64_t subscr_id,
 int db_subscr_update_imei_by_imsi(struct db_context *dbc, const char* imsi, const char *imei);

 int db_subscr_exists_by_imsi(struct db_context *dbc, const char *imsi);
+int db_subscr_authorized_by_imsi(struct db_context *dbc, const char *imsi);
+int db_subscr_is_created_on_demand_by_imsi(struct db_context *dbc, const char *imsi, unsigned int msisdn_len);
 int db_subscr_exists_by_msisdn(struct db_context *dbc, const char *msisdn);

 int db_subscrs_get(struct db_context *dbc, const char *filter_type, const char *filter,
--- a/include/osmocom/hlr/dgsm.h
+++ b/include/osmocom/hlr/dgsm.h
@@ -25,6 +25,7 @@
 #include <osmocom/gsupclient/cni_peer_id.h>
 #include <osmocom/gsupclient/gsup_req.h>

+#define OSMO_DGSM_DEFAULT_LOCAL_ATTACH_MAX_AGE	60 * 60
 #define OSMO_DGSM_DEFAULT_RESULT_TIMEOUT_MS	2000
 #define LOG_DGSM(imsi, level, fmt, args...) \
 	LOGP(DDGSM, level, "(IMSI-%s) " fmt, imsi, ##args)
--- a/include/osmocom/hlr/gsup_server.h
+++ b/include/osmocom/hlr/gsup_server.h
@@ -69,8 +69,6 @@ void osmo_gsup_server_destroy(struct osmo_gsup_server *gsups);
 int osmo_gsup_configure_wildcard_apn(struct osmo_gsup_message *gsup,
 				     uint8_t *apn_buf, size_t apn_buf_size);
 int osmo_gsup_create_insert_subscriber_data_msg(struct osmo_gsup_message *gsup, const char *imsi, const char *msisdn,
-					    uint8_t *msisdn_enc, size_t msisdn_enc_size,
-				            uint8_t *apn_buf, size_t apn_buf_size,
-					    enum osmo_gsup_cn_domain cn_domain);
+					    enum osmo_gsup_cn_domain cn_domain, void *talloc_ctx);
 int osmo_gsup_forward_to_local_peer(struct osmo_gsup_server *server, const struct osmo_cni_peer_id *to_peer,
 				    struct osmo_gsup_req *req, struct osmo_gsup_message *modified_gsup);
--- a/include/osmocom/hlr/hlr.h
+++ b/include/osmocom/hlr/hlr.h
@@ -39,6 +39,13 @@ enum osmo_gsup_message_type;

 extern struct osmo_tdef g_hlr_tdefs[];

+enum subscr_create_on_demand_mode {
+	SUBSCR_COD_MODE_DISABLED = 0,
+	SUBSCR_COD_MODE_NO_MSISDN,
+	SUBSCR_COD_MODE_RAND_MSISDN,
+	SUBSCR_COD_MODE_MSISDN_FROM_IMSI,
+};
+
 struct hlr {
 	/* GSUP server pointer */
 	struct osmo_gsup_server *gs;
@@ -56,8 +63,24 @@ struct hlr {

 	struct llist_head euse_list;
 	struct hlr_euse *euse_default;
-	enum gsm48_gmm_cause reject_cause;
-	enum gsm48_gmm_cause no_proxy_reject_cause;
+
+	struct {
+		enum gsm48_gmm_cause cs;
+		enum gsm48_gmm_cause ps;
+	} reject_cause;
+	struct {
+		enum gsm48_gmm_cause cs;
+		enum gsm48_gmm_cause ps;
+	} no_proxy_reject_cause;
+
+	/* PS: APN default configuration used by Subscription Data on ISR */
+	struct {
+		struct {
+			bool enabled;
+			struct osmo_gsup_pdp_info pdp_infos[OSMO_GSUP_MAX_NUM_PDP_INFO];
+			size_t num_pdp_infos;
+		} pdp_profile;
+	} ps;

 	/* NCSS (call independent) session guard timeout value */
 	int ncss_guard_timeout;
@@ -66,12 +89,18 @@ struct hlr {

 	struct llist_head ss_sessions;

+	struct llist_head smsc_list;
+	struct llist_head smsc_routes;
+	struct hlr_smsc *smsc_default;
+
 	bool store_imei;

-	bool subscr_create_on_demand;
-	/* Bitmask of DB_SUBSCR_FLAG_* */
-	uint8_t subscr_create_on_demand_flags;
-	unsigned int subscr_create_on_demand_rand_msisdn_len;
+	struct {
+		enum subscr_create_on_demand_mode mode;
+		unsigned int rand_msisdn_len;
+		/* Bitmask of DB_SUBSCR_FLAG_* */
+		uint8_t flags;
+	} subscr_create_on_demand;

 	struct {
 		bool allow_startup;
@@ -111,7 +140,10 @@ struct hlr {
 				char *domain_suffix;
 				struct osmo_mslookup_client_method *running;
 			} mdns;
+			bool subscr_create_on_demand_fallback;
 		} client;
+		bool auth_imsi_only;
+		bool ignore_created_on_demand;
 	} mslookup;
 };

@@ -121,3 +153,4 @@ struct hlr_subscriber;

 void osmo_hlr_subscriber_update_notify(struct hlr_subscriber *subscr);
 int hlr_subscr_nam(struct hlr *hlr, struct hlr_subscriber *subscr, bool nam_val, bool is_ps);
+void dgsm_fallback_to_hlr();
--- a/include/osmocom/hlr/hlr_sms.h
+++ b/include/osmocom/hlr/hlr_sms.h
@@ -0,0 +1,33 @@
+#pragma once
+
+#include <osmocom/core/linuxlist.h>
+
+struct hlr_smsc {
+	/* g_hlr->smsc_list */
+	struct llist_head list;
+	struct hlr *hlr;
+	/* name (must match the IPA ID tag) */
+	const char *name;
+	/* human-readable description */
+	const char *description;
+};
+
+struct hlr_smsc *smsc_find(struct hlr *hlr, const char *name);
+struct hlr_smsc *smsc_alloc(struct hlr *hlr, const char *name);
+void smsc_free(struct hlr_smsc *smsc);
+
+struct hlr_smsc_route {
+	/* g_hlr->smsc_routes */
+	struct llist_head list;
+	const char *num_addr;
+	struct hlr_smsc *smsc;
+};
+
+struct hlr_smsc_route *smsc_route_find(struct hlr *hlr, const char *num_addr);
+struct hlr_smsc_route *smsc_route_alloc(struct hlr *hlr, const char *num_addr,
+					struct hlr_smsc *smsc);
+void smsc_route_free(struct hlr_smsc_route *rt);
+
+void forward_mo_sms(struct osmo_gsup_req *req);
+void forward_mt_sms(struct osmo_gsup_req *req);
+void rx_ready_for_sm_req(struct osmo_gsup_req *req);
--- a/include/osmocom/hlr/hlr_vty.h
+++ b/include/osmocom/hlr/hlr_vty.h
@@ -31,15 +31,20 @@ enum hlr_vty_node {
 	HLR_NODE = _LAST_OSMOVTY_NODE + 1,
 	GSUP_NODE,
 	EUSE_NODE,
+	SMSC_NODE,
 	MSLOOKUP_NODE,
 	MSLOOKUP_SERVER_NODE,
 	MSLOOKUP_SERVER_MSC_NODE,
 	MSLOOKUP_CLIENT_NODE,
+	PS_NODE,
+	PS_PDP_PROFILES_NODE,
+	PS_PDP_PROFILES_PROFILE_NODE,
 };


 #define A38_XOR_MIN_KEY_LEN	12
 #define A38_XOR_MAX_KEY_LEN	16
+#define A38_XOR2G_KEY_LEN	16
 #define A38_COMP128_KEY_LEN	16
 #define MILENAGE_KEY_LEN	16

--- a/include/osmocom/hlr/proxy.h
+++ b/include/osmocom/hlr/proxy.h
@@ -71,6 +71,8 @@ void proxy_init(struct osmo_gsup_server *gsup_server_to_vlr);
 void proxy_del(struct proxy *proxy);
 void proxy_set_gc_period(struct proxy *proxy, uint32_t gc_period);

+struct osmo_gsup_req *proxy_deferred_gsup_req_get_by_imsi(struct proxy *proxy, const char *imsi);
+
 /* The API to access / modify proxy entries keeps the implementation opaque, to make sure that we can easily move proxy
 * storage to SQLite db. */
 int proxy_subscr_get_by_imsi(struct proxy_subscr *dst, struct proxy *proxy, const char *imsi);
--- a/include/osmocom/mslookup/mdns_rfc.h
+++ b/include/osmocom/mslookup/mdns_rfc.h
@@ -71,7 +71,7 @@ struct osmo_mdns_rfc_header {
 	uint16_t nscount; /* Number of authority records */
 	uint16_t arcount; /* Number of additional records */
 #elif OSMO_IS_BIG_ENDIAN
-/* auto-generated from the little endian part above (libosmocore/contrib/struct_endianess.py) */
+/* auto-generated from the little endian part above (libosmocore/contrib/struct_endianness.py) */
 	uint16_t id;
 	uint8_t qr:1, opcode:4, aa:1, tc:1, rd:1;
 	uint8_t ra:1, z:3, rcode:4;
--- a/include/osmocom/mslookup/mslookup.h
+++ b/include/osmocom/mslookup/mslookup.h
@@ -35,6 +35,7 @@ enum osmo_mslookup_id_type {
 	OSMO_MSLOOKUP_ID_NONE = 0,
 	OSMO_MSLOOKUP_ID_IMSI,
 	OSMO_MSLOOKUP_ID_MSISDN,
+	OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED,
 };

 extern const struct value_string osmo_mslookup_id_type_names[];
--- a/include/osmocom/mslookup/mslookup_client.h
+++ b/include/osmocom/mslookup/mslookup_client.h
@@ -37,6 +37,8 @@ typedef void (*osmo_mslookup_cb_t)(struct osmo_mslookup_client *client,
 * This query handling info is not seen by the individual method implementations, to clarify that it is the
 * osmo_mslookup_client layer that takes care of these details. */
 struct osmo_mslookup_query_handling {
+	bool search_all;
+
 	/*! Wait at least this long before returning any results.
 	 *
 	 * If nonzero, result_cb will be called as soon as this delay has elapsed, either with the so far youngest age
--- a/sql/hlr.sql
+++ b/sql/hlr.sql
@@ -71,9 +71,9 @@ CREATE TABLE auc_2g (
 CREATE TABLE auc_3g (
 	subscriber_id	INTEGER PRIMARY KEY,	-- subscriber.id
 	algo_id_3g	INTEGER NOT NULL,	-- enum osmo_auth_algo value
-	k		VARCHAR(32) NOT NULL,	-- hex string: subscriber's secret key (128bit)
-	op		VARCHAR(32),		-- hex string: operator's secret key (128bit)
-	opc		VARCHAR(32),		-- hex string: derived from OP and K (128bit)
+	k		VARCHAR(64) NOT NULL,	-- hex string: subscriber's secret key (128/256bit)
+	op		VARCHAR(64),		-- hex string: operator's secret key (128/256bit)
+	opc		VARCHAR(64),		-- hex string: derived from OP and K (128/256bit)
 	sqn		INTEGER NOT NULL DEFAULT 0,	-- sequence number of key usage
 	-- nr of index bits at lower SQN end
 	ind_bitlen	INTEGER NOT NULL DEFAULT 5
@@ -91,4 +91,4 @@ CREATE UNIQUE INDEX idx_subscr_imsi ON subscriber (imsi);

 -- Set HLR database schema version number
 -- Note: This constant is currently duplicated in src/db.c and must be kept in sync!
-PRAGMA user_version = 6;
+PRAGMA user_version = 7;
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -52,6 +52,7 @@ osmo_hlr_SOURCES = \
 	hlr_vty.c \
 	hlr_vty_subscr.c \
 	gsup_send.c \
+	hlr_sms.c \
 	hlr_ussd.c \
 	proxy.c \
 	dgsm.c \
@@ -111,7 +112,7 @@ BOOTSTRAP_SQL = $(top_srcdir)/sql/hlr.sql
 db_bootstrap.h: $(BOOTSTRAP_SQL) $(srcdir)/db_sql2c.sed
 	echo "/* DO NOT EDIT THIS FILE. It is generated from files in osmo-hlr.git/sql/ */" > "$@"
 	echo "#pragma once" >> "$@"
-	echo "static const char *stmt_bootstrap_sql[] = {" >> "$@"
+	echo "static const char * const stmt_bootstrap_sql[] = {" >> "$@"
 	cat "$(BOOTSTRAP_SQL)" \
 		| sed -f "$(srcdir)/db_sql2c.sed" \
 		>> "$@"
--- a/src/auc.c
+++ b/src/auc.c
@@ -1,4 +1,4 @@
-/* (C) 2015 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2015-2023 by Harald Welte <laforge@gnumonks.org>
 *
 * All Rights Reserved
 *
@@ -32,8 +32,8 @@
 /* compute given number of vectors using either aud2g or aud2g or a combination
 * of both.  Handles re-synchronization if rand_auts and auts are set */
 int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
-			struct osmo_sub_auth_data *aud2g,
-			struct osmo_sub_auth_data *aud3g,
+			struct osmo_sub_auth_data2 *aud2g,
+			struct osmo_sub_auth_data2 *aud3g,
 			const uint8_t *rand_auts, const uint8_t *auts)
 {
 	unsigned int i;
@@ -93,10 +93,10 @@ int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
 	     : "2G only",
 	     auts? ", with AUTS resync" : "");
 	if (aud3g) {
-		DBGP("3G: k = %s\n", hexb(aud3g->u.umts.k));
+		DBGP("3G: k = %s\n", hex(aud3g->u.umts.k, aud3g->u.umts.k_len));
 		DBGP("3G: %s = %s\n",
 		     aud3g->u.umts.opc_is_op? "OP" : "opc",
-		     hexb(aud3g->u.umts.opc));
+		     hex(aud3g->u.umts.opc, aud3g->u.umts.opc_len));
 		DBGP("3G: for sqn ind %u, previous sqn was %" PRIu64 "\n",
 		     aud3g->u.umts.ind, aud3g->u.umts.sqn);
 	}
@@ -115,6 +115,9 @@ int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
 		if (aud3g) {
 			/* 3G or 3G + 2G case */

+			/* backwards-compatibiliy: We assume all RES are 8 bytes long */
+			vec[i].res_len = 8;
+
 			/* Do AUTS only for the first vector or we would use
 			 * the same SQN for each following key. */
 			if ((i == 0) && auts) {
@@ -123,10 +126,10 @@ int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
 				DBGP("vector [%u]: resync: rand_auts = %s\n",
 				     i, hex(rand_auts, 16));

-				rc = osmo_auth_gen_vec_auts(vec+i, aud3g, auts,
+				rc = osmo_auth_gen_vec_auts2(vec+i, aud3g, auts,
 							    rand_auts, rand);
 			} else {
-				rc = osmo_auth_gen_vec(vec+i, aud3g, rand);
+				rc = osmo_auth_gen_vec2(vec+i, aud3g, rand);
 			}
 			if (rc < 0) {
 				LOGP(DAUC, LOGL_ERROR, "Error in 3G vector "
@@ -154,7 +157,7 @@ int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,

 			DBGP("vector [%u]: calculating 2G separately\n", i);

-			rc = osmo_auth_gen_vec(&vtmp, aud2g, rand);
+			rc = osmo_auth_gen_vec2(&vtmp, aud2g, rand);
 			if (rc < 0) {
 				LOGP(DAUC, LOGL_ERROR, "Error in 2G vector"
 				     "generation: [%u]: rc = %d\n", i, rc);
@@ -165,7 +168,7 @@ int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
 			vec[i].auth_types |= OSMO_AUTH_TYPE_GSM;
 		} else {
 			/* 2G only case */
-			rc = osmo_auth_gen_vec(vec+i, aud2g, rand);
+			rc = osmo_auth_gen_vec2(vec+i, aud2g, rand);
 			if (rc < 0) {
 				LOGP(DAUC, LOGL_ERROR, "Error in 2G vector "
 				     "generation: [%u]: rc = %d\n", i, rc);
--- a/src/ctrl.c
+++ b/src/ctrl.c
@@ -1,6 +1,6 @@
 /* OsmoHLR Control Interface implementation */

-/* (C) 2017 sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+/* (C) 2017-2023 sysmocom s.f.m.c. GmbH <info@sysmocom.de>
 * All Rights Reserved
 *
 * Author: Max Suraev <msuraev@sysmocom.de>
@@ -39,7 +39,7 @@
 #define SEL_BY_ID SEL_BY "id-"

 extern bool auth_algo_parse(const char *alg_str, enum osmo_auth_algo *algo,
-			    int *minlen, int *maxlen);
+			    int *minlen, int *maxlen, int *minlen_opc, int *maxlen_opc);

 #define hexdump_buf(buf) osmo_hexdump_nospc((void*)buf, sizeof(buf))

@@ -166,7 +166,7 @@ static void print_subscr_info(struct ctrl_cmd *cmd,
 		);
 }

-static void print_subscr_info_aud2g(struct ctrl_cmd *cmd, struct osmo_sub_auth_data *aud)
+static void print_subscr_info_aud2g(struct ctrl_cmd *cmd, struct osmo_sub_auth_data2 *aud)
 {
 	if (aud->algo == OSMO_AUTH_ALG_NONE)
 		return;
@@ -178,7 +178,7 @@ static void print_subscr_info_aud2g(struct ctrl_cmd *cmd, struct osmo_sub_auth_d
 		hexdump_buf(aud->u.gsm.ki));
 }

-static void print_subscr_info_aud3g(struct ctrl_cmd *cmd, struct osmo_sub_auth_data *aud)
+static void print_subscr_info_aud3g(struct ctrl_cmd *cmd, struct osmo_sub_auth_data2 *aud)
 {
 	if (aud->algo == OSMO_AUTH_ALG_NONE)
 		return;
@@ -187,7 +187,7 @@ static void print_subscr_info_aud3g(struct ctrl_cmd *cmd, struct osmo_sub_auth_d
 		"\naud3g.k\t%s"
 		,
 		osmo_auth_alg_name(aud->algo),
-		hexdump_buf(aud->u.umts.k));
+		osmo_hexdump_nospc(aud->u.umts.k, aud->u.umts.k_len));
 	/* hexdump uses a static string buffer, hence only one hexdump per
 	 * printf(). */
 	ctrl_cmd_reply_printf(cmd,
@@ -196,7 +196,7 @@ static void print_subscr_info_aud3g(struct ctrl_cmd *cmd, struct osmo_sub_auth_d
 		"\naud3g.sqn\t%" PRIu64
 		,
 		aud->u.umts.opc_is_op? "op" : "opc",
-		hexdump_buf(aud->u.umts.opc),
+		osmo_hexdump_nospc(aud->u.umts.opc, aud->u.umts.opc_len),
 		aud->u.umts.ind_bitlen,
 		aud->u.umts.sqn);
 }
@@ -291,8 +291,8 @@ CTRL_CMD_DEFINE_RO(subscr_info_aud, "info-aud");
 static int get_subscr_info_aud(struct ctrl_cmd *cmd, void *data)
 {
 	const char *imsi;
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct hlr *hlr = data;
 	const char *by_selector = cmd->node;
 	int rc;
@@ -327,8 +327,8 @@ CTRL_CMD_DEFINE_RO(subscr_info_all, "info-all");
 static int get_subscr_info_all(struct ctrl_cmd *cmd, void *data)
 {
 	struct hlr_subscriber subscr;
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct hlr *hlr = data;
 	const char *by_selector = cmd->node;
 	int rc;
@@ -426,6 +426,20 @@ static int set_subscr_cs_enabled(struct ctrl_cmd *cmd, void *data)
 	return set_subscr_cs_ps_enabled(cmd, data, false);
 }

+CTRL_CMD_DEFINE_RO(subscr_imsi, "imsi");
+static int get_subscr_imsi(struct ctrl_cmd *cmd, void *data)
+{
+	struct hlr_subscriber subscr;
+	struct hlr *hlr = data;
+	const char *by_selector = cmd->node;
+
+	if (!get_subscriber(hlr->dbc, by_selector, &subscr, cmd))
+		return CTRL_CMD_ERROR;
+
+	cmd->reply = talloc_strdup(cmd, subscr.imsi);
+	return CTRL_CMD_REPLY;
+}
+
 CTRL_CMD_DEFINE(subscr_msisdn, "msisdn");
 static int verify_subscr_msisdn(struct ctrl_cmd *cmd, const char *value, void *data)
 {
@@ -492,8 +506,8 @@ static int get_subscr_aud2g(struct ctrl_cmd *cmd, void *data)
 	struct hlr_subscriber subscr;
 	struct hlr *hlr = data;
 	const char *by_selector = cmd->node;
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g_unused;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g_unused;
 	int rc;

 	if (!get_subscriber(hlr->dbc, by_selector, &subscr, cmd))
@@ -550,7 +564,7 @@ static int set_subscr_aud2g(struct ctrl_cmd *cmd, void *data)
 	}
 	if (strcmp(tok, "none") == 0) {
 		aud2g.algo = OSMO_AUTH_ALG_NONE;
-	} else if (!auth_algo_parse(tok, &aud2g.algo, &minlen, &maxlen)) {
+	} else if (!auth_algo_parse(tok, &aud2g.algo, &minlen, &maxlen, NULL, NULL)) {
 		cmd->reply = "Unknown auth algorithm.";
 		return CTRL_CMD_ERROR;
 	}
@@ -592,8 +606,8 @@ static int get_subscr_aud3g(struct ctrl_cmd *cmd, void *data)
 	struct hlr_subscriber subscr;
 	struct hlr *hlr = data;
 	const char *by_selector = cmd->node;
-	struct osmo_sub_auth_data aud2g_unused;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g_unused;
+	struct osmo_sub_auth_data2 aud3g;
 	int rc;

 	if (!get_subscriber(hlr->dbc, by_selector, &subscr, cmd))
@@ -618,9 +632,9 @@ static int get_subscr_aud3g(struct ctrl_cmd *cmd, void *data)
 	}

 	cmd->reply = talloc_asprintf(cmd, "%s,%s,%s,%s,%u", osmo_auth_alg_name(aud3g.algo),
-				     osmo_hexdump_nospc_c(cmd, aud3g.u.umts.k, sizeof(aud3g.u.umts.k)),
+				     osmo_hexdump_nospc_c(cmd, aud3g.u.umts.k, aud3g.u.umts.k_len),
 				     aud3g.u.umts.opc_is_op ? "OP" : "OPC",
-				     osmo_hexdump_nospc_c(cmd, aud3g.u.umts.opc, sizeof(aud3g.u.umts.opc)),
+				     osmo_hexdump_nospc_c(cmd, aud3g.u.umts.opc, aud3g.u.umts.opc_len),
 				     aud3g.u.umts.ind_bitlen);
 	return CTRL_CMD_REPLY;
 }
@@ -630,8 +644,8 @@ static int set_subscr_aud3g(struct ctrl_cmd *cmd, void *data)
 	struct hlr *hlr = data;
 	const char *by_selector = cmd->node;
 	char *tmp = NULL, *tok, *saveptr;
-	int minlen = 0;
-	int maxlen = 0;
+	int minlen = 0, minlen_opc = 0;
+	int maxlen = 0, maxlen_opc = 0;
 	struct sub_auth_data_str aud3g = {
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.u.umts = {
@@ -657,7 +671,7 @@ static int set_subscr_aud3g(struct ctrl_cmd *cmd, void *data)
 	}
 	if (strcmp(tok, "none") == 0) {
 		aud3g.algo = OSMO_AUTH_ALG_NONE;
-	} else if (!auth_algo_parse(tok, &aud3g.algo, &minlen, &maxlen)) {
+	} else if (!auth_algo_parse(tok, &aud3g.algo, &minlen, &maxlen, &minlen_opc, &maxlen_opc)) {
 		cmd->reply = "Unknown auth algorithm.";
 		return CTRL_CMD_ERROR;
 	}
@@ -699,7 +713,7 @@ static int set_subscr_aud3g(struct ctrl_cmd *cmd, void *data)
 		}

 		aud3g.u.umts.opc = tok;
-		if (!osmo_is_hexstr(aud3g.u.umts.opc, MILENAGE_KEY_LEN * 2, MILENAGE_KEY_LEN * 2, true)) {
+		if (!osmo_is_hexstr(aud3g.u.umts.opc, minlen_opc * 2, maxlen_opc * 2, true)) {
 			cmd->reply = talloc_asprintf(cmd, "Invalid OP/OPC.");
 			return CTRL_CMD_ERROR;
 		}
@@ -761,6 +775,7 @@ static int hlr_ctrl_cmds_install(void)
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_info_all);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_ps_enabled);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_cs_enabled);
+	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_imsi);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_msisdn);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_aud2g);
 	rc |= ctrl_cmd_install(CTRL_NODE_SUBSCR_BY, &cmd_subscr_aud3g);
--- a/src/db.c
+++ b/src/db.c
@@ -1,4 +1,4 @@
-/* (C) 2015 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2015-2023 by Harald Welte <laforge@gnumonks.org>
 *
 * All Rights Reserved
 *
@@ -28,7 +28,7 @@
 #include "db_bootstrap.h"

 /* This constant is currently duplicated in sql/hlr.sql and must be kept in sync! */
-#define CURRENT_SCHEMA_VERSION	6
+#define CURRENT_SCHEMA_VERSION	7

 #define SEL_COLUMNS \
 	"id," \
@@ -53,7 +53,7 @@
 static const char *stmt_sql[] = {
 	[DB_STMT_SEL_ALL] = "SELECT " SEL_COLUMNS " FROM subscriber;",
 	[DB_STMT_SEL_ALL_ORDER_LAST_SEEN] = "SELECT " SEL_COLUMNS " FROM subscriber "
-		"WHERE last_lu_seen IS NOT NULL ORDER BY last_lu_seen;",
+		"WHERE last_lu_seen IS NOT NULL AND last_lu_seen > datetime('now','-1 month') ORDER BY last_lu_seen;",
 	[DB_STMT_SEL_FILTER_MSISDN] = "SELECT " SEL_COLUMNS " FROM subscriber WHERE msisdn LIKE $search ORDER BY msisdn",
 	[DB_STMT_SEL_FILTER_IMSI] = "SELECT " SEL_COLUMNS " FROM subscriber WHERE imsi LIKE $search ORDER BY imsi",
 	[DB_STMT_SEL_FILTER_IMEI] = "SELECT " SEL_COLUMNS " FROM subscriber WHERE imei LIKE $search ORDER BY imei",
@@ -92,6 +92,10 @@ static const char *stmt_sql[] = {
 	[DB_STMT_SET_LAST_LU_SEEN] = "UPDATE subscriber SET last_lu_seen = datetime($val, 'unixepoch') WHERE id = $subscriber_id",
 	[DB_STMT_SET_LAST_LU_SEEN_PS] = "UPDATE subscriber SET last_lu_seen_ps = datetime($val, 'unixepoch') WHERE id = $subscriber_id",
 	[DB_STMT_EXISTS_BY_IMSI] = "SELECT 1 FROM subscriber WHERE imsi = $imsi",
+	[DB_STMT_EXISTS_AUTHORIZED_BY_IMSI] = "SELECT 1 FROM subscriber WHERE imsi = $imsi AND (nam_cs = 1 OR nam_ps = 1)",
+	[DB_STMT_IS_CREATED_ON_DEMAND_BY_IMSI] =
+		"SELECT 1 FROM subscriber WHERE imsi = $imsi AND length(msisdn) = $msisdn_len"
+		" AND nam_cs = 0 AND nam_ps = 0 AND vlr_number IS NULL",
 	[DB_STMT_EXISTS_BY_MSISDN] = "SELECT 1 FROM subscriber WHERE msisdn = $msisdn",
 	[DB_STMT_IND_ADD] = "INSERT INTO ind (vlr) VALUES ($vlr)",
 	[DB_STMT_IND_SELECT] = "SELECT ind FROM ind WHERE vlr = $vlr",
@@ -235,7 +239,7 @@ void db_close(struct db_context *dbc)
 	talloc_free(dbc);
 }

-static int db_run_statements(struct db_context *dbc, const char **statements, size_t statements_count)
+static int db_run_statements(struct db_context *dbc, const char * const *statements, size_t statements_count)
 {
 	int rc = 0;
 	int i;
@@ -308,7 +312,7 @@ static int
 db_upgrade_v1(struct db_context *dbc)
 {
 	int rc;
-	const char *statements[] = {
+	const char * const statements[] = {
 		"ALTER TABLE subscriber ADD COLUMN last_lu_seen TIMESTAMP default NULL",
 		"PRAGMA user_version = 1",
 	};
@@ -324,7 +328,7 @@ db_upgrade_v1(struct db_context *dbc)
 static int db_upgrade_v2(struct db_context *dbc)
 {
 	int rc;
-	const char *statements[] = {
+	const char * const statements[] = {
 		"ALTER TABLE subscriber ADD COLUMN imei VARCHAR(14)",
 		"PRAGMA user_version = 2",
 	};
@@ -437,7 +441,7 @@ static int db_upgrade_v3(struct db_context *dbc)
 	"ms_purged_ps," \
 	"last_lu_seen"

-	const char *statements[] = {
+	const char * const statements[] = {
 		"BEGIN TRANSACTION",
 		"CREATE TEMPORARY TABLE subscriber_backup" SUBSCR_V3_CREATE,
 		"INSERT INTO subscriber_backup SELECT " SUBSCR_V2_COLUMN_NAMES " FROM subscriber",
@@ -460,7 +464,7 @@ static int db_upgrade_v3(struct db_context *dbc)
 static int db_upgrade_v4(struct db_context *dbc)
 {
 	int rc;
-	const char *statements[] = {
+	const char * const statements[] = {
 		"ALTER TABLE subscriber ADD COLUMN last_lu_seen_ps TIMESTAMP default NULL",
 		"PRAGMA user_version = 4",
 	};
@@ -476,7 +480,7 @@ static int db_upgrade_v4(struct db_context *dbc)
 static int db_upgrade_v5(struct db_context *dbc)
 {
 	int rc;
-	const char *statements[] = {
+	const char * const statements[] = {
 		"ALTER TABLE subscriber ADD COLUMN vlr_via_proxy VARCHAR",
 		"ALTER TABLE subscriber ADD COLUMN sgsn_via_proxy VARCHAR",
 		"PRAGMA user_version = 5",
@@ -493,7 +497,7 @@ static int db_upgrade_v5(struct db_context *dbc)
 static int db_upgrade_v6(struct db_context *dbc)
 {
 	int rc;
-	const char *statements[] = {
+	const char * const statements[] = {
 		"CREATE TABLE ind (\n"
 		"	-- 3G auth IND pool to be used for this VLR\n"
 		"	ind     INTEGER PRIMARY KEY,\n"
@@ -513,6 +517,46 @@ static int db_upgrade_v6(struct db_context *dbc)
 	return rc;
 }

+static int db_upgrade_v7(struct db_context *dbc)
+{
+	int rc;
+	/* SQLite doesn't allow us to change the column type in-place, so we
+	 * first rename the old table, create a new table and then copy
+	 * the data over before deleting the old table */
+#define CREATE_AUC_3G_V7	\
+"CREATE TABLE auc_3g (\n" \
+"	subscriber_id	INTEGER PRIMARY KEY,	-- subscriber.id\n" \
+"	algo_id_3g	INTEGER NOT NULL,	-- enum osmo_auth_algo value\n" \
+"	k		VARCHAR(64) NOT NULL,	-- hex string: subscriber's secret key (128/256bit)\n" \
+"	op		VARCHAR(64),		-- hex string: operator's secret key (128/256bit)\n" \
+"	opc		VARCHAR(64),		-- hex string: derived from OP and K (128/256bit)\n" \
+"	sqn		INTEGER NOT NULL DEFAULT 0,	-- sequence number of key usage\n" \
+"	-- nr of index bits at lower SQN end\n" \
+"	ind_bitlen	INTEGER NOT NULL DEFAULT 5\n" \
+");"
+	const char * const statements[] = {
+		"BEGIN TRANSACTION",
+		/* rename old table */
+		"ALTER TABLE auc_3g RENAME TO old_auc_3g",
+		/* create new table */
+		CREATE_AUC_3G_V7,
+		/* copy over old data */
+		"INSERT INTO auc_3g SELECT subscriber_id, algo_id_3g, k, op, opc,sqn, ind_bitlen FROM old_auc_3g",
+		/* delete old table */
+		"DROP TABLE old_auc_3g",
+		/* update user_version */
+		"PRAGMA user_version = 7",
+		"COMMIT",
+	};
+
+	rc = db_run_statements(dbc, statements, ARRAY_SIZE(statements));
+	if (rc != SQLITE_DONE) {
+		LOGP(DDB, LOGL_ERROR, "Unable to update HLR database schema to version 7\n");
+		return rc;
+	}
+	return rc;
+}
+
 typedef int (*db_upgrade_func_t)(struct db_context *dbc);
 static db_upgrade_func_t db_upgrade_path[] = {
 	db_upgrade_v1,
@@ -521,6 +565,7 @@ static db_upgrade_func_t db_upgrade_path[] = {
 	db_upgrade_v4,
 	db_upgrade_v5,
 	db_upgrade_v6,
+	db_upgrade_v7,
 };

 static int db_get_user_version(struct db_context *dbc)
--- a/src/db_auc.c
+++ b/src/db_auc.c
@@ -1,4 +1,4 @@
-/* (C) 2015 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2015-2023 by Harald Welte <laforge@gnumonks.org>
 *
 * All Rights Reserved
 *
@@ -74,9 +74,9 @@ out:
 }

 /* hexparse a specific column of a sqlite prepared statement into dst (with length check)
- * returns 0 for success, -EIO on error */
-static int hexparse_stmt(uint8_t *dst, size_t dst_len, sqlite3_stmt *stmt, int col, const char *col_name,
-			 const char *imsi)
+ * returns byte length in case of success, -EIO on error */
+static int hexparse_stmt(uint8_t *dst, size_t dst_len_min, size_t dst_len_max, sqlite3_stmt *stmt,
+			 int col, const char *col_name, const char *imsi)
 {
 	const uint8_t *text;
 	size_t col_len;
@@ -84,9 +84,15 @@ static int hexparse_stmt(uint8_t *dst, size_t dst_len, sqlite3_stmt *stmt, int c
 	/* Bytes are stored as hex strings in database, hence divide length by two */
 	col_len = sqlite3_column_bytes(stmt, col) / 2;

-	if (col_len != dst_len) {
-		LOGAUC(imsi, LOGL_ERROR, "Error reading %s, expected length %lu but has length %lu\n", col_name,
-		       dst_len, col_len);
+	if (col_len < dst_len_min) {
+		LOGAUC(imsi, LOGL_ERROR, "Error reading %s, expected min length %lu but has length %lu\n", col_name,
+		       dst_len_min, col_len);
+		return -EIO;
+	}
+
+	if (col_len > dst_len_max) {
+		LOGAUC(imsi, LOGL_ERROR, "Error reading %s, expected max length %lu but has length %lu\n", col_name,
+		       dst_len_max, col_len);
 		return -EIO;
 	}

@@ -96,10 +102,10 @@ static int hexparse_stmt(uint8_t *dst, size_t dst_len, sqlite3_stmt *stmt, int c
 		return -EIO;
 	}

-	if (osmo_hexparse((void *)text, dst, dst_len) != col_len)
+	if (osmo_hexparse((void *)text, dst, dst_len_max) != col_len)
 		return -EINVAL;

-	return 0;
+	return col_len;
 }

 /* obtain the authentication data for a given imsi
@@ -107,8 +113,8 @@ static int hexparse_stmt(uint8_t *dst, size_t dst_len, sqlite3_stmt *stmt, int c
 * -ENOENT if the IMSI is not known, -ENOKEY if the IMSI is known but has no auth data,
 * -EIO on db failure */
 int db_get_auth_data(struct db_context *dbc, const char *imsi,
-		     struct osmo_sub_auth_data *aud2g,
-		     struct osmo_sub_auth_data *aud3g,
+		     struct osmo_sub_auth_data2 *aud2g,
+		     struct osmo_sub_auth_data2 *aud3g,
 		     int64_t *subscr_id)
 {
 	sqlite3_stmt *stmt = dbc->stmt[DB_STMT_AUC_BY_IMSI];
@@ -142,7 +148,8 @@ int db_get_auth_data(struct db_context *dbc, const char *imsi,
 	/* obtain result values using sqlite3_column_*() */
 	if (sqlite3_column_type(stmt, 1) == SQLITE_INTEGER) {
 		/* we do have some 2G authentication data */
-		if (hexparse_stmt(aud2g->u.gsm.ki, sizeof(aud2g->u.gsm.ki), stmt, 2, "Ki", imsi))
+		if (hexparse_stmt(aud2g->u.gsm.ki, sizeof(aud2g->u.gsm.ki), sizeof(aud2g->u.gsm.ki),
+				  stmt, 2, "Ki", imsi) < 0)
 			goto end_2g;
 		aud2g->algo = sqlite3_column_int(stmt, 1);
 		aud2g->type = OSMO_AUTH_TYPE_GSM;
@@ -151,24 +158,30 @@ int db_get_auth_data(struct db_context *dbc, const char *imsi,
 end_2g:
 	if (sqlite3_column_type(stmt, 3) == SQLITE_INTEGER) {
 		/* we do have some 3G authentication data */
-		if (hexparse_stmt(aud3g->u.umts.k, sizeof(aud3g->u.umts.k), stmt, 4, "K", imsi)) {
+		rc = hexparse_stmt(aud3g->u.umts.k, 16, sizeof(aud3g->u.umts.k), stmt, 4, "K", imsi);
+		if (rc < 0) {
 			ret = -EIO;
 			goto out;
 		}
+		aud3g->u.umts.k_len = rc;
 		aud3g->algo = sqlite3_column_int(stmt, 3);

 		/* UMTS Subscribers can have either OP or OPC */
 		if (sqlite3_column_text(stmt, 5)) {
-			if (hexparse_stmt(aud3g->u.umts.opc, sizeof(aud3g->u.umts.opc), stmt, 5, "OP", imsi)) {
+			rc = hexparse_stmt(aud3g->u.umts.opc, 16, sizeof(aud3g->u.umts.opc), stmt, 5, "OP", imsi);
+			if (rc < 0) {
 				ret = -EIO;
 				goto out;
 			}
+			aud3g->u.umts.opc_len = rc;
 			aud3g->u.umts.opc_is_op = 1;
 		} else {
-			if (hexparse_stmt(aud3g->u.umts.opc, sizeof(aud3g->u.umts.opc), stmt, 6, "OPC", imsi)) {
+			rc = hexparse_stmt(aud3g->u.umts.opc, 16, sizeof(aud3g->u.umts.opc), stmt, 6, "OPC", imsi);
+			if (rc < 0) {
 				ret = -EIO;
 				goto out;
 			}
+			aud3g->u.umts.opc_len = rc;
 			aud3g->u.umts.opc_is_op = 0;
 		}
 		aud3g->u.umts.sqn = sqlite3_column_int64(stmt, 7);
@@ -194,7 +207,7 @@ int db_get_auc(struct db_context *dbc, const char *imsi,
 	       unsigned int num_vec, const uint8_t *rand_auts,
 	       const uint8_t *auts, bool separation_bit)
 {
-	struct osmo_sub_auth_data aud2g, aud3g;
+	struct osmo_sub_auth_data2 aud2g, aud3g;
 	int64_t subscr_id;
 	int ret = 0;
 	int rc;
--- a/src/db_hlr.c
+++ b/src/db_hlr.c
@@ -1,4 +1,4 @@
-/* (C) 2015 by Harald Welte <laforge@gnumonks.org>
+/* (C) 2015-2023 by Harald Welte <laforge@gnumonks.org>
 *
 * All Rights Reserved
 *
@@ -238,8 +238,9 @@ int db_subscr_update_aud_by_id(struct db_context *dbc, int64_t subscr_id,
 		case OSMO_AUTH_ALG_COMP128v1:
 		case OSMO_AUTH_ALG_COMP128v2:
 		case OSMO_AUTH_ALG_COMP128v3:
-		case OSMO_AUTH_ALG_XOR:
+		case OSMO_AUTH_ALG_XOR_2G:
 			break;
+		case OSMO_AUTH_ALG_XOR_3G:
 		case OSMO_AUTH_ALG_MILENAGE:
 			LOGP(DAUC, LOGL_ERROR, "Cannot update auth tokens:"
 			     " auth algo not suited for 2G: %s\n",
@@ -267,11 +268,12 @@ int db_subscr_update_aud_by_id(struct db_context *dbc, int64_t subscr_id,
 		switch (aud->algo) {
 		case OSMO_AUTH_ALG_NONE:
 		case OSMO_AUTH_ALG_MILENAGE:
-		case OSMO_AUTH_ALG_XOR:
+		case OSMO_AUTH_ALG_XOR_3G:
 			break;
 		case OSMO_AUTH_ALG_COMP128v1:
 		case OSMO_AUTH_ALG_COMP128v2:
 		case OSMO_AUTH_ALG_COMP128v3:
+		case OSMO_AUTH_ALG_XOR_2G:
 			LOGP(DAUC, LOGL_ERROR, "Cannot update auth tokens:"
 			     " auth algo not suited for 3G: %s\n",
 			     osmo_auth_alg_name(aud->algo));
@@ -284,12 +286,12 @@ int db_subscr_update_aud_by_id(struct db_context *dbc, int64_t subscr_id,

 		if (aud->algo == OSMO_AUTH_ALG_NONE)
 			break;
-		if (!osmo_is_hexstr(aud->u.umts.k, 32, 32, true)) {
+		if (!osmo_is_hexstr(aud->u.umts.k, 32, 64, true)) {
 			LOGP(DAUC, LOGL_ERROR, "Cannot update auth tokens:"
 			     " Invalid K: '%s'\n", aud->u.umts.k);
 			return -EINVAL;
 		}
-		if (!osmo_is_hexstr(aud->u.umts.opc, 32, 32, true)) {
+		if (!osmo_is_hexstr(aud->u.umts.opc, 32, 64, true)) {
 			LOGP(DAUC, LOGL_ERROR, "Cannot update auth tokens:"
 			     " Invalid OP/OPC: '%s'\n", aud->u.umts.opc);
 			return -EINVAL;
@@ -553,6 +555,59 @@ int db_subscr_exists_by_imsi(struct db_context *dbc, const char *imsi) {
 	return rc;
 }

+/*! Check if a subscriber exists and has CS or PS service in the HLR database.
+ * \param[in, out] dbc  database context.
+ * \param[in] imsi  ASCII string of IMSI digits.
+ * \returns 0 if exists & authorized, -ENOENT if not, -EIO on database error.
+ */
+int db_subscr_authorized_by_imsi(struct db_context *dbc, const char *imsi) {
+	sqlite3_stmt *stmt = dbc->stmt[DB_STMT_EXISTS_AUTHORIZED_BY_IMSI];
+	const char *err;
+	int rc;
+
+	if (!db_bind_text(stmt, NULL, imsi))
+		return -EIO;
+
+	rc = sqlite3_step(stmt);
+	db_remove_reset(stmt);
+	if (rc == SQLITE_ROW)
+		return 0; /* exists */
+	if (rc == SQLITE_DONE)
+		return -ENOENT; /* does not exist */
+
+	err = sqlite3_errmsg(dbc->db);
+	LOGP(DAUC, LOGL_ERROR, "Failed to check for authorized subscriber by IMSI='%s': %s\n", imsi, err);
+	return rc;
+}
+
+/*! Check if a subscriber exists and has ever been attached
+ * \param[in, out] dbc  database context.
+ * \param[in] imsi  ASCII string of IMSI digits.
+ * \returns 0 if has vlr_number, -ENOENT if not, -EIO on database error.
+ */
+int db_subscr_is_created_on_demand_by_imsi(struct db_context *dbc, const char *imsi, unsigned int msisdn_len) {
+	sqlite3_stmt *stmt = dbc->stmt[DB_STMT_IS_CREATED_ON_DEMAND_BY_IMSI];
+	const char *err;
+	int rc;
+
+	if (!db_bind_text(stmt, "$imsi", imsi))
+		return -EIO;
+
+	if (!db_bind_int(stmt, "$msisdn_len", msisdn_len))
+		return -EIO;
+
+	rc = sqlite3_step(stmt);
+	db_remove_reset(stmt);
+	if (rc == SQLITE_ROW)
+		return 0; /* exists */
+	if (rc == SQLITE_DONE)
+		return -ENOENT; /* does not exist */
+
+	err = sqlite3_errmsg(dbc->db);
+	LOGP(DAUC, LOGL_ERROR, "Failed to check for on demand subscriber by IMSI='%s': %s\n", imsi, err);
+	return rc;
+}
+
 /*! Retrieve subscriber data from the HLR database.
 * \param[in,out] dbc  database context.
 * \param[in] imsi  ASCII string of IMSI digits.
@@ -698,9 +753,12 @@ int db_subscrs_get(struct db_context *dbc, const char *filter_type, const char *
 		copy_sqlite3_text_to_buf(subscr.imei, stmt, 3);
 		subscr.nam_cs = sqlite3_column_int(stmt, 9);
 		subscr.nam_ps = sqlite3_column_int(stmt, 10);
-		if (show_ls)
+		if (show_ls) {
 			parse_last_lu_seen(&subscr.last_lu_seen, (const char *)sqlite3_column_text(stmt, 14),
 					   subscr.imsi, "CS");
+			copy_sqlite3_text_to_buf(subscr.vlr_number, stmt, 4);
+		}
+
 		get_cb(&subscr, data);
 		rc = sqlite3_step(stmt);
 		(*count)++;
--- a/src/dgsm.c
+++ b/src/dgsm.c
@@ -58,6 +58,12 @@ static void resolve_hlr_result_cb(struct osmo_mslookup_client *client,
 	if (result->rc != OSMO_MSLOOKUP_RC_RESULT) {
 		LOG_DGSM(query->id.imsi, LOGL_ERROR, "Failed to resolve remote HLR: %s\n",
 			 osmo_mslookup_result_name_c(OTC_SELECT, query, result));
+		if (g_hlr->mslookup.client.subscr_create_on_demand_fallback &&
+		    db_subscr_exists_by_imsi(g_hlr->dbc, query->id.imsi) != 0) {
+			struct osmo_gsup_req *req = proxy_deferred_gsup_req_get_by_imsi(proxy, query->id.imsi);
+			if (req && req->gsup.message_type == OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST)
+				dgsm_fallback_to_hlr(req);
+		}
 		proxy_subscr_del(proxy, query->id.imsi);
 		return;
 	}
@@ -91,8 +97,17 @@ bool dgsm_check_forward_gsup_msg(struct osmo_gsup_req *req)
 	struct osmo_mslookup_query_handling handling;
 	uint32_t request_handle;

-	/* If the IMSI is known in the local HLR, then we won't proxy. */
-	if (db_subscr_exists_by_imsi(g_hlr->dbc, req->gsup.imsi) == 0)
+	/* If the IMSI is authorized in the local HLR, then we won't proxy */
+	if (db_subscr_authorized_by_imsi(g_hlr->dbc, req->gsup.imsi) == 0)
+		return false;
+	/* unless configuration tells us to do otherwise. */
+	if (!g_hlr->mslookup.ignore_created_on_demand && !g_hlr->mslookup.auth_imsi_only &&
+	    db_subscr_exists_by_imsi(g_hlr->dbc, req->gsup.imsi) == 0)
+		return false;
+
+	if (!g_hlr->mslookup.auth_imsi_only && !(g_hlr->mslookup.ignore_created_on_demand &&
+	    db_subscr_is_created_on_demand_by_imsi(g_hlr->dbc, req->gsup.imsi,
+						   g_hlr->subscr_create_on_demand.rand_msisdn_len) == 0))
 		return false;

 	/* Are we already forwarding this IMSI to a remote HLR? */
@@ -168,7 +183,7 @@ void dgsm_init(void *ctx)
 	dgsm_ctx = talloc_named_const(ctx, 0, "dgsm");
 	INIT_LLIST_HEAD(&g_hlr->mslookup.server.local_site_services);

-	g_hlr->mslookup.server.local_attach_max_age = 60 * 60;
+	g_hlr->mslookup.server.local_attach_max_age = OSMO_DGSM_DEFAULT_LOCAL_ATTACH_MAX_AGE;

 	g_hlr->mslookup.client.result_timeout_milliseconds = OSMO_DGSM_DEFAULT_RESULT_TIMEOUT_MS;

--- a/src/dgsm_vty.c
+++ b/src/dgsm_vty.c
@@ -22,9 +22,11 @@
 #include <osmocom/mslookup/mslookup_client_mdns.h>
 #include <osmocom/mslookup/mdns.h>
 #include <osmocom/hlr/hlr_vty.h>
+#include <osmocom/hlr/proxy.h>
 #include <osmocom/hlr/mslookup_server.h>
 #include <osmocom/hlr/mslookup_server_mdns.h>
 #include <osmocom/gsupclient/cni_peer_id.h>
+#include <osmocom/gsm/gsm23003.h>

 struct cmd_node mslookup_node = {
 	MSLOOKUP_NODE,
@@ -188,6 +190,53 @@ DEFUN(cfg_mslookup_server_no_mdns_bind,
 	return CMD_SUCCESS;
 }

+DEFUN(cfg_mslookup_server_max_age,
+      cfg_mslookup_server_max_age_cmd,
+      "max-age <1-21600>",
+      "How old can the Last Location Update be for the mslookup server to respond\n"
+      "max age in seconds\n")
+{
+	uint32_t val = atol(argv[0]);
+	g_hlr->mslookup.server.local_attach_max_age = val;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mslookup_auth_imsi_only,
+      cfg_mslookup_auth_imsi_only_cmd,
+      "authorized-imsi-only",
+      "On local GSUP, use mslookup ignoring local HLR + don't answer queries for IMSIs without PS or CS network access mode")
+{
+	g_hlr->mslookup.auth_imsi_only = true;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mslookup_no_auth_imsi_only,
+      cfg_mslookup_no_auth_imsi_only_cmd,
+      "no authorized-imsi-only",
+      NO_STR "Answer Local GSUP/mDNS queries for any IMSI in the local HLR database")
+{
+	g_hlr->mslookup.auth_imsi_only = false;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mslookup_cod,
+      cfg_mslookup_cod_cmd,
+      "ignore-created-on-demand",
+      "Ignore IMSIs that were created-on-demand")
+{
+	g_hlr->mslookup.ignore_created_on_demand = true;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mslookup_no_cod,
+      cfg_mslookup_no_cod_cmd,
+      "no ignore-created-on-demand",
+      NO_STR "Answer mslookup and local GSUP for created on demand IMSIs")
+{
+	g_hlr->mslookup.ignore_created_on_demand = false;
+	return CMD_SUCCESS;
+}
+
 struct cmd_node mslookup_server_msc_node = {
 	MSLOOKUP_SERVER_MSC_NODE,
 	"%s(config-mslookup-server-msc)# ",
@@ -350,6 +399,24 @@ DEFUN(cfg_mslookup_no_client,
 	return CMD_SUCCESS;
 }

+DEFUN(cfg_mslookup_client_subscr_cod_fallback,
+      cfg_mslookup_client_subscr_cod_fallback_cmd,
+      "create-on-demand-fallback",
+      "If the msclient does not get a response from mDNS, proceed according to this HLR subscriber-create-on-demand config")
+{
+	g_hlr->mslookup.client.subscr_create_on_demand_fallback = true;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_mslookup_client_no_subscr_cod_fallback,
+      cfg_mslookup_client_no_subscr_cod_fallback_cmd,
+      "no create-on-demand-fallback",
+      NO_STR "Return IMSI UNKNOWN if the mslookup client does not receive a response from mDNS")
+{
+	g_hlr->mslookup.client.subscr_create_on_demand_fallback = false;
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_mslookup_client_timeout,
      cfg_mslookup_client_timeout_cmd,
      "timeout <1-100000>",
@@ -421,6 +488,11 @@ int config_write_mslookup(struct vty *vty)

 	vty_out(vty, "mslookup%s", VTY_NEWLINE);

+	if (g_hlr->mslookup.auth_imsi_only)
+			vty_out(vty, " authorized-imsi-only%s", VTY_NEWLINE);
+	if (g_hlr->mslookup.ignore_created_on_demand)
+			vty_out(vty, " ignore-created-on-demand%s", VTY_NEWLINE);
+
 	if (g_hlr->mslookup.server.enable || !llist_empty(&g_hlr->mslookup.server.local_site_services)) {
 		struct mslookup_server_msc_cfg *msc;

@@ -450,6 +522,9 @@ int config_write_mslookup(struct vty *vty)
 			vty_out(vty, "  msc ipa-name %s%s", osmo_ipa_name_to_str(&msc->name), VTY_NEWLINE);
 			config_write_msc_services(vty, "   ", msc);
 		}
+		if (g_hlr->mslookup.server.local_attach_max_age != OSMO_DGSM_DEFAULT_LOCAL_ATTACH_MAX_AGE)
+			vty_out(vty, "  max-age %u%s",
+				g_hlr->mslookup.server.local_attach_max_age, VTY_NEWLINE);

 		/* If the server is disabled, still output the above to not lose the service config. */
 		if (!g_hlr->mslookup.server.enable)
@@ -479,6 +554,8 @@ int config_write_mslookup(struct vty *vty)
 			vty_out(vty, "  timeout %u%s",
 				g_hlr->mslookup.client.result_timeout_milliseconds,
 				VTY_NEWLINE);
+		if (g_hlr->mslookup.client.subscr_create_on_demand_fallback)
+			vty_out(vty, "  create-on-demand-fallback%s", VTY_NEWLINE);
 	}

 	return CMD_SUCCESS;
@@ -545,11 +622,110 @@ DEFUN(do_mslookup_show_services,
 	return CMD_SUCCESS;
 }

+struct proxy_subscr_listentry {
+	struct llist_head entry;
+	timestamp_t last_update;
+	struct proxy_subscr data;
+};
+
+struct proxy_pending_gsup_req {
+	struct llist_head entry;
+	struct osmo_gsup_req *req;
+	timestamp_t received_at;
+};
+
+static void write_one_proxy(struct vty *vty, struct proxy_subscr_listentry *e)
+{
+	struct proxy_subscr p = e->data;
+	uint32_t age;
+
+	vty_out(vty, "%-12s  %-16s  %-12s:%-4u     ",
+		strlen(p.msisdn) == 0 ? "Unknown" : p.msisdn,
+		strlen(p.imsi) == 0 ? "Unknown" : p.imsi,
+		p.remote_hlr_addr.ip ? p.remote_hlr_addr.ip : "Unknown",
+		p.remote_hlr_addr.port);
+
+	if (!timestamp_age(&e->last_update, &age)) {
+		vty_out(vty, "Invalid%s", VTY_NEWLINE);
+		return;
+	}
+
+#define UNIT_AGO(UNITNAME, UNITVAL) \
+		if (age >= (UNITVAL)) { \
+			vty_out(vty, "%u%s", age / (UNITVAL), UNITNAME); \
+			age = age % (UNITVAL); \
+		}
+		UNIT_AGO("d", 60*60*24);
+		UNIT_AGO("h", 60*60);
+		UNIT_AGO("m", 60);
+		UNIT_AGO("s", 1);
+		vty_out(vty, "%s", VTY_NEWLINE);
+#undef UNIT_AGO
+}
+
+static void write_one_proxy_request(struct vty *vty, struct osmo_gsup_req *r)
+{
+	vty_out(vty, "IMSI: %s TYPE: %s%s",
+		r->gsup.imsi,
+		osmo_gsup_message_type_name(r->gsup.message_type),
+		VTY_NEWLINE);
+}
+
+DEFUN(do_proxy_del_sub,
+      do_proxy_del_sub_cmd,
+      "proxy subscriber-delete [IMSI]",
+      "Subscriber Proxy \n"
+      "Delete by IMSI\n"
+      "IMSI of subscriber to delete from the Proxy"
+      )
+{
+	const char *imsi = argv[0];
+	if (!osmo_imsi_str_valid(imsi)) {
+		vty_out(vty, "%% Not a valid IMSI: %s%s", imsi, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (proxy_subscr_del(g_hlr->gs->proxy, imsi) == 0)
+		return CMD_SUCCESS;
+	vty_out(vty, "%% Unable to delete a Proxy for: %s%s", imsi, VTY_NEWLINE);
+	return CMD_WARNING;
+}
+
+DEFUN(do_proxy_show,
+      do_proxy_show_cmd,
+      "show proxy",
+      SHOW_STR "Proxy Entries\n")
+{
+	struct proxy_subscr_listentry *e;
+	struct proxy_pending_gsup_req *p;
+	unsigned int count = 0;
+
+	vty_out(vty, "MSISDN        IMSI              HLR                   AGE%s", VTY_NEWLINE);
+	vty_out(vty, "------------  ----------------  --------------------  ------%s", VTY_NEWLINE);
+	llist_for_each_entry(e, &g_hlr->gs->proxy->subscr_list, entry) {
+		count++;
+		write_one_proxy(vty, e);
+	}
+
+	vty_out(vty, "%s%s",
+		(count == 0) ? "% No proxy subscribers" : "", VTY_NEWLINE);
+	if (!llist_count(&g_hlr->gs->proxy->pending_gsup_reqs))
+		return CMD_SUCCESS;
+	vty_out(vty, "In-flight Proxy Subscribers Requests:%s", VTY_NEWLINE);
+	llist_for_each_entry(p, &g_hlr->gs->proxy->pending_gsup_reqs, entry) {
+		write_one_proxy_request(vty, p->req);
+	}
+	return CMD_SUCCESS;
+}
+
 void dgsm_vty_init(void)
 {
 	install_element(CONFIG_NODE, &cfg_mslookup_cmd);

 	install_node(&mslookup_node, config_write_mslookup);
+	install_element(MSLOOKUP_NODE, &cfg_mslookup_auth_imsi_only_cmd);
+	install_element(MSLOOKUP_NODE, &cfg_mslookup_no_auth_imsi_only_cmd);
+	install_element(MSLOOKUP_NODE, &cfg_mslookup_cod_cmd);
+	install_element(MSLOOKUP_NODE, &cfg_mslookup_no_cod_cmd);
 	install_element(MSLOOKUP_NODE, &cfg_mslookup_mdns_cmd);
 	install_element(MSLOOKUP_NODE, &cfg_mslookup_mdns_domain_suffix_cmd);
 	install_element(MSLOOKUP_NODE, &cfg_mslookup_no_mdns_cmd);
@@ -563,6 +739,7 @@ void dgsm_vty_init(void)
 	install_element(MSLOOKUP_SERVER_NODE, &cfg_mslookup_server_msc_service_cmd);
 	install_element(MSLOOKUP_SERVER_NODE, &cfg_mslookup_server_msc_no_service_cmd);
 	install_element(MSLOOKUP_SERVER_NODE, &cfg_mslookup_server_msc_no_service_addr_cmd);
+	install_element(MSLOOKUP_SERVER_NODE, &cfg_mslookup_server_max_age_cmd);
 	install_element(MSLOOKUP_SERVER_NODE, &cfg_mslookup_server_msc_cmd);

 	install_node(&mslookup_server_msc_node, NULL);
@@ -573,6 +750,8 @@ void dgsm_vty_init(void)
 	install_element(MSLOOKUP_NODE, &cfg_mslookup_client_cmd);
 	install_element(MSLOOKUP_NODE, &cfg_mslookup_no_client_cmd);
 	install_node(&mslookup_client_node, NULL);
+	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_subscr_cod_fallback_cmd);
+	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_no_subscr_cod_fallback_cmd);
 	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_timeout_cmd);
 	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_mdns_bind_cmd);
 	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_mdns_domain_suffix_cmd);
@@ -581,4 +760,6 @@ void dgsm_vty_init(void)
 	install_element(MSLOOKUP_CLIENT_NODE, &cfg_mslookup_client_no_gateway_proxy_cmd);

 	install_element_ve(&do_mslookup_show_services_cmd);
+	install_element_ve(&do_proxy_show_cmd);
+	install_element_ve(&do_proxy_del_sub_cmd);
 }
--- a/src/gsup_server.c
+++ b/src/gsup_server.c
@@ -32,6 +32,7 @@

 #include <osmocom/hlr/gsup_server.h>
 #include <osmocom/hlr/gsup_router.h>
+#include <osmocom/hlr/hlr.h>

 #define LOG_GSUP_CONN(conn, level, fmt, args...) \
 	LOGP(DLGSUP, level, "GSUP peer %s: " fmt, \
@@ -179,11 +180,9 @@ static int osmo_gsup_server_read_cb(struct ipa_server_conn *conn,

 	if (hh->proto == IPAC_PROTO_IPACCESS) {
 		rc = ipa_server_conn_ccm(conn, msg);
-		if (rc < 0) {
-			/* conn is already invalid here! */
-			return -1;
-		}
 		msgb_free(msg);
+		if (rc < 0) /* conn is already invalid here! */
+			return -1;
 		return 0;
 	}

@@ -446,19 +445,16 @@ int osmo_gsup_configure_wildcard_apn(struct osmo_gsup_message *gsup,
 * \param[out] gsup  The gsup message to populate.
 * \param[in] imsi  The subscriber's IMSI.
 * \param[in] msisdn The subscriber's MSISDN.
- * \param[out] msisdn_enc A buffer large enough to store the MSISDN in encoded form.
- * \param[in] msisdn_enc_size Size of the buffer (must be >= OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN).
- * \param[out] apn_buf A buffer large enough to store an APN (required if cn_domain is OSMO_GSUP_CN_DOMAIN_PS).
- * \param[in] apn_buf_size Size of APN buffer (must be >= APN_MAXLEN).
 * \param[in] cn_domain The CN Domain of the subscriber connection.
+ * \param[in] talloc_ctx To allocation memory for dynamic fields (msisdn, apn) in the gsup field
 * \returns 0 on success, and negative on error.
 */
 int osmo_gsup_create_insert_subscriber_data_msg(struct osmo_gsup_message *gsup, const char *imsi, const char *msisdn,
-						uint8_t *msisdn_enc, size_t msisdn_enc_size,
-						uint8_t *apn_buf, size_t apn_buf_size,
-						enum osmo_gsup_cn_domain cn_domain)
+						enum osmo_gsup_cn_domain cn_domain,
+						void *talloc_ctx)
 {
 	int len;
+	uint8_t *msisdn_buf = talloc_size(talloc_ctx, OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN);

 	OSMO_ASSERT(gsup);
 	*gsup = (struct osmo_gsup_message){
@@ -467,27 +463,29 @@ int osmo_gsup_create_insert_subscriber_data_msg(struct osmo_gsup_message *gsup,

 	osmo_strlcpy(gsup->imsi, imsi, sizeof(gsup->imsi));

-	if (msisdn_enc_size < OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN)
-		return -ENOSPC;
-
-	OSMO_ASSERT(msisdn_enc);
-	len = gsm48_encode_bcd_number(msisdn_enc, msisdn_enc_size, 0, msisdn);
+	len = gsm48_encode_bcd_number(msisdn_buf, OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN, 0, msisdn);
 	if (len < 1) {
 		LOGP(DLGSUP, LOGL_ERROR, "%s: Error: cannot encode MSISDN '%s'\n", imsi, msisdn);
 		return -ENOSPC;
 	}
-	gsup->msisdn_enc = msisdn_enc;
+	gsup->msisdn_enc = msisdn_buf;
 	gsup->msisdn_enc_len = len;

 	#pragma message "FIXME: deal with encoding the following data: gsup.hlr_enc"

 	gsup->cn_domain = cn_domain;
 	if (gsup->cn_domain == OSMO_GSUP_CN_DOMAIN_PS) {
-		OSMO_ASSERT(apn_buf_size >= APN_MAXLEN);
-		OSMO_ASSERT(apn_buf);
-		/* FIXME: PDP infos - use more fine-grained access control
-		   instead of wildcard APN */
-		osmo_gsup_configure_wildcard_apn(gsup, apn_buf, apn_buf_size);
+		if (g_hlr->ps.pdp_profile.enabled) {
+			OSMO_ASSERT(g_hlr->ps.pdp_profile.num_pdp_infos <= ARRAY_SIZE(g_hlr->ps.pdp_profile.pdp_infos));
+			OSMO_ASSERT(g_hlr->ps.pdp_profile.num_pdp_infos <= ARRAY_SIZE(gsup->pdp_infos));
+			memcpy(gsup->pdp_infos,
+			       g_hlr->ps.pdp_profile.pdp_infos,
+			       sizeof(struct osmo_gsup_pdp_info) * g_hlr->ps.pdp_profile.num_pdp_infos);
+			gsup->num_pdp_infos = g_hlr->ps.pdp_profile.num_pdp_infos;
+		} else {
+			uint8_t *apn_buf = talloc_size(talloc_ctx, APN_MAXLEN);
+			osmo_gsup_configure_wildcard_apn(gsup, apn_buf, APN_MAXLEN);
+		}
 	}

 	return 0;
--- a/src/hlr.c
+++ b/src/hlr.c
@@ -49,6 +49,7 @@
 #include <osmocom/hlr/rand.h>
 #include <osmocom/hlr/hlr_vty.h>
 #include <osmocom/hlr/hlr_ussd.h>
+#include <osmocom/hlr/hlr_sms.h>
 #include <osmocom/hlr/dgsm.h>
 #include <osmocom/hlr/proxy.h>
 #include <osmocom/hlr/lu_fsm.h>
@@ -85,8 +86,6 @@ osmo_hlr_subscriber_update_notify(struct hlr_subscriber *subscr)

 	llist_for_each_entry(co, &g_hlr->gs->clients, list) {
 		struct osmo_gsup_message gsup = { };
-		uint8_t msisdn_enc[OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN];
-		uint8_t apn[APN_MAXLEN];
 		struct msgb *msg_out;
 		uint8_t *peer;
 		int peer_len;
@@ -131,8 +130,7 @@ osmo_hlr_subscriber_update_notify(struct hlr_subscriber *subscr)
 		     subscr->imsi, cn_domain == OSMO_GSUP_CN_DOMAIN_PS ? "PS" : "CS",
 		     osmo_quote_str(peer_compare, -1));

-		if (osmo_gsup_create_insert_subscriber_data_msg(&gsup, subscr->imsi, subscr->msisdn, msisdn_enc,
-								sizeof(msisdn_enc), apn, sizeof(apn), cn_domain) != 0) {
+		if (osmo_gsup_create_insert_subscriber_data_msg(&gsup, subscr->imsi, subscr->msisdn, cn_domain, OTC_SELECT) != 0) {
 			LOGP(DLGSUP, LOGL_ERROR,
 			       "IMSI='%s': Cannot notify GSUP client; could not create gsup message "
 			       "for %s:%u\n", subscr->imsi,
@@ -206,23 +204,34 @@ static int subscr_create_on_demand(const char *imsi)
 {
 	char msisdn[GSM23003_MSISDN_MAX_DIGITS + 1];
 	int rc;
-	unsigned int rand_msisdn_len = g_hlr->subscr_create_on_demand_rand_msisdn_len;

-	if (!g_hlr->subscr_create_on_demand)
-		return -1;
 	if (db_subscr_exists_by_imsi(g_hlr->dbc, imsi) == 0)
 		return -1;
-	if (rand_msisdn_len && generate_new_msisdn(msisdn, imsi, rand_msisdn_len) != 0)
+
+	switch (g_hlr->subscr_create_on_demand.mode) {
+	case SUBSCR_COD_MODE_MSISDN_FROM_IMSI:
+		OSMO_STRLCPY_ARRAY(msisdn, imsi);
+		break;
+	case SUBSCR_COD_MODE_RAND_MSISDN:
+		if (generate_new_msisdn(msisdn, imsi, g_hlr->subscr_create_on_demand.rand_msisdn_len) != 0)
+			return -1;
+		break;
+	case SUBSCR_COD_MODE_NO_MSISDN:
+		msisdn[0] = '\0';
+		break;
+	case SUBSCR_COD_MODE_DISABLED:
+	default:
 		return -1;
+	}

 	LOGP(DMAIN, LOGL_INFO, "IMSI='%s': Creating subscriber on demand\n", imsi);
-	rc = db_subscr_create(g_hlr->dbc, imsi, g_hlr->subscr_create_on_demand_flags);
+	rc = db_subscr_create(g_hlr->dbc, imsi, g_hlr->subscr_create_on_demand.flags);
 	if (rc) {
 		LOGP(DMAIN, LOGL_ERROR, "Failed to create subscriber on demand (rc=%d): IMSI='%s'\n", rc, imsi);
 		return rc;
 	}

-	if (!rand_msisdn_len)
+	if (msisdn[0] == '\0')
 		return 0;

 	/* Update MSISDN of the new (just allocated) subscriber */
@@ -324,7 +333,11 @@ static int rx_send_auth_info(struct osmo_gsup_req *req)
 						  " Returning slightly inaccurate cause 'IMSI Unknown' via GSUP");
 			return rc;
 		case -ENOENT:
-			osmo_gsup_req_respond_err(req, g_hlr->reject_cause, "IMSI unknown");
+			osmo_gsup_req_respond_err(req,
+						  (req->gsup.cn_domain == OSMO_GSUP_CN_DOMAIN_CS) ?
+						  g_hlr->no_proxy_reject_cause.cs :
+						  g_hlr->no_proxy_reject_cause.ps,
+						  "IMSI unknown");
 			return rc;
 		default:
 			osmo_gsup_req_respond_err(req, GMM_CAUSE_NET_FAIL, "failure to look up IMSI in db");
@@ -382,7 +395,7 @@ static int rx_purge_ms_req(struct osmo_gsup_req *req)
 	return rc;
 }

-static int rx_check_imei_req(struct osmo_gsup_req *req)
+static int rx_check_imei_req(struct osmo_gsup_req *req, bool final)
 {
 	struct osmo_gsup_message gsup_reply;
 	char imei[GSM23003_IMEI_NUM_DIGITS_NO_CHK+1] = {0};
@@ -436,7 +449,7 @@ static int rx_check_imei_req(struct osmo_gsup_req *req)
 		.message_type = OSMO_GSUP_MSGT_CHECK_IMEI_RESULT,
 		.imei_result = OSMO_GSUP_IMEI_RESULT_ACK,
 	};
-	return osmo_gsup_req_respond(req, &gsup_reply, false, true);
+	return osmo_gsup_req_respond(req, &gsup_reply, false, final);
 }

 static char namebuf[255];
@@ -557,7 +570,16 @@ static int read_cb(struct osmo_gsup_conn *conn, struct msgb *msg)
 		lu_rx_gsup(req);
 		break;
 	case OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST:
-		rx_check_imei_req(req);
+		rx_check_imei_req(req, true);
+		break;
+	case OSMO_GSUP_MSGT_MO_FORWARD_SM_REQUEST:
+		forward_mo_sms(req);
+		break;
+	case OSMO_GSUP_MSGT_MT_FORWARD_SM_REQUEST:
+		forward_mt_sms(req);
+		break;
+	case OSMO_GSUP_MSGT_READY_FOR_SM_REQUEST:
+		rx_ready_for_sm_req(req);
 		break;
 	default:
 		LOGP(DMAIN, LOGL_DEBUG, "Unhandled GSUP message type %s\n",
@@ -568,6 +590,12 @@ static int read_cb(struct osmo_gsup_conn *conn, struct msgb *msg)
 	return 0;
 }

+void dgsm_fallback_to_hlr(struct osmo_gsup_req *req) {
+	LOGP(DDGSM, LOGL_DEBUG, "Fall back to HLR from DGSM for [%s]\n",
+	     osmo_gsup_message_type_name(req->gsup.message_type));
+	rx_check_imei_req(req, false);
+}
+
 static void print_usage(void)
 {
 	printf("Usage: osmo-hlr\n");
@@ -727,7 +755,7 @@ static void signal_hdlr(int signal)
 }

 static const char vlr_copyright[] =
-	"Copyright (C) 2016, 2017 by Harald Welte, sysmocom s.f.m.c. GmbH\r\n"
+	"Copyright (C) 2016-2023 by Harald Welte, sysmocom s.f.m.c. GmbH\r\n"
 	"License AGPLv3+: GNU AGPL version 3 or later <http://gnu.org/licenses/agpl-3.0.html>\r\n"
 	"This is free software: you are free to change and redistribute it.\r\n"
 	 "There is NO WARRANTY, to the extent permitted by law.\r\n";
@@ -753,14 +781,18 @@ int main(int argc, char **argv)

 	g_hlr = talloc_zero(hlr_ctx, struct hlr);
 	INIT_LLIST_HEAD(&g_hlr->euse_list);
+	INIT_LLIST_HEAD(&g_hlr->smsc_list);
 	INIT_LLIST_HEAD(&g_hlr->ss_sessions);
 	INIT_LLIST_HEAD(&g_hlr->ussd_routes);
+	INIT_LLIST_HEAD(&g_hlr->smsc_routes);
 	INIT_LLIST_HEAD(&g_hlr->mslookup.server.local_site_services);
 	g_hlr->db_file_path = talloc_strdup(g_hlr, HLR_DEFAULT_DB_FILE_PATH);
 	g_hlr->mslookup.server.mdns.domain_suffix = talloc_strdup(g_hlr, OSMO_MDNS_DOMAIN_SUFFIX_DEFAULT);
 	g_hlr->mslookup.client.mdns.domain_suffix = talloc_strdup(g_hlr, OSMO_MDNS_DOMAIN_SUFFIX_DEFAULT);
-	g_hlr->reject_cause = GMM_CAUSE_IMSI_UNKNOWN;
-	g_hlr->no_proxy_reject_cause = GMM_CAUSE_IMSI_UNKNOWN;
+	g_hlr->reject_cause.cs = GMM_CAUSE_IMSI_UNKNOWN;
+	g_hlr->no_proxy_reject_cause.cs = GMM_CAUSE_IMSI_UNKNOWN;
+	g_hlr->reject_cause.ps = GMM_CAUSE_IMSI_UNKNOWN;
+	g_hlr->no_proxy_reject_cause.ps = GMM_CAUSE_IMSI_UNKNOWN;

 	/* Init default (call independent) SS session guard timeout value */
 	g_hlr->ncss_guard_timeout = NCSS_GUARD_TIMEOUT_DEFAULT;
--- a/src/hlr_sms.c
+++ b/src/hlr_sms.c
@@ -0,0 +1,276 @@
+/* OsmoHLR SMS-over-GSUP routing implementation */
+
+/* Author: Mychaela N. Falconia <falcon@freecalypso.org>, 2023 - however,
+ * Mother Mychaela's contributions are NOT subject to copyright.
+ * No rights reserved, all rights relinquished.
+ *
+ * Based on earlier unmerged work by Vadim Yanitskiy, 2019.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <errno.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/gsm/gsup.h>
+#include <osmocom/gsm/gsm48_ie.h>
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#include <osmocom/hlr/hlr.h>
+#include <osmocom/hlr/hlr_sms.h>
+#include <osmocom/hlr/gsup_server.h>
+#include <osmocom/hlr/gsup_router.h>
+#include <osmocom/hlr/logging.h>
+#include <osmocom/hlr/db.h>
+
+/***********************************************************************
+ * core data structures expressing config from VTY
+ ***********************************************************************/
+
+struct hlr_smsc *smsc_find(struct hlr *hlr, const char *name)
+{
+	struct hlr_smsc *smsc;
+
+	llist_for_each_entry(smsc, &hlr->smsc_list, list) {
+		if (!strcmp(smsc->name, name))
+			return smsc;
+	}
+	return NULL;
+}
+
+struct hlr_smsc *smsc_alloc(struct hlr *hlr, const char *name)
+{
+	struct hlr_smsc *smsc = smsc_find(hlr, name);
+	if (smsc)
+		return NULL;
+
+	smsc = talloc_zero(hlr, struct hlr_smsc);
+	smsc->name = talloc_strdup(smsc, name);
+	smsc->hlr = hlr;
+	llist_add_tail(&smsc->list, &hlr->smsc_list);
+
+	return smsc;
+}
+
+void smsc_free(struct hlr_smsc *smsc)
+{
+	llist_del(&smsc->list);
+	talloc_free(smsc);
+}
+
+struct hlr_smsc_route *smsc_route_find(struct hlr *hlr, const char *num_addr)
+{
+	struct hlr_smsc_route *rt;
+
+	llist_for_each_entry(rt, &hlr->smsc_routes, list) {
+		if (!strcmp(rt->num_addr, num_addr))
+			return rt;
+	}
+	return NULL;
+}
+
+struct hlr_smsc_route *smsc_route_alloc(struct hlr *hlr, const char *num_addr,
+					struct hlr_smsc *smsc)
+{
+	struct hlr_smsc_route *rt;
+
+	if (smsc_route_find(hlr, num_addr))
+		return NULL;
+
+	rt = talloc_zero(hlr, struct hlr_smsc_route);
+	rt->num_addr = talloc_strdup(rt, num_addr);
+	rt->smsc = smsc;
+	llist_add_tail(&rt->list, &hlr->smsc_routes);
+
+	return rt;
+}
+
+void smsc_route_free(struct hlr_smsc_route *rt)
+{
+	llist_del(&rt->list);
+	talloc_free(rt);
+}
+
+/***********************************************************************
+ * forwarding of MO SMS to SMSCs based on SM-RP-DA
+ ***********************************************************************/
+
+static const struct hlr_smsc *find_smsc_route(const char *smsc_addr)
+{
+	const struct hlr_smsc_route *rt;
+
+	rt = smsc_route_find(g_hlr, smsc_addr);
+	if (rt)
+		return rt->smsc;
+	return g_hlr->smsc_default;
+}
+
+static void respond_with_sm_rp_cause(struct osmo_gsup_req *req,
+				     uint8_t sm_rp_cause)
+{
+	struct osmo_gsup_message rsp_msg = { };
+
+	rsp_msg.sm_rp_cause = &sm_rp_cause;
+	osmo_gsup_req_respond(req, &rsp_msg, true, true);
+}
+
+/* Short Message from MSC/VLR towards SMSC */
+void forward_mo_sms(struct osmo_gsup_req *req)
+{
+	uint8_t gsm48_decode_buffer[GSM411_SMSC_ADDR_MAX_OCTETS];
+	char smsc_addr[GSM411_SMSC_ADDR_MAX_DIGITS+1];
+	const struct hlr_smsc *smsc;
+	struct osmo_cni_peer_id dest_peer;
+
+	/* Make sure SM-RP-DA (SMSC address) is present */
+	if (req->gsup.sm_rp_da == NULL || !req->gsup.sm_rp_da_len) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_INV_MAND_INFO,
+					  "missing SM-RP-DA");
+		return;
+	}
+
+	if (req->gsup.sm_rp_da_type != OSMO_GSUP_SMS_SM_RP_ODA_SMSC_ADDR) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_INV_MAND_INFO,
+					  "SM-RP-DA type is not SMSC");
+		return;
+	}
+
+	/* Enforce the length constrainst on SM-RP-DA, as specified in
+	 * GSM 04.11 section 8.2.5.2.  Also enforce absence of ToN/NPI
+	 * extension octets at the same time. */
+	if (req->gsup.sm_rp_da_len < GSM411_SMSC_ADDR_MIN_OCTETS ||
+	    req->gsup.sm_rp_da_len > GSM411_SMSC_ADDR_MAX_OCTETS ||
+	    !(req->gsup.sm_rp_da[0] & 0x80)) {
+		/* This form of bogosity originates from the MS,
+		 * not from OsmoMSC or any other Osmocom network elements! */
+		LOGP(DLSMS, LOGL_NOTICE,
+		     "Rx '%s' (IMSI-%s) contains invalid SM-RP-DA from MS\n",
+		     osmo_gsup_message_type_name(req->gsup.message_type),
+		     req->gsup.imsi);
+		respond_with_sm_rp_cause(req, GSM411_RP_CAUSE_SEMANT_INC_MSG);
+		return;
+	}
+
+	/* Decode SMSC address from SM-RP-DA */
+	gsm48_decode_buffer[0] = req->gsup.sm_rp_da_len - 1;
+	memcpy(gsm48_decode_buffer + 1, req->gsup.sm_rp_da + 1,
+		req->gsup.sm_rp_da_len - 1);
+	gsm48_decode_bcd_number2(smsc_addr, sizeof(smsc_addr),
+				 gsm48_decode_buffer,
+				 req->gsup.sm_rp_da_len, 0);
+
+	/* Look for a route to this SMSC */
+	smsc = find_smsc_route(smsc_addr);
+	if (smsc == NULL) {
+		LOGP(DLSMS, LOGL_NOTICE,
+		     "Failed to find a route for '%s' (IMSI-%s, SMSC-Addr-%s)\n",
+		     osmo_gsup_message_type_name(req->gsup.message_type),
+		     req->gsup.imsi, smsc_addr);
+		respond_with_sm_rp_cause(req,
+					 GSM411_RP_CAUSE_MO_NUM_UNASSIGNED);
+		return;
+	}
+
+	/* We got the IPA name of our SMSC - forward the message */
+	osmo_cni_peer_id_set(&dest_peer, OSMO_CNI_PEER_ID_IPA_NAME,
+			     (const uint8_t *) smsc->name,
+			     strlen(smsc->name) + 1);
+	osmo_gsup_forward_to_local_peer(req->cb_data, &dest_peer, req, NULL);
+}
+
+/***********************************************************************
+ * forwarding of MT SMS from SMSCs to MSC/VLR based on IMSI
+ ***********************************************************************/
+
+void forward_mt_sms(struct osmo_gsup_req *req)
+{
+	struct hlr_subscriber subscr;
+	struct osmo_cni_peer_id dest_peer;
+	int rc;
+
+	rc = db_subscr_get_by_imsi(g_hlr->dbc, req->gsup.imsi, &subscr);
+	if (rc < 0) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_IMSI_UNKNOWN,
+					  "IMSI unknown");
+		return;
+	}
+	/* is this subscriber currently attached to a VLR? */
+	if (!subscr.vlr_number[0]) {
+		osmo_gsup_req_respond_err(req, GMM_CAUSE_IMPL_DETACHED,
+					  "subscriber not attached to a VLR");
+		return;
+	}
+	osmo_cni_peer_id_set(&dest_peer, OSMO_CNI_PEER_ID_IPA_NAME,
+			     (const uint8_t *) subscr.vlr_number,
+			     strlen(subscr.vlr_number) + 1);
+	osmo_gsup_forward_to_local_peer(req->cb_data, &dest_peer, req, NULL);
+}
+
+/***********************************************************************
+ * READY-FOR-SM handling
+ *
+ * An MSC indicates that an MS is ready to receive messages.  If one
+ * or more SMSCs have previously tried to send MT SMS to this MS and
+ * failed, we should pass this READY-FOR-SM message to them so they
+ * can resend their queued SMS right away.  But which SMSC do we
+ * forward the message to?  3GPP specs call for a complicated system
+ * where the HLR remembers which SMSCs have tried and failed to deliver
+ * MT SMS, and those SMSCs then get notified - but that design is too
+ * much complexity for the current state of Osmocom.  So we keep it
+ * simple: we iterate over all configured SMSCs and forward a copy
+ * of the READY-FOR-SM.req message to each.
+ *
+ * Routing of responses is another problem: the MSC that sent
+ * READY-FOR-SM.req expects only one response, and one can even argue
+ * that the operation is a "success" from the perspective of the MS
+ * irrespective of whether each given SMSC handled the notification
+ * successfully or not.  Hence our approach: we always return success
+ * to the MS, and when we forward copies of READY-FOR-SM.req to SMSCs,
+ * we list the HLR as the message source - this way SMSC responses
+ * will terminate at this HLR and won't be forwarded to the MSC.
+ ***********************************************************************/
+
+static void forward_req_copy_to_smsc(const struct osmo_gsup_req *req,
+				     const struct hlr_smsc *smsc)
+{
+	const char *my_ipa_name = g_hlr->gsup_unit_name.serno;
+	struct osmo_gsup_message forward = req->gsup;
+	struct osmo_ipa_name smsc_ipa_name;
+
+	/* set the source to this HLR */
+	forward.source_name = (const uint8_t *) my_ipa_name;
+	forward.source_name_len = strlen(my_ipa_name) + 1;
+
+	/* send it off */
+	LOG_GSUP_REQ(req, LOGL_INFO, "Forwarding source-reset copy to %s\n",
+		     smsc->name);
+	osmo_ipa_name_set(&smsc_ipa_name, (const uint8_t *) smsc->name,
+			  strlen(smsc->name) + 1);
+	osmo_gsup_enc_send_to_ipa_name(g_hlr->gs, &smsc_ipa_name, &forward);
+}
+
+void rx_ready_for_sm_req(struct osmo_gsup_req *req)
+{
+	struct hlr_smsc *smsc;
+
+	/* fan request msg out to all SMSCs */
+	llist_for_each_entry(smsc, &g_hlr->smsc_list, list)
+		forward_req_copy_to_smsc(req, smsc);
+
+	/* send OK response to the MSC and the MS */
+	osmo_gsup_req_respond_msgt(req, OSMO_GSUP_MSGT_READY_FOR_SM_RESULT,
+				   true);
+}
--- a/src/hlr_ussd.c
+++ b/src/hlr_ussd.c
@@ -122,9 +122,40 @@ void ussd_route_del(struct hlr_ussd_route *rt)
 	talloc_free(rt);
 }

-static struct hlr_ussd_route *ussd_route_lookup_7bit(struct hlr *hlr, const char *ussd_code)
+static struct hlr_ussd_route *ussd_route_lookup_for_req(struct hlr *hlr, const struct ss_request *req)
 {
+	const uint8_t cgroup = req->ussd_data_dcs >> 4;
+	const uint8_t lang = req->ussd_data_dcs & 0x0f;
+	char ussd_code[GSM0480_USSD_7BIT_STRING_LEN];
 	struct hlr_ussd_route *rt;
+
+	ussd_code[0] = '\0';
+
+	/* We support only the Coding Group 0 (GSM 7-bit default alphabeet).  In fact,
+	 * the USSD request is usually limited to [*#0-9], so we don't really need to
+	 * support other coding groups and languages. */
+	switch (cgroup) {
+	case 0:
+		/* The Language is usually set to '1111'B (unspecified), but some UEs
+		 * are known to indicate '0000'B (German). */
+		if (lang != 0x0f) {
+			LOGP(DSS, LOGL_NOTICE, "USSD DataCodingScheme (0x%02x): "
+			     "the Language is usually set to 15 (unspecified), "
+			     "but the request indicates %u - ignoring this\n",
+			     req->ussd_data_dcs, lang);
+			/* do not abort, attempt to decode as if it was '1111'B */
+		}
+
+		gsm_7bit_decode_n_ussd(&ussd_code[0], sizeof(ussd_code),
+				       req->ussd_data, (req->ussd_data_len * 8) / 7);
+		break;
+	default:
+		LOGP(DSS, LOGL_ERROR, "USSD DataCodingScheme (0x%02x): "
+		     "Coding Group %u is not supported, expecting Coding Group 0\n",
+		     req->ussd_data_dcs, cgroup);
+		return NULL;
+	}
+
 	llist_for_each_entry(rt, &hlr->ussd_routes, list) {
 		if (!strncmp(ussd_code, rt->prefix, strlen(rt->prefix))) {
 			LOGP(DSS, LOGL_DEBUG, "Found %s '%s' (prefix '%s') for USSD "
@@ -603,7 +634,7 @@ void rx_proc_ss_req(struct osmo_gsup_req *gsup_req)
 			} else {
 				/* VLR->EUSE: MO USSD. VLR is known ('conn'), EUSE is to be resolved */
 				struct hlr_ussd_route *rt;
-				rt = ussd_route_lookup_7bit(hlr, (const char *) req.ussd_text);
+				rt = ussd_route_lookup_for_req(hlr, &req);
 				if (rt) {
 					if (rt->is_external) {
 						ss->is_external = true;
@@ -631,7 +662,8 @@ void rx_proc_ss_req(struct osmo_gsup_req *gsup_req)
 		if (!ss) {
 			LOGP(DSS, LOGL_ERROR, "%s/0x%08x: CONTINUE for unknown SS session\n",
 				gsup->imsi, gsup->session_id);
-			osmo_gsup_req_respond_err(gsup_req, GMM_CAUSE_INV_MAND_INFO, "CONTINUE for unknown SS session");
+			osmo_gsup_req_respond_err(gsup_req, GMM_CAUSE_MSGT_INCOMP_P_STATE,
+						  "CONTINUE for unknown SS session");
 			return;
 		}

@@ -652,6 +684,8 @@ void rx_proc_ss_req(struct osmo_gsup_req *gsup_req)
 		if (!ss) {
 			LOGP(DSS, LOGL_ERROR, "%s/0x%08x: END for unknown SS session\n",
 				gsup->imsi, gsup->session_id);
+			osmo_gsup_req_respond_err(gsup_req, GMM_CAUSE_MSGT_INCOMP_P_STATE,
+						  "END for unknown SS session");
 			return;
 		}

@@ -682,4 +716,5 @@ void rx_proc_ss_error(struct osmo_gsup_req *req)
 {
 	LOGP(DSS, LOGL_NOTICE, "%s/0x%08x: Process SS ERROR (%s)\n", req->gsup.imsi, req->gsup.session_id,
 		osmo_gsup_session_state_name(req->gsup.session_state));
+	osmo_gsup_req_free(req);
 }
--- a/src/hlr_vty.c
+++ b/src/hlr_vty.c
@@ -26,9 +26,12 @@
 */

 #include <errno.h>
+#include <string.h>

 #include <osmocom/core/talloc.h>
 #include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
+#include <osmocom/gsm/apn.h>
+
 #include <osmocom/vty/vty.h>
 #include <osmocom/vty/stats.h>
 #include <osmocom/vty/command.h>
@@ -41,6 +44,7 @@
 #include <osmocom/hlr/hlr_vty.h>
 #include <osmocom/hlr/hlr_vty_subscr.h>
 #include <osmocom/hlr/hlr_ussd.h>
+#include <osmocom/hlr/hlr_sms.h>
 #include <osmocom/hlr/gsup_server.h>

 static const struct value_string gsm48_gmm_cause_vty_names[] = {
@@ -103,39 +107,240 @@ DEFUN(cfg_gsup,
 	return CMD_SUCCESS;
 }

+struct cmd_node ps_node = {
+	PS_NODE,
+	"%s(config-hlr-ps)# ",
+	1,
+};
+
+DEFUN(cfg_ps,
+      cfg_ps_cmd,
+      "ps",
+      "Configure the PS options")
+{
+	vty->node = PS_NODE;
+	return CMD_SUCCESS;
+}
+
+struct cmd_node ps_pdp_profiles_node = {
+	PS_PDP_PROFILES_NODE,
+	"%s(config-hlr-ps-pdp-profiles)# ",
+	1,
+};
+
+DEFUN(cfg_ps_pdp_profiles,
+      cfg_ps_pdp_profiles_cmd,
+      "pdp-profiles default",
+      "Define a PDP profile set.\n"
+      "Define the global default profile.\n")
+{
+	g_hlr->ps.pdp_profile.enabled = true;
+
+	vty->node = PS_PDP_PROFILES_NODE;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_ps_pdp_profiles,
+      cfg_no_ps_pdp_profiles_cmd,
+      "no pdp-profiles default",
+      NO_STR
+      "Delete PDP profile.\n"
+      "Unique identifier for this PDP profile set.\n")
+{
+	g_hlr->ps.pdp_profile.enabled = false;
+	return CMD_SUCCESS;
+}
+
+
+
+struct cmd_node ps_pdp_profiles_profile_node = {
+	PS_PDP_PROFILES_PROFILE_NODE,
+	"%s(config-hlr-ps-pdp-profile)# ",
+	1,
+};
+
+
+/* context_id == 0 means the slot is free */
+struct osmo_gsup_pdp_info *get_pdp_profile(uint8_t context_id)
+{
+	for (int i = 0; i < OSMO_GSUP_MAX_NUM_PDP_INFO; i++) {
+		struct osmo_gsup_pdp_info *info = &g_hlr->ps.pdp_profile.pdp_infos[i];
+		if (info->context_id == context_id)
+			return info;
+	}
+
+	return NULL;
+}
+
+struct osmo_gsup_pdp_info *create_pdp_profile(uint8_t context_id)
+{
+	struct osmo_gsup_pdp_info *info = get_pdp_profile(0);
+	if (!info)
+		return NULL;
+
+	memset(info, 0, sizeof(*info));
+	info->context_id = context_id;
+	info->have_info = 1;
+
+	g_hlr->ps.pdp_profile.num_pdp_infos++;
+	return info;
+}
+
+void destroy_pdp_profile(struct osmo_gsup_pdp_info *info)
+{
+	info->context_id = 0;
+	if (info->apn_enc)
+		talloc_free((void *) info->apn_enc);
+
+	g_hlr->ps.pdp_profile.num_pdp_infos--;
+	memset(info, 0, sizeof(*info));
+}
+
+DEFUN(cfg_ps_pdp_profiles_profile,
+      cfg_ps_pdp_profiles_profile_cmd,
+      "profile <1-10>",
+      "Configure a PDP profile\n"
+      "Unique PDP context identifier. The lowest profile will be used as default context.\n")
+{
+	struct osmo_gsup_pdp_info *info;
+	uint8_t context_id = atoi(argv[0]);
+
+	info = get_pdp_profile(context_id);
+	if (!info) {
+		info = create_pdp_profile(context_id);
+		if (!info) {
+			vty_out(vty, "Failed to create profile %d!%s", context_id, VTY_NEWLINE);
+			return CMD_ERR_INCOMPLETE;
+		}
+	}
+
+	vty->node = PS_PDP_PROFILES_PROFILE_NODE;
+	vty->index = info;
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_ps_pdp_profiles_profile,
+      cfg_no_ps_pdp_profiles_profile_cmd,
+      "no profile <1-10>",
+      NO_STR
+      "Delete a PDP profile\n"
+      "Unique PDP context identifier. The lowest profile will be used as default context.\n")
+{
+	struct osmo_gsup_pdp_info *info;
+	uint8_t context_id = atoi(argv[0]);
+
+	info = get_pdp_profile(context_id);
+	if (info)
+		destroy_pdp_profile(info);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_ps_pdp_profile_apn, cfg_ps_pdp_profile_apn_cmd,
+	"apn ID",
+	"Configure the APN.\n"
+	"APN name or * for wildcard apn.\n")
+{
+	struct osmo_gsup_pdp_info *info = vty->index;
+	const char *apn_name = argv[0];
+
+	/* apn encoded takes one more byte than strlen() */
+	size_t apn_enc_len = strlen(apn_name) + 1;
+	uint8_t *apn_enc;
+	int ret;
+
+	if (apn_enc_len > APN_MAXLEN) {
+		vty_out(vty, "APN name is too long '%s'. Max is %d!%s", apn_name, APN_MAXLEN, VTY_NEWLINE);
+		return CMD_ERR_INCOMPLETE;
+	}
+
+	info->apn_enc = apn_enc = (uint8_t *) talloc_zero_size(g_hlr, apn_enc_len);
+	ret = info->apn_enc_len = osmo_apn_from_str(apn_enc, apn_enc_len, apn_name);
+	if (ret < 0) {
+		talloc_free(apn_enc);
+		info->apn_enc = NULL;
+		info->apn_enc_len = 0;
+		vty_out(vty, "Invalid APN name %s!", apn_name);
+		return CMD_WARNING;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_ps_pdp_profile_apn, cfg_no_ps_pdp_profile_apn_cmd,
+      "no apn",
+      NO_STR
+      "Delete the APN.\n")
+{
+	struct osmo_gsup_pdp_info *info = vty->index;
+	if (info->apn_enc) {
+		talloc_free((void *) info->apn_enc);
+		info->apn_enc = NULL;
+		info->apn_enc_len = 0;
+	}
+
+	return CMD_SUCCESS;
+}
+
+static void config_write_subscr_create_on_demand(struct vty *vty)
+{
+	const uint8_t flags = g_hlr->subscr_create_on_demand.flags;
+	const char *flags_str;
+
+	switch (g_hlr->subscr_create_on_demand.mode) {
+	case SUBSCR_COD_MODE_MSISDN_FROM_IMSI:
+		vty_out(vty, " subscriber-create-on-demand msisdn-from-imsi");
+		break;
+	case SUBSCR_COD_MODE_RAND_MSISDN:
+		vty_out(vty, " subscriber-create-on-demand %u",
+			g_hlr->subscr_create_on_demand.rand_msisdn_len);
+		break;
+	case SUBSCR_COD_MODE_NO_MSISDN:
+		vty_out(vty, " subscriber-create-on-demand no-msisdn");
+		break;
+	case SUBSCR_COD_MODE_DISABLED:
+	default:
+		vty_out(vty, " no subscriber-create-on-demand%s", VTY_NEWLINE);
+		return;
+	}
+
+	if ((flags & DB_SUBSCR_FLAG_NAM_CS) && (flags & DB_SUBSCR_FLAG_NAM_PS))
+		flags_str = "cs+ps";
+	else if (flags & DB_SUBSCR_FLAG_NAM_CS)
+		flags_str = "cs";
+	else if (flags & DB_SUBSCR_FLAG_NAM_PS)
+		flags_str = "ps";
+	else
+		flags_str = "none";
+	vty_out(vty, " %s%s", flags_str, VTY_NEWLINE);
+}
+
+
 static int config_write_hlr(struct vty *vty)
 {
 	vty_out(vty, "hlr%s", VTY_NEWLINE);

-	if (g_hlr->reject_cause != GMM_CAUSE_IMSI_UNKNOWN)
-		vty_out(vty, " reject-cause not-found %s%s",
+	if (g_hlr->reject_cause.cs != GMM_CAUSE_IMSI_UNKNOWN)
+		vty_out(vty, " reject-cause not-found cs %s%s",
 			get_value_string_or_null(gsm48_gmm_cause_vty_names,
-						 (uint32_t) g_hlr->reject_cause), VTY_NEWLINE);
-	if (g_hlr->no_proxy_reject_cause != GMM_CAUSE_IMSI_UNKNOWN)
-		vty_out(vty, " reject-cause no-proxy %s%s",
+						 (uint32_t) g_hlr->reject_cause.cs), VTY_NEWLINE);
+	if (g_hlr->reject_cause.ps != GMM_CAUSE_IMSI_UNKNOWN)
+		vty_out(vty, " reject-cause not-found ps %s%s",
 			get_value_string_or_null(gsm48_gmm_cause_vty_names,
-						 (uint32_t) g_hlr->no_proxy_reject_cause), VTY_NEWLINE);
+						 (uint32_t) g_hlr->reject_cause.ps), VTY_NEWLINE);
+	if (g_hlr->no_proxy_reject_cause.cs != GMM_CAUSE_IMSI_UNKNOWN)
+		vty_out(vty, " reject-cause no-proxy cs %s%s",
+			get_value_string_or_null(gsm48_gmm_cause_vty_names,
+						 (uint32_t) g_hlr->no_proxy_reject_cause.cs), VTY_NEWLINE);
+	if (g_hlr->no_proxy_reject_cause.ps != GMM_CAUSE_IMSI_UNKNOWN)
+		vty_out(vty, " reject-cause no-proxy ps %s%s",
+			get_value_string_or_null(gsm48_gmm_cause_vty_names,
+						 (uint32_t) g_hlr->no_proxy_reject_cause.ps), VTY_NEWLINE);
 	if (g_hlr->store_imei)
 		vty_out(vty, " store-imei%s", VTY_NEWLINE);
 	if (g_hlr->db_file_path && strcmp(g_hlr->db_file_path, HLR_DEFAULT_DB_FILE_PATH))
 		vty_out(vty, " database %s%s", g_hlr->db_file_path, VTY_NEWLINE);
-	if (g_hlr->subscr_create_on_demand) {
-		const char *flags_str = "none";
-		uint8_t flags = g_hlr->subscr_create_on_demand_flags;
-		unsigned int rand_msisdn_len = g_hlr->subscr_create_on_demand_rand_msisdn_len;
-
-		if ((flags & DB_SUBSCR_FLAG_NAM_CS) && (flags & DB_SUBSCR_FLAG_NAM_PS))
-			flags_str = "cs+ps";
-		else if (flags & DB_SUBSCR_FLAG_NAM_CS)
-			flags_str = "cs";
-		else if (flags & DB_SUBSCR_FLAG_NAM_PS)
-			flags_str = "ps";
-
-		if (rand_msisdn_len)
-			vty_out(vty, " subscriber-create-on-demand %i %s%s", rand_msisdn_len, flags_str, VTY_NEWLINE);
-		else
-			vty_out(vty, " subscriber-create-on-demand no-msisdn %s%s", flags_str, VTY_NEWLINE);
-	}
+	config_write_subscr_create_on_demand(vty);
 	return CMD_SUCCESS;
 }

@@ -149,6 +354,37 @@ static int config_write_hlr_gsup(struct vty *vty)
 	return CMD_SUCCESS;
 }

+static int config_write_hlr_ps(struct vty *vty)
+{
+	vty_out(vty, " ps%s", VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+static int config_write_hlr_ps_pdp_profiles(struct vty *vty)
+{
+	char apn[APN_MAXLEN + 1] = {};
+
+	if (!g_hlr->ps.pdp_profile.enabled)
+		return CMD_SUCCESS;
+
+	vty_out(vty, "  pdp-profiles default%s", VTY_NEWLINE);
+	for (int i = 0; i < g_hlr->ps.pdp_profile.num_pdp_infos; i++) {
+		struct osmo_gsup_pdp_info *pdp_info = &g_hlr->ps.pdp_profile.pdp_infos[i];
+		if (!pdp_info->context_id)
+			continue;
+
+		vty_out(vty, "   profile %d%s", pdp_info->context_id, VTY_NEWLINE);
+		if (!pdp_info->have_info)
+			continue;
+
+		if (pdp_info->apn_enc && pdp_info->apn_enc_len) {
+			osmo_apn_to_str(apn, pdp_info->apn_enc, pdp_info->apn_enc_len);
+			vty_out(vty, "    apn %s%s", apn, VTY_NEWLINE);
+		}
+	}
+	return CMD_SUCCESS;
+}
+
 static void show_one_conn(struct vty *vty, const struct osmo_gsup_conn *conn)
 {
 	const struct ipa_server_conn *isc = conn->conn;
@@ -212,8 +448,6 @@ DEFUN(cfg_hlr_gsup_ipa_name,
 * USSD Entity
 ***********************************************************************/

-#include <osmocom/hlr/hlr_ussd.h>
-
 #define USSD_STR "USSD Configuration\n"
 #define UROUTE_STR "Routing Configuration\n"
 #define PREFIX_STR "Prefix-Matching Route\n" "USSD Prefix\n"
@@ -400,21 +634,185 @@ DEFUN(cfg_ncss_guard_timeout, cfg_ncss_guard_timeout_cmd,
 	return CMD_SUCCESS;
 }

+/***********************************************************************
+ * Routing of SM-RL to GSUP-attached SMSCs
+ ***********************************************************************/
+
+#define SMSC_STR "Configuration of GSUP routing to SMSCs\n"
+
+struct cmd_node smsc_node = {
+	SMSC_NODE,
+	"%s(config-hlr-smsc)# ",
+	1,
+};
+
+DEFUN(cfg_smsc_entity, cfg_smsc_entity_cmd,
+	"smsc entity NAME",
+	SMSC_STR
+	"Configure a particular external SMSC\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc;
+	const char *id = argv[0];
+
+	smsc = smsc_find(g_hlr, id);
+	if (!smsc) {
+		smsc = smsc_alloc(g_hlr, id);
+		if (!smsc)
+			return CMD_WARNING;
+	}
+	vty->index = smsc;
+	vty->index_sub = &smsc->description;
+	vty->node = SMSC_NODE;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_entity, cfg_no_smsc_entity_cmd,
+	"no smsc entity NAME",
+	NO_STR SMSC_STR "Remove a particular external SMSC\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc = smsc_find(g_hlr, argv[0]);
+	if (!smsc) {
+		vty_out(vty, "%% Cannot remove non-existent SMSC %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (g_hlr->smsc_default == smsc) {
+		vty_out(vty,
+			"%% Cannot remove SMSC %s, it is the default route%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_free(smsc);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_smsc_route, cfg_smsc_route_cmd,
+	"smsc route NUMBER NAME",
+	SMSC_STR
+	"Configure GSUP route to a particular SMSC\n"
+	"Numeric address of this SMSC, must match EF.SMSP programming in SIMs\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc = smsc_find(g_hlr, argv[1]);
+	struct hlr_smsc_route *rt = smsc_route_find(g_hlr, argv[0]);
+	if (rt) {
+		vty_out(vty,
+			"%% Cannot add [another?] route for SMSC address %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	if (!smsc) {
+		vty_out(vty, "%% Cannot find SMSC '%s'%s", argv[1],
+			VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_route_alloc(g_hlr, argv[0], smsc);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_route, cfg_no_smsc_route_cmd,
+	"no smsc route NUMBER",
+	NO_STR SMSC_STR "Remove GSUP route to a particular SMSC\n"
+	"Numeric address of the SMSC\n")
+{
+	struct hlr_smsc_route *rt = smsc_route_find(g_hlr, argv[0]);
+	if (!rt) {
+		vty_out(vty, "%% Cannot find route for SMSC address %s%s",
+			argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+	smsc_route_free(rt);
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_smsc_defroute, cfg_smsc_defroute_cmd,
+	"smsc default-route NAME",
+	SMSC_STR
+	"Configure default SMSC route for unknown SMSC numeric addresses\n"
+	"IPA name of the external SMSC\n")
+{
+	struct hlr_smsc *smsc;
+
+	smsc = smsc_find(g_hlr, argv[0]);
+	if (!smsc) {
+		vty_out(vty, "%% Cannot find SMSC %s%s", argv[0], VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (g_hlr->smsc_default != smsc) {
+		vty_out(vty, "Switching default route from %s to %s%s",
+			g_hlr->smsc_default ? g_hlr->smsc_default->name : "<none>",
+			smsc->name, VTY_NEWLINE);
+		g_hlr->smsc_default = smsc;
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_no_smsc_defroute, cfg_no_smsc_defroute_cmd,
+	"no smsc default-route",
+	NO_STR SMSC_STR
+	"Remove default SMSC route for unknown SMSC numeric addresses\n")
+{
+	g_hlr->smsc_default = NULL;
+
+	return CMD_SUCCESS;
+}
+
+static void dump_one_smsc(struct vty *vty, struct hlr_smsc *smsc)
+{
+	vty_out(vty, " smsc entity %s%s", smsc->name, VTY_NEWLINE);
+}
+
+static int config_write_smsc(struct vty *vty)
+{
+	struct hlr_smsc *smsc;
+	struct hlr_smsc_route *rt;
+
+	llist_for_each_entry(smsc, &g_hlr->smsc_list, list)
+		dump_one_smsc(vty, smsc);
+
+	llist_for_each_entry(rt, &g_hlr->smsc_routes, list) {
+		vty_out(vty, " smsc route %s %s%s", rt->num_addr,
+			rt->smsc->name, VTY_NEWLINE);
+	}
+
+	if (g_hlr->smsc_default)
+		vty_out(vty, " smsc default-route %s%s",
+			g_hlr->smsc_default->name, VTY_NEWLINE);
+
+	return 0;
+}

 DEFUN(cfg_reject_cause, cfg_reject_cause_cmd,
      "reject-cause TYPE CAUSE", "") /* Dynamically Generated */
 {
-	int cause_code = get_string_value(gsm48_gmm_cause_vty_names, argv[1]);
+	int cause_code = get_string_value(gsm48_gmm_cause_vty_names, argv[2]);
 	OSMO_ASSERT(cause_code >= 0);

-	if (strcmp(argv[0], "not-found") == 0)
-		g_hlr->reject_cause = (enum gsm48_gmm_cause) cause_code;
-	if (strcmp(argv[0], "no-proxy") == 0)
-		g_hlr->no_proxy_reject_cause = (enum gsm48_gmm_cause) cause_code;
+	if (strcmp(argv[0], "not-found") == 0) {
+		if (strcmp(argv[1], "cs") == 0)
+			g_hlr->reject_cause.cs = (enum gsm48_gmm_cause) cause_code;
+		else
+			g_hlr->reject_cause.ps = (enum gsm48_gmm_cause) cause_code;
+	}
+	if (strcmp(argv[0], "no-proxy") == 0) {
+		if (strcmp(argv[1], "cs") == 0)
+			g_hlr->no_proxy_reject_cause.cs = (enum gsm48_gmm_cause) cause_code;
+		else
+			g_hlr->no_proxy_reject_cause.ps = (enum gsm48_gmm_cause) cause_code;
+	}

 	return CMD_SUCCESS;
 }

+
+
 DEFUN(cfg_store_imei, cfg_store_imei_cmd,
 	"store-imei",
 	"Save the IMEI in the database when receiving Check IMEI requests. Note that an MSC does not necessarily send"
@@ -433,29 +831,37 @@ DEFUN(cfg_no_store_imei, cfg_no_store_imei_cmd,
 }

 DEFUN(cfg_subscr_create_on_demand, cfg_subscr_create_on_demand_cmd,
-	"subscriber-create-on-demand (no-msisdn|<3-15>) (none|cs|ps|cs+ps)",
+	"subscriber-create-on-demand (no-msisdn|msisdn-from-imsi|<3-15>) (none|cs|ps|cs+ps)",
 	"Make a new record when a subscriber is first seen.\n"
 	"Do not automatically assign MSISDN.\n"
+	"Assign MSISDN identical to subscriber's IMSI.\n"
 	"Length of an automatically assigned MSISDN.\n"
 	"Do not allow any NAM (Network Access Mode) by default.\n"
 	"Allow access to circuit switched NAM by default.\n"
 	"Allow access to packet switched NAM by default.\n"
 	"Allow access to circuit and packet switched NAM by default.\n")
 {
+	enum subscr_create_on_demand_mode mode;
 	unsigned int rand_msisdn_len = 0;
 	uint8_t flags = 0x00;

-	if (strcmp(argv[0], "no-msisdn") != 0)
+	if (strcmp(argv[0], "no-msisdn") == 0) {
+		mode = SUBSCR_COD_MODE_NO_MSISDN;
+	} else if (strcmp(argv[0], "msisdn-from-imsi") == 0) {
+		mode = SUBSCR_COD_MODE_MSISDN_FROM_IMSI;
+	} else { /* random MSISDN */
+		mode = SUBSCR_COD_MODE_RAND_MSISDN;
 		rand_msisdn_len = atoi(argv[0]);
+	}

 	if (strstr(argv[1], "cs"))
 		flags |= DB_SUBSCR_FLAG_NAM_CS;
 	if (strstr(argv[1], "ps"))
 		flags |= DB_SUBSCR_FLAG_NAM_PS;

-	g_hlr->subscr_create_on_demand = true;
-	g_hlr->subscr_create_on_demand_rand_msisdn_len = rand_msisdn_len;
-	g_hlr->subscr_create_on_demand_flags = flags;
+	g_hlr->subscr_create_on_demand.mode = mode;
+	g_hlr->subscr_create_on_demand.rand_msisdn_len = rand_msisdn_len;
+	g_hlr->subscr_create_on_demand.flags = flags;

 	return CMD_SUCCESS;
 }
@@ -464,7 +870,7 @@ DEFUN(cfg_no_subscr_create_on_demand, cfg_no_subscr_create_on_demand_cmd,
 	"no subscriber-create-on-demand",
 	"Do not make a new record when a subscriber is first seen.\n")
 {
-	g_hlr->subscr_create_on_demand = false;
+	g_hlr->subscr_create_on_demand.mode = SUBSCR_COD_MODE_DISABLED;
 	return CMD_SUCCESS;
 }

@@ -512,7 +918,7 @@ void hlr_vty_init(void *hlr_ctx)
 	cfg_reject_cause_cmd.string =
 		vty_cmd_string_from_valstr(hlr_ctx,
 					   gsm48_gmm_cause_vty_names,
-					   "reject-cause (not-found|no-proxy) (", "|", ")",
+					   "reject-cause (not-found|no-proxy) (cs|ps) (", "|", ")",
 					   VTY_DO_LOWER);

 	cfg_reject_cause_cmd.doc =
@@ -520,7 +926,9 @@ void hlr_vty_init(void *hlr_ctx)
 					   gsm48_gmm_cause_vty_descs,
 					   "GSUP/GMM cause to be sent\n"
 					   "in the case the IMSI could not be found in the database\n"
-					   "in the case no remote HLR reponded to mslookup GSUP request\n",
+					   "in the case no remote HLR reponded to mslookup GSUP request\n"
+					   "for CS domain\n"
+					   "for PS domain\n",
 					   "\n", "", 0);

 	logging_vty_add_cmds();
@@ -538,6 +946,20 @@ void hlr_vty_init(void *hlr_ctx)
 	install_element(GSUP_NODE, &cfg_hlr_gsup_bind_ip_cmd);
 	install_element(GSUP_NODE, &cfg_hlr_gsup_ipa_name_cmd);

+	/* PS */
+	install_node(&ps_node, config_write_hlr_ps);
+	install_element(HLR_NODE, &cfg_ps_cmd);
+
+	install_node(&ps_pdp_profiles_node, config_write_hlr_ps_pdp_profiles);
+	install_element(PS_NODE, &cfg_ps_pdp_profiles_cmd);
+	install_element(PS_NODE, &cfg_no_ps_pdp_profiles_cmd);
+
+	install_node(&ps_pdp_profiles_profile_node, NULL);
+	install_element(PS_PDP_PROFILES_NODE, &cfg_ps_pdp_profiles_profile_cmd);
+	install_element(PS_PDP_PROFILES_NODE, &cfg_no_ps_pdp_profiles_profile_cmd);
+	install_element(PS_PDP_PROFILES_PROFILE_NODE, &cfg_ps_pdp_profile_apn_cmd);
+	install_element(PS_PDP_PROFILES_PROFILE_NODE, &cfg_no_ps_pdp_profile_apn_cmd);
+
 	install_element(HLR_NODE, &cfg_database_cmd);

 	install_element(HLR_NODE, &cfg_euse_cmd);
@@ -549,6 +971,15 @@ void hlr_vty_init(void *hlr_ctx)
 	install_element(HLR_NODE, &cfg_ussd_defaultroute_cmd);
 	install_element(HLR_NODE, &cfg_ussd_no_defaultroute_cmd);
 	install_element(HLR_NODE, &cfg_ncss_guard_timeout_cmd);
+
+	install_node(&smsc_node, config_write_smsc);
+	install_element(HLR_NODE, &cfg_smsc_entity_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_entity_cmd);
+	install_element(HLR_NODE, &cfg_smsc_route_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_route_cmd);
+	install_element(HLR_NODE, &cfg_smsc_defroute_cmd);
+	install_element(HLR_NODE, &cfg_no_smsc_defroute_cmd);
+
 	install_element(HLR_NODE, &cfg_reject_cause_cmd);
 	install_element(HLR_NODE, &cfg_store_imei_cmd);
 	install_element(HLR_NODE, &cfg_no_store_imei_cmd);
--- a/src/hlr_vty_subscr.c
+++ b/src/hlr_vty_subscr.c
@@ -1,5 +1,5 @@
 /* OsmoHLR subscriber management VTY implementation */
-/* (C) 2017 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
+/* (C) 2017-2023 by sysmocom s.f.m.c. GmbH <info@sysmocom.de>
 * All Rights Reserved
 *
 * This program is free software; you can redistribute it and/or modify
@@ -77,8 +77,8 @@ static void dump_last_lu_seen(struct vty *vty, const char *domain_label, time_t
 static void subscr_dump_full_vty(struct vty *vty, struct hlr_subscriber *subscr)
 {
 	int rc;
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;

 	vty_out(vty, "    ID: %"PRIu64"%s", subscr->id, VTY_NEWLINE);

@@ -137,12 +137,12 @@ static void subscr_dump_full_vty(struct vty *vty, struct hlr_subscriber *subscr)

 	if (aud2g.type != OSMO_AUTH_TYPE_NONE && aud2g.type != OSMO_AUTH_TYPE_GSM) {
 		vty_out(vty, "%% Error: 2G auth data is not of type 'GSM'%s", VTY_NEWLINE);
-		aud2g = (struct osmo_sub_auth_data){};
+		aud2g = (struct osmo_sub_auth_data2){};
 	}

 	if (aud3g.type != OSMO_AUTH_TYPE_NONE && aud3g.type != OSMO_AUTH_TYPE_UMTS) {
 		vty_out(vty, "%% Error: 3G auth data is not of type 'UMTS'%s", VTY_NEWLINE);
-		aud3g = (struct osmo_sub_auth_data){};
+		aud3g = (struct osmo_sub_auth_data2){};
 	}

 	if (aud2g.algo != OSMO_AUTH_ALG_NONE && aud2g.type != OSMO_AUTH_TYPE_NONE) {
@@ -154,9 +154,10 @@ static void subscr_dump_full_vty(struct vty *vty, struct hlr_subscriber *subscr)

 	if (aud3g.algo != OSMO_AUTH_ALG_NONE && aud3g.type != OSMO_AUTH_TYPE_NONE) {
 		vty_out(vty, "    3G auth: %s%s", osmo_auth_alg_name(aud3g.algo), VTY_NEWLINE);
-		vty_out(vty, "             K=%s%s", hexdump_buf(aud3g.u.umts.k), VTY_NEWLINE);
+		vty_out(vty, "             K=%s%s",
+			osmo_hexdump_nospc(aud3g.u.umts.k, aud3g.u.umts.k_len), VTY_NEWLINE);
 		vty_out(vty, "             %s=%s%s", aud3g.u.umts.opc_is_op? "OP" : "OPC",
-			hexdump_buf(aud3g.u.umts.opc), VTY_NEWLINE);
+			osmo_hexdump_nospc(aud3g.u.umts.opc, aud3g.u.umts.opc_len), VTY_NEWLINE);
 		vty_out(vty, "             IND-bitlen=%u", aud3g.u.umts.ind_bitlen);
 		if (aud3g.u.umts.sqn)
 			vty_out(vty, " last-SQN=%"PRIu64, aud3g.u.umts.sqn);
@@ -181,8 +182,11 @@ static void subscr_dump_summary_vty(struct hlr_subscriber *subscr, void *data)
 		vty_out(vty,"   ------------- ");
 	}
 	vty_out(vty, "   %-2s%-2s  ", subscr->nam_cs ? "CS" : "", subscr->nam_ps ? "PS" : "");
-	if (subscr->last_lu_seen)
+	if (subscr->last_lu_seen) {
+		/* VLR Number is max length 32, possibly truncate here */
+		vty_out(vty, " %.22s ", subscr->vlr_number);
 		dump_last_lu_seen(vty, "CS", subscr->last_lu_seen, true);
+	}
 	vty_out_newline(vty);
 }

@@ -217,8 +221,8 @@ static void dump_summary_table_vty(struct vty *vty, bool header, bool show_ls)
 {
 	const char *texts = "ID     MSISDN        IMSI              IMEI              NAM";
 	const char *lines = "-----  ------------  ----------------  ----------------  -----";
-	const char *ls_text = "    LAST SEEN";
-	const char *ls_line = "  ------------";
+	const char *ls_text = "    VLR_NUMBER             LAST SEEN      ";
+	const char *ls_line = "  ---------------------  ---------------------";
 	if (header) {
 		if (!show_ls)
 			vty_out(vty, "%s%s%s%s", texts, VTY_NEWLINE, lines, VTY_NEWLINE);
@@ -460,20 +464,27 @@ static bool is_hexkey_valid(struct vty *vty, const char *label,
 	return false;
 }

-#define AUTH_ALG_TYPES_2G "(comp128v1|comp128v2|comp128v3|xor)"
+#define AUTH_ALG_TYPES_2G "(comp128v1|comp128v2|comp128v3|xor-2g)"
 #define AUTH_ALG_TYPES_2G_HELP \
 	"Use COMP128v1 algorithm\n" \
 	"Use COMP128v2 algorithm\n" \
 	"Use COMP128v3 algorithm\n" \
-	"Use XOR algorithm\n"
+	"Use XOR-2G algorithm\n"

-#define AUTH_ALG_TYPES_3G "milenage"
+#define AUTH_ALG_TYPES_3G "(milenage|tuak)"
 #define AUTH_ALG_TYPES_3G_HELP \
-	"Use Milenage algorithm\n"
+	"Use Milenage algorithm\n" \
+	"Use TUAK algorithm\n"

 bool auth_algo_parse(const char *alg_str, enum osmo_auth_algo *algo,
-		     int *minlen, int *maxlen)
+		     int *minlen, int *maxlen, int *minlen_opc, int *maxlen_opc)
 {
+	/* Default: no OP[c]. True for all 2G algorithms, and 3G-XOR. Overridden below for real 3G AKA algorithms. */
+	if (minlen_opc)
+		*minlen_opc = 0;
+	if (maxlen_opc)
+		*maxlen_opc = 0;
+
 	if (!strcasecmp(alg_str, "none")) {
 		*algo = OSMO_AUTH_ALG_NONE;
 		*minlen = *maxlen = 0;
@@ -486,13 +497,28 @@ bool auth_algo_parse(const char *alg_str, enum osmo_auth_algo *algo,
 	} else if (!strcasecmp(alg_str, "comp128v3")) {
 		*algo = OSMO_AUTH_ALG_COMP128v3;
 		*minlen = *maxlen = A38_COMP128_KEY_LEN;
-	} else if (!strcasecmp(alg_str, "xor")) {
-		*algo = OSMO_AUTH_ALG_XOR;
+	} else if (!strcasecmp(alg_str, "xor-3g")) {
+		*algo = OSMO_AUTH_ALG_XOR_3G;
 		*minlen = A38_XOR_MIN_KEY_LEN;
 		*maxlen = A38_XOR_MAX_KEY_LEN;
+	} else if (!strcasecmp(alg_str, "xor-2g")) {
+		*algo = OSMO_AUTH_ALG_XOR_2G;
+		*minlen = *maxlen = A38_XOR2G_KEY_LEN;
 	} else if (!strcasecmp(alg_str, "milenage")) {
 		*algo = OSMO_AUTH_ALG_MILENAGE;
 		*minlen = *maxlen = MILENAGE_KEY_LEN;
+		if (minlen_opc)
+			*minlen_opc = MILENAGE_KEY_LEN;
+		if (maxlen_opc)
+			*maxlen_opc = MILENAGE_KEY_LEN;
+	} else if (!strcasecmp(alg_str, "tuak")) {
+		*algo = OSMO_AUTH_ALG_TUAK;
+		*minlen = 16;
+		*maxlen = 32;
+		if (minlen_opc)
+			*minlen_opc = 32;
+		if (maxlen_opc)
+			*maxlen_opc = 32;
 	} else
 		return false;
 	return true;
@@ -548,7 +574,7 @@ DEFUN(subscriber_aud2g,
 		.u.gsm.ki = ki,
 	};

-	if (!auth_algo_parse(alg_type, &aud2g.algo, &minlen, &maxlen)) {
+	if (!auth_algo_parse(alg_type, &aud2g.algo, &minlen, &maxlen, NULL, NULL)) {
 		vty_out(vty, "%% Unknown auth algorithm: '%s'%s", alg_type, VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -607,21 +633,21 @@ DEFUN(subscriber_aud3g,
      SUBSCR_UPDATE_HELP
      "Set UMTS authentication data (3G, and 2G with UMTS AKA)\n"
      AUTH_ALG_TYPES_3G_HELP
-      "Set Encryption Key K\n" "K as 32 hexadecimal characters\n"
-      "Set OP key\n" "Set OPC key\n" "OP or OPC as 32 hexadecimal characters\n"
+      "Set Encryption Key K\n" "K as 32/64 hexadecimal characters\n"
+      "Set OP key\n" "Set OPC key\n" "OP or OPC as 32/64 hexadecimal characters\n"
      "Set IND bit length\n" "IND bit length value (default: 5)\n")
 {
 	struct hlr_subscriber subscr;
-	int minlen = 0;
-	int maxlen = 0;
+	int minlen = 0, minlen_opc = 0;
+	int maxlen = 0, maxlen_opc = 0;
 	int rc;
 	const char *id_type = argv[0];
 	const char *id = argv[1];
-	const char *alg_type = AUTH_ALG_TYPES_3G;
-	const char *k = argv[2];
-	bool opc_is_op = (strcasecmp("op", argv[3]) == 0);
-	const char *op_opc = argv[4];
-	int ind_bitlen = argc > 6? atoi(argv[6]) : 5;
+	const char *alg_type = argv[2];
+	const char *k = argv[3];
+	bool opc_is_op = (strcasecmp("op", argv[4]) == 0);
+	const char *op_opc = argv[5];
+	int ind_bitlen = argc > 7 ? atoi(argv[7]) : 5;
 	struct sub_auth_data_str aud3g = {
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.u.umts = {
@@ -632,7 +658,7 @@ DEFUN(subscriber_aud3g,
 		},
 	};

-	if (!auth_algo_parse(alg_type, &aud3g.algo, &minlen, &maxlen)) {
+	if (!auth_algo_parse(alg_type, &aud3g.algo, &minlen, &maxlen, &minlen_opc, &maxlen_opc)) {
 		vty_out(vty, "%% Unknown auth algorithm: '%s'%s", alg_type, VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -640,8 +666,7 @@ DEFUN(subscriber_aud3g,
 	if (!is_hexkey_valid(vty, "K", aud3g.u.umts.k, minlen, maxlen))
 		return CMD_WARNING;

-	if (!is_hexkey_valid(vty, opc_is_op ? "OP" : "OPC", aud3g.u.umts.opc,
-			     MILENAGE_KEY_LEN, MILENAGE_KEY_LEN))
+	if (!is_hexkey_valid(vty, opc_is_op ? "OP" : "OPC", aud3g.u.umts.opc, minlen_opc, maxlen_opc))
 		return CMD_WARNING;

 	if (get_subscr_by_argv(vty, id_type, id, &subscr))
@@ -659,11 +684,11 @@ DEFUN(subscriber_aud3g,

 DEFUN(subscriber_aud3g_xor,
      subscriber_aud3g_xor_cmd,
-      SUBSCR_UPDATE "aud3g xor k K"
+      SUBSCR_UPDATE "aud3g xor-3g k K"
      " [ind-bitlen] [<0-28>]",
      SUBSCR_UPDATE_HELP
      "Set UMTS authentication data (3G, and 2G with UMTS AKA)\n"
-      "Use XOR algorithm\n"
+      "Use XOR-3G algorithm\n"
      "Set Encryption Key K\n" "K as 32 hexadecimal characters\n"
      "Set IND bit length\n" "IND bit length value (default: 5)\n")
 {
@@ -685,8 +710,8 @@ DEFUN(subscriber_aud3g_xor,
 		},
 	};

-	if (!auth_algo_parse("xor", &aud3g.algo, &minlen, &maxlen)) {
-		vty_out(vty, "%% Unknown auth algorithm: '%s'%s", "xor", VTY_NEWLINE);
+	if (!auth_algo_parse("xor-3g", &aud3g.algo, &minlen, &maxlen, NULL, NULL)) {
+		vty_out(vty, "%% Unknown auth algorithm: '%s'%s", "xor-3g", VTY_NEWLINE);
 		return CMD_WARNING;
 	}

--- a/src/lu_fsm.c
+++ b/src/lu_fsm.c
@@ -136,7 +136,8 @@ static void lu_start(struct osmo_gsup_req *update_location_req)
 	}

 	if (db_subscr_get_by_imsi(g_hlr->dbc, update_location_req->gsup.imsi, &lu->subscr) < 0) {
-		lu_failure(lu, g_hlr->reject_cause, "Subscriber does not exist");
+		lu_failure(lu, (lu->is_ps) ? g_hlr->reject_cause.ps : g_hlr->reject_cause.cs,
+			   "Subscriber does not exist");
 		return;
 	}

@@ -241,13 +242,11 @@ static void lu_fsm_wait_insert_data_result_onenter(struct osmo_fsm_inst *fi, uin
 	struct lu *lu = fi->priv;
 	struct hlr_subscriber *subscr = &lu->subscr;
 	struct osmo_gsup_message gsup;
-	uint8_t msisdn_enc[OSMO_GSUP_MAX_CALLED_PARTY_BCD_LEN];
-	uint8_t apn[APN_MAXLEN];

 	if (osmo_gsup_create_insert_subscriber_data_msg(&gsup, subscr->imsi,
-							subscr->msisdn, msisdn_enc, sizeof(msisdn_enc),
-							apn, sizeof(apn),
-							lu->is_ps? OSMO_GSUP_CN_DOMAIN_PS : OSMO_GSUP_CN_DOMAIN_CS)) {
+							subscr->msisdn,
+							lu->is_ps ? OSMO_GSUP_CN_DOMAIN_PS : OSMO_GSUP_CN_DOMAIN_CS,
+							OTC_SELECT)) {
 		lu_failure(lu, GMM_CAUSE_NET_FAIL, "cannot encode Insert Subscriber Data message");
 		return;
 	}
@@ -277,6 +276,7 @@ void lu_fsm_wait_insert_data_result(struct osmo_fsm_inst *fi, uint32_t event, vo

 	case OSMO_GSUP_MSGT_INSERT_DATA_ERROR:
 		lu_failure(lu, GMM_CAUSE_NET_FAIL, "Rx %s", osmo_gsup_message_type_name(req->gsup.message_type));
+		osmo_gsup_req_free(req);
 		break;

 	default:
--- a/src/mslookup/Makefile.am
+++ b/src/mslookup/Makefile.am
@@ -1,7 +1,7 @@
 # This is _NOT_ the library release version, it's an API version.
 # Please read chapter "Library interface versions" of the libtool documentation
 # before making any modifications: https://www.gnu.org/software/libtool/manual/html_node/Versioning.html
-LIBVERSION=1:0:0
+LIBVERSION=1:1:0

 AM_CPPFLAGS = $(all_includes) -I$(top_srcdir)/include -I$(top_builddir)/include
 AM_CFLAGS = -fPIC -Wall $(PCSC_CFLAGS) $(TALLOC_CFLAGS) $(LIBOSMOCORE_CFLAGS)
--- a/src/mslookup/mdns.c
+++ b/src/mslookup/mdns.c
@@ -45,6 +45,7 @@ static char *domain_from_query(void *ctx, const struct osmo_mslookup_query *quer
 	/* Get id from query */
 	switch (query->id.type) {
 		case OSMO_MSLOOKUP_ID_IMSI:
+		case OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED:
 			id = query->id.imsi;
 			break;
 		case OSMO_MSLOOKUP_ID_MSISDN:
--- a/src/mslookup/mslookup.c
+++ b/src/mslookup/mslookup.c
@@ -91,6 +91,7 @@ const struct value_string osmo_mslookup_id_type_names[] = {
 	{ OSMO_MSLOOKUP_ID_NONE, "none" },
 	{ OSMO_MSLOOKUP_ID_IMSI, "imsi" },
 	{ OSMO_MSLOOKUP_ID_MSISDN, "msisdn" },
+	{ OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED, "imsiauth" },
 	{}
 };

@@ -134,6 +135,7 @@ bool osmo_mslookup_id_valid(const struct osmo_mslookup_id *id)
 {
 	switch (id->type) {
 	case OSMO_MSLOOKUP_ID_IMSI:
+	case OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED:
 		return osmo_imsi_str_valid(id->imsi);
 	case OSMO_MSLOOKUP_ID_MSISDN:
 		return osmo_msisdn_str_valid(id->msisdn);
@@ -157,6 +159,7 @@ size_t osmo_mslookup_id_name_buf(char *buf, size_t buflen, const struct osmo_msl
 	struct osmo_strbuf sb = { .buf = buf, .len = buflen };
 	switch (id->type) {
 	case OSMO_MSLOOKUP_ID_IMSI:
+	case OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED:
 		OSMO_STRBUF_PRINTF(sb, "%s", id->imsi);
 		break;
 	case OSMO_MSLOOKUP_ID_MSISDN:
@@ -298,6 +301,7 @@ int osmo_mslookup_query_init_from_domain_str(struct osmo_mslookup_query *q, cons
 	id = second_last_dot + 1;
 	switch (q->id.type) {
 	case OSMO_MSLOOKUP_ID_IMSI:
+	case OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED:
 		rc = token(q->id.imsi, sizeof(q->id.imsi), id, last_dot);
 		if (rc)
 			return rc;
--- a/src/mslookup/mslookup_client.c
+++ b/src/mslookup/mslookup_client.c
@@ -154,16 +154,20 @@ void osmo_mslookup_client_rx_result(struct osmo_mslookup_client *client, uint32_
 	if (result->rc != OSMO_MSLOOKUP_RC_RESULT)
 		return;

+	/* If the client wants to see all results, send this result now */
+	if (req->handling.search_all && result->age > 0)
+		req->handling.result_cb(client, request_handle, &req->query, result);
+
 	/* If we already stored an earlier successful result, keep that if its age is younger. */
 	if (req->result.rc == OSMO_MSLOOKUP_RC_RESULT
-	    && result->age >= req->result.age)
+	    && result->age > req->result.age)
 		return;

 	req->result = *result;

 	/* If age == 0, it doesn't get any better, so return the result immediately. */
 	if (req->result.age == 0) {
-		osmo_mslookup_request_send_result(req, true);
+		osmo_mslookup_request_send_result(req, !req->handling.search_all);
 		return;
 	}

--- a/src/mslookup/osmo-mslookup-client.c
+++ b/src/mslookup/osmo-mslookup-client.c
@@ -133,6 +133,10 @@ CSV_HEADERS "\n"
 "		1000-5000@sip.voice.123.msisdn	Same, but silent for first second\n"
 "		10000-@smpp.sms.567.msisdn	Return 1 result after 10 seconds\n"
 "\n"
+"--search-all -A\n"
+"	Do not stop when a response with age of zero comes in.\n"
+"	This can be used to \"search\" the entire dGSM network if for\n"
+"	example there is a need to track down so-called \"evil twin\" hlr entries.\n"
 "--format -f csv (default)\n"
 "	Format result lines in CSV format.\n"
 "--no-csv-headers -H\n"
@@ -196,6 +200,7 @@ enum result_format {
 };

 static struct {
+	bool search_all;
 	bool daemon;
 	struct osmo_sockaddr_str mdns_addr;
 	uint32_t min_delay;
@@ -419,9 +424,9 @@ static void socket_client_close(struct socket_client *c)
 {
 	struct osmo_fd *ofd = &c->ofd;

+	osmo_fd_unregister(ofd);
 	close(ofd->fd);
 	ofd->fd = -1;
-	osmo_fd_unregister(ofd);

 	llist_del(&c->entry);
 	talloc_free(c);
@@ -429,7 +434,11 @@ static void socket_client_close(struct socket_client *c)

 void socket_client_respond_result(struct socket_client *c, const char *response)
 {
-	write(c->ofd.fd, response, strlen(response));
+	size_t len = strlen(response);
+	int rc = write(c->ofd.fd, response, len);
+
+	if (rc != len)
+		print_error("%s: write() returned %d instead of %zu\n", __func__, rc, len);
 }

 static int socket_read_cb(struct osmo_fd *ofd)
@@ -526,8 +535,13 @@ int socket_accept(struct osmo_fd *ofd, unsigned int flags)

 	llist_add(&c->entry, &globals.socket_clients);

-	if (globals.format == FORMAT_CSV && cmdline_opts.csv_headers)
-		write(c->ofd.fd, CSV_HEADERS, strlen(CSV_HEADERS));
+	if (globals.format == FORMAT_CSV && cmdline_opts.csv_headers) {
+		size_t len = strlen(CSV_HEADERS);
+		int rc = write(c->ofd.fd, CSV_HEADERS, strlen(CSV_HEADERS));
+
+		if (rc != len)
+			print_error("%s: write() returned %d instead of %zu\n", __func__, rc, len);
+	}

 	return 0;
 }
@@ -561,9 +575,9 @@ void socket_close(void)
 	llist_for_each_entry_safe(c, n, &globals.socket_clients, entry)
 		socket_client_close(c);
 	if (osmo_fd_is_registered(&globals.socket_ofd)) {
+		osmo_fd_unregister(&globals.socket_ofd);
 		close(globals.socket_ofd.fd);
 		globals.socket_ofd.fd = -1;
-		osmo_fd_unregister(&globals.socket_ofd);
 	}
 }

@@ -628,6 +642,7 @@ void start_query_str(const char *query_str)
 	const char *domain_str = query_str;
 	char *at;
 	struct osmo_mslookup_query_handling h = {
+		.search_all = cmdline_opts.search_all,
 		.min_wait_milliseconds = cmdline_opts.min_delay,
 		.result_timeout_milliseconds = cmdline_opts.timeout,
 		.result_cb = mslookup_result_cb,
@@ -730,6 +745,7 @@ int main(int argc, char **argv)
 		int option_index = 0;

 		static struct option long_options[] = {
+			{ "search-all", 0, 0, 'A' },
 			{ "format", 1, 0, 'f' },
 			{ "no-csv-headers", 0, 0, 'H' },
 			{ "daemon", 0, 0, 'd' },
@@ -755,12 +771,15 @@ int main(int argc, char **argv)
 		} \
 	} while (0)

-		c = getopt_long(argc, argv, "f:Hdm:M:D:t:T:s:SqhV", long_options, &option_index);
+		c = getopt_long(argc, argv, "Af:Hdm:M:D:t:T:s:SqhV", long_options, &option_index);

 		if (c == -1)
 			break;

 		switch (c) {
+		case 'A':
+			cmdline_opts.search_all = true;
+			break;
 		case 'f':
 			cmdline_opts.format_str = optarg;
 			break;
--- a/src/mslookup_server.c
+++ b/src/mslookup_server.c
@@ -192,12 +192,37 @@ static void mslookup_server_rx_hlr_gsup(const struct osmo_mslookup_query *query,
 {
 	const struct mslookup_service_host *host;
 	int rc;
+	bool exists = false;
+	bool auth_imsi_only = false;
+	bool created_on_demand = false;
+
 	switch (query->id.type) {
+	case OSMO_MSLOOKUP_ID_IMSI_AUTHORIZED:
+		auth_imsi_only = true;
 	case OSMO_MSLOOKUP_ID_IMSI:
+		/* Entries that have been created by subscriber create on demand
+		   will have default msisdn length. and will not have any vlr_number entry.
+		   We should not answer for these, unless they have CS/PS service. */
+		if (g_hlr->mslookup.ignore_created_on_demand) {
+			rc = db_subscr_is_created_on_demand_by_imsi(g_hlr->dbc, query->id.imsi,
+								    g_hlr->subscr_create_on_demand.rand_msisdn_len);
+			if (!rc) {
+				exists = true;
+				created_on_demand = true;
+				rc = -ENOENT;
+				break;
+			}
+		}
 		rc = db_subscr_exists_by_imsi(g_hlr->dbc, query->id.imsi);
+		if (g_hlr->mslookup.auth_imsi_only || auth_imsi_only) {
+			if (!rc)
+				exists = true;
+			rc = db_subscr_authorized_by_imsi(g_hlr->dbc, query->id.imsi);
+		}
 		break;
 	case OSMO_MSLOOKUP_ID_MSISDN:
 		rc = db_subscr_exists_by_msisdn(g_hlr->dbc, query->id.msisdn);
+		/* FIXME: The log message below might not match */
 		break;
 	default:
 		LOGP(DMSLOOKUP, LOGL_ERROR, "Unknown mslookup ID type: %d\n", query->id.type);
@@ -206,8 +231,11 @@ static void mslookup_server_rx_hlr_gsup(const struct osmo_mslookup_query *query,
 	}

 	if (rc) {
-		LOGP(DMSLOOKUP, LOGL_DEBUG, "%s: does not exist in local HLR\n",
-		     osmo_mslookup_result_name_c(OTC_SELECT, query, NULL));
+		LOGP(DMSLOOKUP, LOGL_DEBUG, "%s: %s%s%s in local HLR\n",
+		     osmo_mslookup_result_name_c(OTC_SELECT, query, NULL),
+		     (exists) ? "exists but" : "does not exist",
+		     (created_on_demand) ? " is created on demand and since untouched" : "",
+		     (exists && !created_on_demand) ? " is not authorized" : "");
 		*result = not_found;
 		return;
 	}
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -92,7 +92,11 @@ static void proxy_pending_req_remote_hlr_connect_result(struct osmo_gsup_req *re
 			osmo_gsup_req_respond(req, &gsup_reply, false, true);
 			return;
 		}
-		osmo_gsup_req_respond_err(req, g_hlr->no_proxy_reject_cause,
+
+		osmo_gsup_req_respond_err(req,
+					  (req->gsup.cn_domain == OSMO_GSUP_CN_DOMAIN_CS) ?
+					  g_hlr->no_proxy_reject_cause.cs :
+					  g_hlr->no_proxy_reject_cause.ps,
 					  "Proxy: Failed to connect to home HLR");
 		return;
 	}
@@ -113,6 +117,19 @@ static bool proxy_deferred_gsup_req_waiting(struct proxy *proxy, const char *ims
 	return false;
 }

+struct osmo_gsup_req *proxy_deferred_gsup_req_get_by_imsi(struct proxy *proxy, const char *imsi)
+{
+	struct proxy_pending_gsup_req *p;
+	OSMO_ASSERT(imsi);
+
+	llist_for_each_entry(p, &proxy->pending_gsup_reqs, entry) {
+		if (strcmp(p->req->gsup.imsi, imsi))
+			continue;
+		return p->req;
+	}
+	return NULL;
+}
+
 /* Result of looking for remote HLR. If it failed, pass remote_hlr as NULL. On failure, the remote_hlr may be passed
 * NULL. */
 static void proxy_deferred_gsup_req_pop(struct proxy *proxy, const char *imsi, struct remote_hlr *remote_hlr)
--- a/tests/auc/Makefile.am
+++ b/tests/auc/Makefile.am
@@ -2,12 +2,12 @@ SUBDIRS = gen_ts_55_205_test_sets

 AM_CPPFLAGS = \
 	$(all_includes) \
+	-I$(top_srcdir)/include \
 	$(NULL)

 AM_CFLAGS = \
 	-Wall \
 	-ggdb3 \
-	-I$(top_srcdir)/include \
 	$(LIBOSMOCORE_CFLAGS) \
 	$(LIBOSMOGSM_CFLAGS) \
 	$(NULL)
@@ -30,8 +30,8 @@ auc_test_SOURCES = \
 	$(NULL)

 auc_test_LDADD = \
-	$(top_srcdir)/src/auc.c \
-	$(top_srcdir)/src/logging.c \
+	$(top_builddir)/src/auc.o \
+	$(top_builddir)/src/logging.o \
 	$(LIBOSMOCORE_LIBS) \
 	$(LIBOSMOGSM_LIBS) \
 	$(NULL)
@@ -41,8 +41,8 @@ auc_ts_55_205_test_sets_SOURCES = \
 	$(NULL)

 auc_ts_55_205_test_sets_LDADD = \
-	$(top_srcdir)/src/auc.c \
-	$(top_srcdir)/src/logging.c \
+	$(top_builddir)/src/auc.o \
+	$(top_builddir)/src/logging.o \
 	$(LIBOSMOCORE_LIBS) \
 	$(LIBOSMOGSM_LIBS) \
 	$(NULL)
--- a/tests/auc/auc_test.c
+++ b/tests/auc/auc_test.c
@@ -116,14 +116,14 @@ int rand_get(uint8_t *rand, unsigned int len)
 /* Subscriber with 2G-only (COMP128v1) authentication data */
 static void test_gen_vectors_2g_only(void)
 {
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct osmo_auth_vector vec;
 	int rc;

 	comment_start();

-	aud2g = (struct osmo_sub_auth_data){
+	aud2g = (struct osmo_sub_auth_data2){
 		.type = OSMO_AUTH_TYPE_GSM,
 		.algo = OSMO_AUTH_ALG_COMP128v1,
 	};
@@ -131,7 +131,7 @@ static void test_gen_vectors_2g_only(void)
 	osmo_hexparse("EB215756028D60E3275E613320AEC880",
 		      aud2g.u.gsm.ki, sizeof(aud2g.u.gsm.ki));

-	aud3g = (struct osmo_sub_auth_data){ 0 };
+	aud3g = (struct osmo_sub_auth_data2){ 0 };

 	next_rand("39fa2f4e3d523d8619a73b4f65c3e14d", true);

@@ -179,14 +179,14 @@ static void test_gen_vectors_2g_only(void)
 * reflects the default configuration of sysmoUSIM-SJS1 */
 static void test_gen_vectors_2g_plus_3g(void)
 {
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct osmo_auth_vector vec;
 	int rc;

 	comment_start();

-	aud2g = (struct osmo_sub_auth_data){
+	aud2g = (struct osmo_sub_auth_data2){
 		.type = OSMO_AUTH_TYPE_GSM,
 		.algo = OSMO_AUTH_ALG_COMP128v1,
 	};
@@ -194,9 +194,11 @@ static void test_gen_vectors_2g_plus_3g(void)
 	osmo_hexparse("EB215756028D60E3275E613320AEC880",
 		      aud2g.u.gsm.ki, sizeof(aud2g.u.gsm.ki));

-	aud3g = (struct osmo_sub_auth_data){
+	aud3g = (struct osmo_sub_auth_data2){
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.algo = OSMO_AUTH_ALG_MILENAGE,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 		.u.umts.sqn = 31,
 	};

@@ -292,8 +294,8 @@ void _test_gen_vectors_3g_only__expect_vecs(struct osmo_auth_vector vecs[3])
 * tuples are suitable for both 2G and 3G authentication */
 static void test_gen_vectors_3g_only(void)
 {
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct osmo_auth_vector vec;
 	struct osmo_auth_vector vecs[3];
 	uint8_t auts[14];
@@ -302,11 +304,13 @@ static void test_gen_vectors_3g_only(void)

 	comment_start();

-	aud2g = (struct osmo_sub_auth_data){ 0 };
+	aud2g = (struct osmo_sub_auth_data2){ 0 };

-	aud3g = (struct osmo_sub_auth_data){
+	aud3g = (struct osmo_sub_auth_data2){
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.algo = OSMO_AUTH_ALG_MILENAGE,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 		.u.umts.sqn = 31,
 	};

@@ -466,18 +470,20 @@ static void test_gen_vectors_3g_only(void)
 * 2G and 3G authentication */
 static void test_gen_vectors_3g_xor(void)
 {
-	struct osmo_sub_auth_data aud2g;
-	struct osmo_sub_auth_data aud3g;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
 	struct osmo_auth_vector vec;
 	int rc;

 	comment_start();

-	aud2g = (struct osmo_sub_auth_data){ 0 };
+	aud2g = (struct osmo_sub_auth_data2){ 0 };

-	aud3g = (struct osmo_sub_auth_data){
+	aud3g = (struct osmo_sub_auth_data2){
 		.type = OSMO_AUTH_TYPE_UMTS,
-		.algo = OSMO_AUTH_ALG_XOR,
+		.algo = OSMO_AUTH_ALG_XOR_3G,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 		.u.umts.sqn = 0,
 	};

@@ -517,39 +523,43 @@ void test_gen_vectors_bad_args(void)
 	int rc;
 	int i;

-	struct osmo_sub_auth_data aud2g = {
+	struct osmo_sub_auth_data2 aud2g = {
 		.type = OSMO_AUTH_TYPE_GSM,
 		.algo = OSMO_AUTH_ALG_COMP128v1,
 	};

-	struct osmo_sub_auth_data aud3g = {
+	struct osmo_sub_auth_data2 aud3g = {
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.algo = OSMO_AUTH_ALG_MILENAGE,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 	};

-	struct osmo_sub_auth_data aud2g_noalg = {
+	struct osmo_sub_auth_data2 aud2g_noalg = {
 		.type = OSMO_AUTH_TYPE_GSM,
 		.algo = OSMO_AUTH_ALG_NONE,
 	};

-	struct osmo_sub_auth_data aud3g_noalg = {
+	struct osmo_sub_auth_data2 aud3g_noalg = {
 		.type = OSMO_AUTH_TYPE_UMTS,
 		.algo = OSMO_AUTH_ALG_NONE,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 	};

-	struct osmo_sub_auth_data aud_notype = {
+	struct osmo_sub_auth_data2 aud_notype = {
 		.type = OSMO_AUTH_TYPE_NONE,
 		.algo = OSMO_AUTH_ALG_MILENAGE,
 	};

-	struct osmo_sub_auth_data no_aud = {
+	struct osmo_sub_auth_data2 no_aud = {
 		.type = OSMO_AUTH_TYPE_NONE,
 		.algo = OSMO_AUTH_ALG_NONE,
 	};

 	struct {
-		struct osmo_sub_auth_data *aud2g;
-		struct osmo_sub_auth_data *aud3g;
+		struct osmo_sub_auth_data2 *aud2g;
+		struct osmo_sub_auth_data2 *aud3g;
 		uint8_t *rand_auts;
 		uint8_t *auts;
 		const char *label;
--- a/tests/auc/gen_ts_55_205_test_sets/func_template.c
+++ b/tests/auc/gen_ts_55_205_test_sets/func_template.c
@@ -24,43 +24,46 @@

 static void {func_name}(void)
 {{
-        struct osmo_sub_auth_data aud2g;
-        struct osmo_sub_auth_data aud3g;
-        struct osmo_auth_vector vec;
-        int rc;
+	struct osmo_sub_auth_data2 aud2g;
+	struct osmo_sub_auth_data2 aud3g;
+	struct osmo_auth_vector vec;
+	int rc;

-        comment_start();
+	comment_start();

-        aud2g = (struct osmo_sub_auth_data){{ 0 }};
+	aud2g = (struct osmo_sub_auth_data2){{ 0 }};

-        aud3g = (struct osmo_sub_auth_data){{
-                .type = OSMO_AUTH_TYPE_UMTS,
-                .algo = OSMO_AUTH_ALG_MILENAGE,
+	aud3g = (struct osmo_sub_auth_data2){{
+		.type = OSMO_AUTH_TYPE_UMTS,
+		.algo = OSMO_AUTH_ALG_MILENAGE,
+		.u.umts.k_len = 16,
+		.u.umts.opc_len = 16,
 		.u.umts.sqn = 31,
-        }};
+	}};

-        osmo_hexparse("{Ki}",
-                      aud3g.u.umts.k, sizeof(aud3g.u.umts.k));
-        osmo_hexparse("{OPc}",
-                      aud3g.u.umts.opc, sizeof(aud3g.u.umts.opc));
+	osmo_hexparse("{Ki}",
+		      aud3g.u.umts.k, sizeof(aud3g.u.umts.k));
+	osmo_hexparse("{OPc}",
+		      aud3g.u.umts.opc, sizeof(aud3g.u.umts.opc));

-        osmo_hexparse("{RAND}",
-                      fake_rand, sizeof(fake_rand));
+	osmo_hexparse("{RAND}",
+		      fake_rand, sizeof(fake_rand));

-        vec = (struct osmo_auth_vector){{ {{0}} }};
+	vec = (struct osmo_auth_vector){{ {{0}} }};
+	vec.res_len = 8;
 	VERBOSE_ASSERT(aud3g.u.umts.sqn, == 31, "%"PRIu64);
-        rc = auc_compute_vectors(&vec, 1, &aud2g, &aud3g, NULL, NULL);
-        VERBOSE_ASSERT(rc, == 1, "%d");
+	rc = auc_compute_vectors(&vec, 1, &aud2g, &aud3g, NULL, NULL);
+	VERBOSE_ASSERT(rc, == 1, "%d");
 	VERBOSE_ASSERT(aud3g.u.umts.sqn, == 32, "%"PRIu64);

-        VEC_IS(&vec,
-               "  rand: {RAND}\n"
-               "  ck: {MIL3G-CK}\n"
-               "  ik: {MIL3G-IK}\n"
-               "  res: {MIL3G-RES}0000000000000000\n"
-               "  kc: {Kc}\n"
-               "  sres: {SRES#1}\n"
-              );
+	VEC_IS(&vec,
+	       "  rand: {RAND}\n"
+	       "  ck: {MIL3G-CK}\n"
+	       "  ik: {MIL3G-IK}\n"
+	       "  res: {MIL3G-RES}0000000000000000\n"
+	       "  kc: {Kc}\n"
+	       "  sres: {SRES#1}\n"
+	      );

 	comment_end();
 }}
--- a/tests/auc/gen_ts_55_205_test_sets/main_template.c
+++ b/tests/auc/gen_ts_55_205_test_sets/main_template.c
@@ -55,7 +55,7 @@ char *vec_str(const struct osmo_auth_vector *vec)
 	if (pos >= end) \
 		return buf; \
 	pos += snprintf(pos, sizeof(buf) - (pos - buf), \
-                        "  " #what ": %s\n", \
+			"  " #what ": %s\n", \
 			osmo_hexdump_nospc((void*)&vec->what, sizeof(vec->what)))

 	append(rand);
@@ -71,7 +71,7 @@ char *vec_str(const struct osmo_auth_vector *vec)

 #define VEC_IS(vec, expect) do { \
 		char *_is = vec_str(vec); \
-	        if (strcmp(_is, expect)) { \
+		if (strcmp(_is, expect)) { \
 			fprintf(stderr, "MISMATCH! expected ==\n%s\n", \
 				expect); \
 			char *a = _is; \
--- a/tests/db/Makefile.am
+++ b/tests/db/Makefile.am
@@ -1,7 +1,10 @@
-AM_CFLAGS = \
+AM_CPPFLAGS = \
 	$(all_includes) \
 	-I$(top_srcdir)/include \
 	-I$(top_builddir)/include \
+	$(NULL)
+
+AM_CFLAGS = \
 	-Wall \
 	-ggdb3 \
 	$(LIBOSMOCORE_CFLAGS) \
--- a/tests/db/db_test.c
+++ b/tests/db/db_test.c
@@ -122,16 +122,16 @@ static void _fill_invalid(void *dest, size_t size)
 /* Not linking the real auc_compute_vectors(), just returning num_vec.
 * This gets called by db_get_auc(), but we're only interested in its rc. */
 int auc_compute_vectors(struct osmo_auth_vector *vec, unsigned int num_vec,
-			struct osmo_sub_auth_data *aud2g,
-			struct osmo_sub_auth_data *aud3g,
+			struct osmo_sub_auth_data2 *aud2g,
+			struct osmo_sub_auth_data2 *aud3g,
 			const uint8_t *rand_auts, const uint8_t *auts)
 { return num_vec; }

 static struct db_context *dbc = NULL;
 static void *ctx = NULL;
 static struct hlr_subscriber g_subscr;
-static struct osmo_sub_auth_data g_aud2g;
-static struct osmo_sub_auth_data g_aud3g;
+static struct osmo_sub_auth_data2 g_aud2g;
+static struct osmo_sub_auth_data2 g_aud3g;
 static int g_rc;
 static int64_t g_id;

@@ -180,18 +180,21 @@ void dump_subscr(struct hlr_subscriber *subscr)
 #undef Pb
 }

-void dump_aud(const char *label, struct osmo_sub_auth_data *aud)
+void dump_aud(const char *label, struct osmo_sub_auth_data2 *aud)
 {
 	if (aud->type == OSMO_AUTH_TYPE_NONE) {
 		fprintf(stderr, "%s: none\n", label);
 		return;
 	}

-	fprintf(stderr, "%s: struct osmo_sub_auth_data {\n", label);
+	fprintf(stderr, "%s: struct osmo_sub_auth_data2 {\n", label);
 #define Pf(name, fmt) \
 	Pfo(name, fmt, aud)
 #define Phex(name) \
 	Pfv(name, "'%s'", osmo_hexdump_nospc(aud->name, sizeof(aud->name)))
+#define Phexl(name, len) \
+	Pfv(name, "'%s'", osmo_hexdump_nospc(aud->name, aud->len))
+

 	Pfv(type, "%s", osmo_sub_auth_type_name(aud->type));
 	Pfv(algo, "%s", osmo_auth_alg_name(aud->algo));
@@ -200,9 +203,9 @@ void dump_aud(const char *label, struct osmo_sub_auth_data *aud)
 		Phex(u.gsm.ki);
 		break;
 	case OSMO_AUTH_TYPE_UMTS:
-		Phex(u.umts.opc);
+		Phexl(u.umts.opc, u.umts.opc_len);
 		Pf(u.umts.opc_is_op, "%u");
-		Phex(u.umts.k);
+		Phexl(u.umts.k, u.umts.k_len);
 		Phex(u.umts.amf);
 		if (aud->u.umts.sqn) {
 			Pf(u.umts.sqn, "%"PRIu64);
@@ -219,6 +222,7 @@ void dump_aud(const char *label, struct osmo_sub_auth_data *aud)

 #undef Pf
 #undef Phex
+#undef Phexl
 }

 void db_raw_sql(struct db_context *dbc, const char *sql)
@@ -586,7 +590,7 @@ static void test_subscr_aud(void)
 	ASSERT_SEL_AUD(imsi0, 0, id);

 	ASSERT_RC(db_subscr_update_aud_by_id(dbc, id,
-		mk_aud_2g(OSMO_AUTH_ALG_XOR, "CededEffacedAceFacedBadFadedBeef")),
+		mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "CededEffacedAceFacedBadFadedBeef")),
 		0);
 	ASSERT_SEL_AUD(imsi0, 0, id);

@@ -604,7 +608,7 @@ static void test_subscr_aud(void)
 		-ENOENT);

 	ASSERT_RC(db_subscr_update_aud_by_id(dbc, id,
-		mk_aud_2g(OSMO_AUTH_ALG_XOR, "CededEffacedAceFacedBadFadedBeef")),
+		mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "CededEffacedAceFacedBadFadedBeef")),
 		0);
 	ASSERT_SEL_AUD(imsi0, 0, id);

@@ -707,12 +711,12 @@ static void test_subscr_aud(void)
 	ASSERT_SEL_AUD(imsi0, 0, id);

 	ASSERT_RC(db_subscr_update_aud_by_id(dbc, id,
-		mk_aud_2g(OSMO_AUTH_ALG_XOR, "f000000000000f00000000000f000000f00000000")),
+		mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "f000000000000f00000000000f000000f00000000")),
 		-EINVAL);
 	ASSERT_SEL_AUD(imsi0, 0, id);

 	ASSERT_RC(db_subscr_update_aud_by_id(dbc, id,
-		mk_aud_2g(OSMO_AUTH_ALG_XOR, "f00")),
+		mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "f00")),
 		-EINVAL);
 	ASSERT_SEL_AUD(imsi0, 0, id);

--- a/tests/db/db_test.err
+++ b/tests/db/db_test.err
@@ -824,7 +824,7 @@ db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_COMP128v1, "01234567
 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v1,
  .u.gsm.ki = '0123456789abcdef0123456789abcdef',
@@ -841,7 +841,7 @@ db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_COMP128v1, "01234567
 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v1,
  .u.gsm.ki = '0123456789abcdef0123456789abcdef',
@@ -853,7 +853,7 @@ db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_COMP128v2, "BeadedBe
 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v2,
  .u.gsm.ki = 'beadedbeeaced1ebbeddefacedfacade',
@@ -865,21 +865,21 @@ db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_COMP128v3, "DeafBedd
 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'deafbeddedbabeacceededfadeddecaf',
 }
 3G: none

-db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR, "CededEffacedAceFacedBadFadedBeef")) --> 0
+db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "CededEffacedAceFacedBadFadedBeef")) --> 0

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
-  .algo = XOR,
+  .algo = XOR-2G,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
 3G: none
@@ -900,14 +900,14 @@ DAUC IMSI='123456789000000': No 3G Auth Data

 db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_NONE, NULL)) --> -ENOENT

-db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR, "CededEffacedAceFacedBadFadedBeef")) --> 0
+db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "CededEffacedAceFacedBadFadedBeef")) --> 0

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 3G Auth Data

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
-  .algo = XOR,
+  .algo = XOR-2G,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
 3G: none
@@ -932,7 +932,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -954,7 +954,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -970,7 +970,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'deaf0ff1ced0d0dabbedd1ced1cef00d',
@@ -985,7 +985,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1001,7 +1001,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'cededeffacedacefacedbadfadedbeef',
@@ -1033,7 +1033,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'cededeffacedacefacedbadfadedbeef',
@@ -1069,12 +1069,12 @@ db_subscr_update_aud_by_id(dbc, id, mk_aud_3g(OSMO_AUTH_ALG_MILENAGE, "BeefedCaf

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1097,12 +1097,12 @@ DAUC Cannot update auth tokens: Unknown auth algo: 99999

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1112,17 +1112,17 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
  .u.umts.ind_bitlen = 5,
 }

-db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR, "f000000000000f00000000000f000000f00000000")) --> -EINVAL
+db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "f000000000000f00000000000f000000f00000000")) --> -EINVAL
 DAUC Cannot update auth tokens: Invalid KI: 'f000000000000f00000000000f000000f00000000'

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1132,17 +1132,17 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
  .u.umts.ind_bitlen = 5,
 }

-db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR, "f00")) --> -EINVAL
+db_subscr_update_aud_by_id(dbc, id, mk_aud_2g(OSMO_AUTH_ALG_XOR_2G, "f00")) --> -EINVAL
 DAUC Cannot update auth tokens: Invalid KI: 'f00'

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1157,12 +1157,12 @@ DAUC Cannot update auth tokens: auth algo not suited for 2G: MILENAGE

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1177,12 +1177,12 @@ DAUC Cannot update auth tokens: Invalid OP/OPC: '0f000000000000f00000000000f0000

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1197,12 +1197,12 @@ DAUC Cannot update auth tokens: Invalid K: '000000000000f00000000000f000000'

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1217,12 +1217,12 @@ DAUC Cannot update auth tokens: Invalid ind_bitlen: 29

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1237,12 +1237,12 @@ DAUC Cannot update auth tokens: Invalid OP/OPC: 'X000000000000f00000000000f00000

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1257,12 +1257,12 @@ DAUC Cannot update auth tokens: Invalid K: 'f000000000000 f00000000000 f000000'

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0

-2G: struct osmo_sub_auth_data {
+2G: struct osmo_sub_auth_data2 {
  .type = GSM,
  .algo = COMP128v3,
  .u.gsm.ki = 'cededeffacedacefacedbadfadedbeef',
 }
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1338,7 +1338,7 @@ sqlite3_prepare_v2(dbc->db, sql, -1, &stmt, NULL) --> SQLITE_OK
 sqlite3_step(stmt) --> SQLITE_DONE

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> -ENOKEY
-DAUC IMSI='123456789000000': Error reading Ki, expected length 16 but has length 15
+DAUC IMSI='123456789000000': Error reading Ki, expected min length 16 but has length 15
 DAUC IMSI='123456789000000': No 3G Auth Data


@@ -1359,7 +1359,7 @@ sqlite3_step(stmt) --> SQLITE_DONE

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> -5
 DAUC IMSI='123456789000000': No 2G Auth Data
-DAUC IMSI='123456789000000': Error reading K, expected length 16 but has length 15
+DAUC IMSI='123456789000000': Error reading K, expected min length 16 but has length 15



@@ -1374,7 +1374,7 @@ sqlite3_step(stmt) --> SQLITE_DONE

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> -5
 DAUC IMSI='123456789000000': No 2G Auth Data
-DAUC IMSI='123456789000000': Error reading OP, expected length 16 but has length 15
+DAUC IMSI='123456789000000': Error reading OP, expected min length 16 but has length 15



@@ -1389,7 +1389,7 @@ sqlite3_step(stmt) --> SQLITE_DONE

 db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> -5
 DAUC IMSI='123456789000000': No 2G Auth Data
-DAUC IMSI='123456789000000': Error reading OPC, expected length 16 but has length 15
+DAUC IMSI='123456789000000': Error reading OPC, expected min length 16 but has length 15



@@ -1458,7 +1458,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1477,7 +1477,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1495,7 +1495,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1513,7 +1513,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1534,7 +1534,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1550,7 +1550,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1568,7 +1568,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
@@ -1586,7 +1586,7 @@ db_get_auth_data(dbc, imsi0, &g_aud2g, &g_aud3g, &g_id) --> 0
 DAUC IMSI='123456789000000': No 2G Auth Data

 2G: none
-3G: struct osmo_sub_auth_data {
+3G: struct osmo_sub_auth_data2 {
  .type = UMTS,
  .algo = MILENAGE,
  .u.umts.opc = 'beefedcafefaceacedaddeddecadefee',
--- a/tests/db_upgrade/create_subscribers.vty
+++ b/tests/db_upgrade/create_subscribers.vty
@@ -43,5 +43,5 @@ OsmoHLR# subscriber imsi 5555555 create
    MSISDN: none
 OsmoHLR# subscriber imsi 5555555 update msisdn 55555555555555
 % Updated subscriber IMSI='5555555' to MSISDN='55555555555555'
-OsmoHLR# subscriber imsi 5555555 update aud2g xor ki 55555555555555555555555555555555
+OsmoHLR# subscriber imsi 5555555 update aud2g xor-2g ki 55555555555555555555555555555555
 OsmoHLR# subscriber imsi 5555555 update aud3g milenage k 55555555555555555555555555555555 opc 55555555555555555555555555555555
--- a/tests/db_upgrade/db_upgrade_test.ok
+++ b/tests/db_upgrade/db_upgrade_test.ok
@@ -12,7 +12,7 @@ Table auc_2g contents:
 algo_id_2g|ki|subscriber_id
 1|BeefedCafeFaceAcedAddedDecadeFee|1
 2|33333333333333333333333333333333|4
-4|55555555555555555555555555555555|6
+6|55555555555555555555555555555555|6

 Table: auc_3g
 name|type|notnull|dflt_value|pk
@@ -86,6 +86,7 @@ DDB Database <PATH>test.db' has been upgraded to HLR DB schema version 3
 DDB Database <PATH>test.db' has been upgraded to HLR DB schema version 4
 DDB Database <PATH>test.db' has been upgraded to HLR DB schema version 5
 DDB Database <PATH>test.db' has been upgraded to HLR DB schema version 6
+DDB Database <PATH>test.db' has been upgraded to HLR DB schema version 7
 DMAIN Cmdline option --db-check: Database was opened successfully, quitting.

 Resulting db:
@@ -100,15 +101,15 @@ Table auc_2g contents:
 algo_id_2g|ki|subscriber_id
 1|BeefedCafeFaceAcedAddedDecadeFee|1
 2|33333333333333333333333333333333|4
-4|55555555555555555555555555555555|6
+6|55555555555555555555555555555555|6

 Table: auc_3g
 name|type|notnull|dflt_value|pk
 algo_id_3g|INTEGER|1||0
 ind_bitlen|INTEGER|1|5|0
-k|VARCHAR(32)|1||0
-op|VARCHAR(32)|0||0
-opc|VARCHAR(32)|0||0
+k|VARCHAR(64)|1||0
+op|VARCHAR(64)|0||0
+opc|VARCHAR(64)|0||0
 sqn|INTEGER|1|0|0
 subscriber_id|INTEGER|0||1

@@ -179,5 +180,5 @@ osmo-hlr --database $db --db-check --config-file $srcdir/osmo-hlr.cfg
 rc = 0
 DMAIN hlr starting
 DDB using database: <PATH>test.db
-DDB Database <PATH>test.db' has HLR DB schema version 6
+DDB Database <PATH>test.db' has HLR DB schema version 7
 DMAIN Cmdline option --db-check: Database was opened successfully, quitting.
--- a/tests/db_upgrade/hlr_db_v0.sql
+++ b/tests/db_upgrade/hlr_db_v0.sql
@@ -61,7 +61,7 @@ CREATE TABLE auc_2g (
 );
 INSERT INTO auc_2g VALUES(1,1,'BeefedCafeFaceAcedAddedDecadeFee');
 INSERT INTO auc_2g VALUES(4,2,'33333333333333333333333333333333');
-INSERT INTO auc_2g VALUES(6,4,'55555555555555555555555555555555');
+INSERT INTO auc_2g VALUES(6,6,'55555555555555555555555555555555');
 CREATE TABLE auc_3g (
 	subscriber_id	INTEGER PRIMARY KEY,	-- subscriber.id
 	algo_id_3g	INTEGER NOT NULL,	-- enum osmo_auth_algo value
--- a/tests/gsup/Makefile.am
+++ b/tests/gsup/Makefile.am
@@ -1,9 +1,9 @@
 AM_CPPFLAGS = \
 	$(all_includes) \
+	-I$(top_srcdir)/include \
 	$(NULL)

 AM_CFLAGS = \
-	-I$(top_srcdir)/include \
 	$(LIBOSMOCORE_CFLAGS) \
 	$(LIBOSMOGSM_CFLAGS) \
 	$(NULL)
--- a/tests/mslookup/Makefile.am
+++ b/tests/mslookup/Makefile.am
@@ -1,11 +1,11 @@
 AM_CPPFLAGS = \
 	$(all_includes) \
+	-I$(top_srcdir)/include \
 	$(NULL)

 AM_CFLAGS = \
 	-Wall \
 	-ggdb3 \
-	-I$(top_srcdir)/include \
 	$(LIBOSMOCORE_CFLAGS) \
 	$(LIBOSMOGSM_CFLAGS) \
 	$(LIBOSMOABIS_CFLAGS) \
--- a/tests/test_nodes.vty
+++ b/tests/test_nodes.vty
@@ -47,12 +47,14 @@ OsmoHLR(config-hlr)# ?
  no                           Negate a command or set its defaults
  ussd                         USSD Configuration
  ncss-guard-timeout           Set guard timer for NCSS (call independent SS) session activity
+  smsc                         Configuration of GSUP routing to SMSCs
  reject-cause                 GSUP/GMM cause to be sent
  store-imei                   Save the IMEI in the database when receiving Check IMEI requests. Note that an MSC does not necessarily send Check IMEI requests (for OsmoMSC, you may want to set 'check-imei-rqd 1').
  subscriber-create-on-demand  Make a new record when a subscriber is first seen.
 OsmoHLR(config-hlr)# list
 ...
  gsup
+  ps
  database PATH
  euse NAME
  no euse NAME
@@ -62,10 +64,16 @@ OsmoHLR(config-hlr)# list
  ussd default-route external EUSE
  no ussd default-route
  ncss-guard-timeout <0-255>
+  smsc entity NAME
+  no smsc entity NAME
+  smsc route NUMBER NAME
+  no smsc route NUMBER
+  smsc default-route NAME
+  no smsc default-route
  reject-cause (not-found|no-proxy) (imsi-unknown|illegal-ms|plmn-not-allowed|la-not-allowed|roaming-not-allowed|no-suitable-cell-in-la|net-fail|congestion|auth-unacceptable|proto-error-unspec)
  store-imei
  no store-imei
-  subscriber-create-on-demand (no-msisdn|<3-15>) (none|cs|ps|cs+ps)
+  subscriber-create-on-demand (no-msisdn|msisdn-from-imsi|<3-15>) (none|cs|ps|cs+ps)
  no subscriber-create-on-demand

 OsmoHLR(config-hlr)# gsup
@@ -107,11 +115,18 @@ log stderr
 hlr
 store-imei
 database hlr_vty_test.db
+ no subscriber-create-on-demand
 gsup
  bind ip 127.0.0.1
  ipa-name unnamed-HLR
 ussd route prefix *#100# internal own-msisdn
 ussd route prefix *#101# internal own-imsi
+ ps
+  pdp-profiles default
+   profile 1
+    apn internet
+   profile 2
+    apn *
 end

 OsmoHLR# configure terminal
@@ -448,3 +463,44 @@ mslookup
 client
  mdns bind 239.192.23.42 4266
 ...
+OsmoHLR(config-mslookup-server)# end
+OsmoHLR# configure terminal
+
+OsmoHLR(config)# hlr
+OsmoHLR(config-hlr)# ps?
+  ps  Configure the PS options
+
+OsmoHLR(config-hlr)# ps
+
+OsmoHLR(config-hlr-ps)# list
+...
+  pdp-profiles default
+  no pdp-profiles default
+...
+OsmoHLR(config-hlr-ps)# no pdp-profiles default
+
+
+OsmoHLR(config-hlr-ps)# pdp-profiles default
+OsmoHLR(config-hlr-ps-pdp-profiles)# ?
+...
+  profile  Configure a PDP profile
+...
+OsmoHLR(config-hlr-ps-pdp-profiles)# profile 1
+
+OsmoHLR(config-hlr-ps-pdp-profile)# ?
+...
+  apn    Configure the APN.
+...
+OsmoHLR(config-hlr-ps-pdp-profile)# apn internet
+OsmoHLR(config-hlr-ps-pdp-profile)# exit
+OsmoHLR(config-hlr-ps-pdp-profiles)# profile 2
+OsmoHLR(config-hlr-ps-pdp-profile)# apn *
+OsmoHLR(config-hlr-ps-pdp-profile)# show running-config
+...
+ ps
+  pdp-profiles default
+   profile 1
+    apn internet
+   profile 2
+    apn *
+...
--- a/tests/test_subscr_create_on_demand.vty
+++ b/tests/test_subscr_create_on_demand.vty
@@ -10,6 +10,14 @@ hlr
 subscriber-create-on-demand no-msisdn none
 ...

+OsmoHLR(config-hlr)# subscriber-create-on-demand msisdn-from-imsi cs+ps
+OsmoHLR(config-hlr)# show running-config
+...
+hlr
+...
+ subscriber-create-on-demand msisdn-from-imsi cs+ps
+...
+
 OsmoHLR(config-hlr)# subscriber-create-on-demand 3 none
 OsmoHLR(config-hlr)# show running-config
 ...
--- a/tests/test_subscriber.ctrl
+++ b/tests/test_subscriber.ctrl
@@ -674,11 +674,11 @@ lmsi	00000000
 GET 112 subscriber.by-imsi-901991234567891.aud2g
 GET_REPLY 112 subscriber.by-imsi-901991234567891.aud2g none

-SET 113 subscriber.by-imsi-901991234567891.aud2g xor,c01ffedc1cadaeac1d1f1edacac1ab0a
+SET 113 subscriber.by-imsi-901991234567891.aud2g xor-2g,c01ffedc1cadaeac1d1f1edacac1ab0a
 SET_REPLY 113 subscriber.by-imsi-901991234567891.aud2g OK

 GET 114 subscriber.by-imsi-901991234567891.aud2g
-GET_REPLY 114 subscriber.by-imsi-901991234567891.aud2g XOR,c01ffedc1cadaeac1d1f1edacac1ab0a
+GET_REPLY 114 subscriber.by-imsi-901991234567891.aud2g XOR-2G,c01ffedc1cadaeac1d1f1edacac1ab0a

 SET 115 subscriber.by-imsi-901991234567891.aud2g none
 SET_REPLY 115 subscriber.by-imsi-901991234567891.aud2g OK
--- a/tests/test_subscriber.vty
+++ b/tests/test_subscriber.vty
@@ -8,10 +8,10 @@ OsmoHLR# list
  subscriber (imsi|msisdn|id|imei) IDENT delete
  subscriber (imsi|msisdn|id|imei) IDENT update msisdn (none|MSISDN)
  subscriber (imsi|msisdn|id|imei) IDENT update aud2g none
-  subscriber (imsi|msisdn|id|imei) IDENT update aud2g (comp128v1|comp128v2|comp128v3|xor) ki KI
+  subscriber (imsi|msisdn|id|imei) IDENT update aud2g (comp128v1|comp128v2|comp128v3|xor-2g) ki KI
  subscriber (imsi|msisdn|id|imei) IDENT update aud3g none
-  subscriber (imsi|msisdn|id|imei) IDENT update aud3g milenage k K (op|opc) OP_C [ind-bitlen] [<0-28>]
-  subscriber (imsi|msisdn|id|imei) IDENT update aud3g xor k K [ind-bitlen] [<0-28>]
+  subscriber (imsi|msisdn|id|imei) IDENT update aud3g (milenage|tuak) k K (op|opc) OP_C [ind-bitlen] [<0-28>]
+  subscriber (imsi|msisdn|id|imei) IDENT update aud3g xor-3g k K [ind-bitlen] [<0-28>]
  subscriber (imsi|msisdn|id|imei) IDENT update imei (none|IMEI)
  subscriber (imsi|msisdn|id|imei) IDENT update network-access-mode (none|cs|ps|cs+ps)
  show mslookup services
@@ -144,7 +144,7 @@ OsmoHLR# subscriber imsi 123456789023000 update aud2g ?
  comp128v1  Use COMP128v1 algorithm
  comp128v2  Use COMP128v2 algorithm
  comp128v3  Use COMP128v3 algorithm
-  xor        Use XOR algorithm
+  xor-2g     Use XOR-2G algorithm

 OsmoHLR# subscriber imsi 123456789023000 update aud2g comp128v1 ?
  ki  Set Ki Encryption Key
@@ -155,12 +155,12 @@ OsmoHLR# subscriber imsi 123456789023000 update aud2g comp128v1 ki ?
 OsmoHLR# subscriber imsi 123456789023000 update aud2g comp128v1 ki val ?
  <cr>  

-OsmoHLR# subscriber imsi 123456789023000 update aud2g xor ki Deaf0ff1ceD0d0DabbedD1ced1ceF00d
+OsmoHLR# subscriber imsi 123456789023000 update aud2g xor-2g ki Deaf0ff1ceD0d0DabbedD1ced1ceF00d
 OsmoHLR# subscriber imsi 123456789023000 show
    ID: 101
    IMSI: 123456789023000
    MSISDN: 423
-    2G auth: XOR
+    2G auth: XOR-2G
             KI=deaf0ff1ced0d0dabbedd1ced1cef00d

 OsmoHLR# subscriber imsi 123456789023000 update aud2g comp128v1 ki BeefedCafeFaceAcedAddedDecadeFee
@@ -241,7 +241,7 @@ OsmoHLR# subscriber id 101 show
    2G auth: COMP128v3
             KI=c01ffedc1cadaeac1d1f1edacac1ab0a

-OsmoHLR# subscriber id 101 update aud2g xor ki CoiffedCicadaeAcidifiedAcaciaBoa
+OsmoHLR# subscriber id 101 update aud2g xor-2g ki CoiffedCicadaeAcidifiedAcaciaBoa
 % Invalid value for KI: 'CoiffedCicadaeAcidifiedAcaciaBoa'
 OsmoHLR# subscriber id 101 show
    ID: 101
@@ -250,7 +250,7 @@ OsmoHLR# subscriber id 101 show
    2G auth: COMP128v3
             KI=c01ffedc1cadaeac1d1f1edacac1ab0a

-OsmoHLR# subscriber id 101 update aud2g xor ki C01ffedC1cadaeAc1d1f1edAcac1aB0aX
+OsmoHLR# subscriber id 101 update aud2g xor-2g ki C01ffedC1cadaeAc1d1f1edAcac1aB0aX
 % Invalid value for KI: 'C01ffedC1cadaeAc1d1f1edAcac1aB0aX'
 OsmoHLR# subscriber id 101 show
    ID: 101
@@ -269,20 +269,21 @@ OsmoHLR# subscriber id 101 show
 OsmoHLR# subscriber imsi 123456789023000 update aud3g ?
  none      Delete 3G authentication data
  milenage  Use Milenage algorithm
-  xor       Use XOR algorithm
+  tuak      Use TUAK algorithm
+  xor-3g    Use XOR-3G algorithm

 OsmoHLR# subscriber imsi 123456789023000 update aud3g milenage ?
  k  Set Encryption Key K

 OsmoHLR# subscriber imsi 123456789023000 update aud3g milenage k ?
-  K  K as 32 hexadecimal characters
+  K  K as 32/64 hexadecimal characters

 OsmoHLR# subscriber imsi 123456789023000 update aud3g milenage k Deaf0ff1ceD0d0DabbedD1ced1ceF00d ?
  op   Set OP key
  opc  Set OPC key

 OsmoHLR# subscriber imsi 123456789023000 update aud3g milenage k Deaf0ff1ceD0d0DabbedD1ced1ceF00d opc ?
-  OP_C  OP or OPC as 32 hexadecimal characters
+  OP_C  OP or OPC as 32/64 hexadecimal characters

 OsmoHLR# subscriber imsi 123456789023000 update aud3g milenage k Deaf0ff1ceD0d0DabbedD1ced1ceF00d opc CededEffacedAceFacedBadFadedBeef ?
  [ind-bitlen]  Set IND bit length
--- a/tests/test_subscriber_errors.ctrl
+++ b/tests/test_subscriber_errors.ctrl
@@ -130,7 +130,7 @@ ERROR 54 Value failed verification.
 SET 55 subscriber.by-imsi-901990000000003.aud2g foobar,2134
 ERROR 55 Unknown auth algorithm.

-SET 56 subscriber.by-imsi-901990000000003.aud2g xor,2134
+SET 56 subscriber.by-imsi-901990000000003.aud2g xor-2g,2134
 ERROR 56 Invalid KI.

 SET 57 subscriber.by-imsi-901990000000003.aud3g foobar
@@ -139,17 +139,17 @@ ERROR 57 Value failed verification.
 SET 58 subscriber.by-imsi-901990000000003.aud3g foobar,2134
 ERROR 58 Unknown auth algorithm.

-SET 60 subscriber.by-imsi-901990000000003.aud3g milenage,2134
-ERROR 60 Invalid KI.
+SET 59 subscriber.by-imsi-901990000000003.aud3g milenage,2134
+ERROR 59 Invalid KI.

-SET 61 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,AAA
+SET 60 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,AAA
+ERROR 60 Invalid format.
+
+SET 61 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC
 ERROR 61 Invalid format.

-SET 62 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC
-ERROR 62 Invalid format.
+SET 62 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC,zzz
+ERROR 62 Invalid OP/OPC.

-SET 63 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC,zzz
-ERROR 63 Invalid OP/OPC.
-
-SET 64 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC,fb2a3d1b360f599abab99db8669f8308,
-ERROR 64 Invalid format.
+SET 63 subscriber.by-imsi-901990000000003.aud3g milenage,c01ffedc1cadaeac1d1f1edacac1ab0a,OPC,fb2a3d1b360f599abab99db8669f8308,
+ERROR 63 Invalid format.
Author	SHA1	Message	Date
Keith Whyte	823b398cf8	Split REJect cause by CN DOMAIN Allow using a distinct Reject Cause for CS and PS Domain. This breaks any existing config that defines custom reject-cause TODO: Add Alias or Hidden function or whatever to handle old config.	2024-09-05 05:35:53 +01:00
Keith	aed979912f	Add the VLR to the subscribers last-seen vty command It's useful to see WHERE the subcriber was last seen in a distributed GSM configuration Change-Id: I658e42c965a95b23675d4333d262522206fd24c4	2024-09-05 05:35:53 +01:00
Keith	36342811b3	Add a time limit to show subscribers last-seen There was a comment in gerrit I7f0573381a6d0d13841ac6d42d50f0e8389decf4 mentioning concern that the show subscriber commands I added had no limits I see now my mistake. Change-Id: I170e1025d534881281379efee0f5f8f51b88fc06	2024-09-05 05:35:53 +01:00
Keith	8293ab0f27	Make local attach max age VTY configurable Change-Id: I14d1e6489001529ac2c96ddbf41605c33b05283b	2024-09-05 05:35:53 +01:00
Keith	d82e366a5a	VTY: Add proxy inspection and delete Change-Id: I5d990b1c765e2bfb762012f0924e68c2856804bc	2024-09-05 05:35:53 +01:00
Keith	7aa94b7b92	Implement subscriber-create-on-demand fallback If the mslookup client gets no response with the configured timeout, then go ahead and create a local subscriber if subscriber-create-on-demand is so configured. Change-Id: I3755baa393f6cc6b766abf90ba0f3a062e4c0f5f	2024-09-05 05:35:53 +01:00
Keith	eb692378ae	DGSM: Add ignore-created-on-demand option When a subscriber is create(d)-on-demand (assuming configuration does not grant CS/PS access by default), then the following will be true: * The subscriber will never have connected, and therefore have no vlr_number entry. * The msisdn length will be the length configured in create-on-demand. * The subscriber will have no CS/PS access. Let's use these three conditions to 'detect' subscribers than have beeen created on demand, and ignore them in both the case of an incoming mslookup, and a local GSUP request. Change-Id: I40d40467316c360bcbd50d50cb2e52a38e718eac	2024-09-05 05:35:46 +01:00
Keith	d001047adf	mslookup: Add a flag to not stop on receive age: zero This allows using the DGSM system to search for duplicate IMSI entries across all HLRs Change-Id: Ic69d6bc9834099ba3a7f3b6f8334b5eac90f2897	2024-09-05 04:52:45 +01:00
Keith	587a024e00	D-GSM: Add a query type for authorized imsi. Adds the possibility to use the DGSM/mDNS system to search all HLRs for only IMSIs that have either CS or PS service Change-Id: I54c469d34c3cd1bfd9a72a6c751ae183606d75ec	2024-09-05 04:52:45 +01:00
Keith	c795e6d85e	DGSM: add option to respond only for authorized IMSIs Adds a vty configuration option to the mslookup server which instructs the server to only reposnd to gsup.hlr queries for IMSIs that are both known AND have either Circuit Switched or Packet Switched access enabled. This helps in the case of so-called 'evil twin' IMSI entries, where, possibly due to subscriber-create-on-demand, as a result of a Location Update at a time when the home HLR was not reachable, the local hlr has an entry for an IMSI that in reality belongs to another HLR. NOTE: Network-wide concurrent use of subscriber-create-on-demand and the mslookup client is not currently possible, as the mslookup client has no fallback option to create-on-demand. A future commit, however will implement this fallback, thereby completing support for D-GSM with create-on-demand. Change-Id: I2643d6c93289ec0835fa1c00e275d627914775bc	2024-09-05 04:52:45 +01:00
Vadim Yanitskiy	7c06eea5b2	subscriber-create-on-demand: add mode for MSISDN=IMSI In may be desirable for some users to assign deterministic MSISDNs when subscriber-create-on-demand is enabled. This can be achieved by assigning MSISDN=IMSI. This commit adds a new mode for that. Change-Id: I3470492f5e46de7246d9a74e80c37f80f455d851	2024-08-22 02:32:07 +07:00
Vadim Yanitskiy	d4693f652a	subscriber-create-on-demand: rework configuration This commit prepares for adding a new subscriber-create-on-demand mode (MSISDN=IMSI), which is implemented in a follow-up patch. * add an enumerated type for subscriber-create-on-demand mode; * store the related parameters in an anonymous structure. Change-Id: Ib553172655f83dad1ac0e0254615c8c207d79ca9	2024-08-07 16:20:14 +07:00
Oliver Smith	c819234a42	Bump version: 1.7.0.17-bae13 → 1.8.0 Change-Id: I3b05d5ac5417f5c995e7057474adba72326ebf11	2024-07-24 16:22:50 +02:00
Oliver Smith	bae137d9eb	mslookup: don't ignore return value of write() Fix GCC 13.2.0 refuses to build this with -Werror: src/mslookup/osmo-mslookup-client.c: In function 'socket_client_respond_result': src/osmo-hlr/src/mslookup/osmo-mslookup-client.c:432:9: error: ignoring return value of 'write' declared with attribute 'warn_unused_result' [-Werror=unused-result] 432 \| write(c->ofd.fd, response, strlen(response)); \| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/mslookup/osmo-mslookup-client.c: In function 'socket_accept': src/osmo-hlr/src/mslookup/osmo-mslookup-client.c:530:17: error: ignoring return value of 'write' declared with attribute 'warn_unused_result' [-Werror=unused-result] 530 \| write(c->ofd.fd, CSV_HEADERS, strlen(CSV_HEADERS)); \| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Change-Id: I4b2e5cabe5306a999197f7c98362d872a3739078	2024-07-03 10:45:25 +02:00
Vadim Yanitskiy	413f5e3670	README.md: cosmetic: fix a typo Change-Id: Idd4270a74c2a9921943606c1157343f4756b1643	2024-06-05 18:34:07 +07:00
Oliver Smith	6b771e34bd	debian/postinst: add checks, be verbose Do not attempt to change permissions/ownership if the package gets upgraded from a version higher than the next release. Do not fail if the user deleted the config file. Be verbose when changing permissions. Related: OS#4107 Change-Id: I1bcbe414fd18101e4d875a16539deab7baf9cb5f	2024-05-15 11:47:40 +00:00
Oliver Smith	a005ad6495	contrib: remove rpm spec file Related: https://osmocom.org/news/255 Related: OS#6446 Change-Id: Idd67d52ca736c4e145387ea8d4030f9cf4b9596d	2024-05-08 14:40:58 +02:00
Oliver Smith	e391c4c58d	.deb/.rpm: various fixes related to non-root * Explicitly chown /var/lib/osmocom to osmocom:osmocom, instead of relying on systemd to do it when the service starts up. This does not work with the systemd versions in debian 10 and almalinux 8. * deb: Use "useradd" instead of the interactive "adduser" perl script from Debian. This makes it consistent with how we do it in rpm, and avoids the dependency on "adduser". * deb: Remove support for the "dpkg-statoverride --list" logic. This seems to be a rather obscure feature to override permissions for certain files or directories. Let's rather remove this complexity to make the postinst script more maintainable and more similar to the rpm spec file. If users need this, they can achieve something similar by using their own Osmocom config file in a different path with different permissions. * deb: Consistently use tabs throughout postinst, instead of mixing tabs and spaces. Related: OS#4107 Change-Id: Ib20406dd253f5e8720552e92e9002e45591218fa	2024-04-26 15:07:32 +02:00
Max	a26abc6aa8	.deb/.rpm: add osmocom user during package install Created osmocom user & group during package installation. Fix the configuration dir/files permission to match. Related: OS#4107 Tweaked-By: Oliver Smith <osmith@sysmocom.de> Change-Id: I625c993ab03dfe32976c651acca9c35c33a768e7	2024-04-24 11:52:09 +02:00
Harald Welte	da4fc0eab9	README.md: Add Forum and Issue Tracker sections Change-Id: Ic88d30fc8952762565af6115c8bb7d67fa7d7866	2024-03-23 17:28:12 +01:00
Harald Welte	507315eed8	README.md: Improve mark-down formatting Change-Id: Ib608ec568572af672934d1e2960e1dabc3a2a45c	2024-03-23 17:26:19 +01:00
Harald Welte	72f92e28c9	Add funding link to github mirror see https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository Change-Id: I935ec923362fd8d3f03a8db8e93e033f86f0a5ac	2024-03-23 17:22:45 +01:00
Vadim Yanitskiy	ac1365fddf	build: include {README.md,git-version-gen} into the release tarball Change-Id: I072b5899ac77326f619d351f17aa78490946f452	2024-01-26 23:33:48 +07:00
Mychaela N. Falconia	be8bcd30eb	ctrl: add subscriber.by-.imsi GET-able variable There may be a need in various OsmoCNI-attached entities (for example, external SMSC implementations) to perform a mapping from known MSISDN to unknown IMSI, querying OsmoHLR subscriber db for it. Querying for subscriber.by-msisdn-.imsi will be much more efficient (and easier on client-side implementors) than querying for subscriber.by-msisdn-*.info and fishing the IMSI out of the long multiline response, discarding all other irrelevant info. Related: OS#6312 Change-Id: Icea1a74d0c664047f46758ab4ad75508782f3d12	2023-12-17 21:47:21 +00:00
Andreas Eversberg	947e137918	Use uniform log format for default config files Related: OS#6272 Change-Id: I4319b688286845d2ffbd944e51e9cc2e5159563c	2023-12-01 12:41:19 +01:00
Mychaela N. Falconia	e513c43857	SMS over GSUP: handle READY-FOR-SM.req from MSCs When an MS indicates that it is ready to receive MT SMS, the MSC will send us a READY-FOR-SM.req message. Handle it by sending copies of the same message to all connected SMSCs and returning OK result to the MS that indicates its ready status. Related: OS#6135 Change-Id: I731545a3a0d0804289e24a7769e13bfd3f645132	2023-09-21 02:06:58 +00:00
Mychaela N. Falconia	f6a303c669	SMS over GSUP: implement forwarding of MT SMS When an SMSC tries to deliver an SM to a subscriber, it will send us an MT-forwardSM.req GSUP message. We look up the subscriber by IMSI and see if they are attached to a VLR. If the subscriber is attached, we forward the message to the MSC/VLR, otherwise return an error to the SMSC. Related: OS#6135 Change-Id: Ib3551bf7839690606c677461758c5cfef5f0aa7b	2023-09-21 02:06:49 +00:00
Mychaela N. Falconia	786ec5b91c	SMS over GSUP: implement forwarding of MO SMS MO-forwardSM.req messages are now forwarded to a connected SMSC based on the SMSC address (SM-RP-DA) in the MO SM and the vty-defined mapping from SMSC numeric addresses to IPA names. Related: OS#6135 Depends: Iea5c29909c5be80f81dbbc2873656ff5cf590a5d (libosmocore) Change-Id: Iaad4531922c41583d261c79f42561a1bdbe03521	2023-09-21 02:05:15 +00:00
Mychaela N. Falconia	ff7c7ea085	SMS over GSUP: implement vty config of SMSC routing At the user-visible level (advanced settings menus on phones, GSM 07.05 AT commands, SIM programming) each SMSC is identified by a numeric address that looks like a phone number, originally meant to be a Global Title. OsmoMSC passes these SMSC addresses through as-is to MO-forwardSM.req GSUP message - however, SMSCs that connect to OsmoHLR via GSUP identify themselves by their IPA names instead. Hence we need a mapping mechanism in OsmoHLR config. To accommodate different styles of network design ranging from strict recreation of classic GSM architecture to guest roaming arrangements, a two-level configuration is implemented, modeled after EUSE/USSD configuration: first one defines which SMSCs exist as entities, identified only by their IPA names, and then one defines which numeric SMSC address (in SM-RP-DA) should go to which configured SMSC, with the additional possibility of a default route. Related: OS#6135 Change-Id: I1624dcd9d22b4efca965ccdd1c74f0063a94a33c	2023-09-21 01:56:21 +00:00
Vadim Yanitskiy	fa6af8872f	hlr_vty.c: drop redundant include of hlr_ussd.h Change-Id: Ia873c3ea7fb76cb83628811f159e9d5f2de8dcbd	2023-09-17 02:04:05 +00:00
Pau Espin Pedrol	d052f076e3	Bump version: 1.6.0.20-37f0-dirty → 1.7.0 Change-Id: I3f169ff8f9b10a4d4b5c50286951d326fa713245	2023-09-12 14:41:34 +02:00
Alexander Couzens	37f0b3a8f3	Add support for multiple APN profiles for subscriber data Previously the HLR sent in the Insert Subscriber Data call only the wildcard APN as a single entry. This violates the spec because the first entry (with the lowest context_id) is always the default APN, but it is forbidden to have a wildcard APN as default apn. Introduce a default template/profile which can contain multiple APNs. This profile is always sent out to the SGSN/MME as part of Insert-Subscriber-Data. In the future a subscriber might have a profile template name written into the database which will resolve to a "pdp-profile premium" in the configuration. To be backward compatible, if the pdp-profile default section is missing, the HLR will send out only a wildcard APN. Config example: hlr ps pdp-profile default profile 1 apn internet profile 2 apn * Changes to the apn list will be only handed out to subscribers when the subscriber do a location update. Related: SYS#6391 Change-Id: I540132ee5dcfd09f4816e02e702927e1074ca50f	2023-09-12 09:48:02 +00:00
Harald Welte	7a763aa012	Add VTY support for TUAK algorithm Change-Id: If2611658f7cb990b484d7429ab2f944f56fd2eb6 Depends: libosmocore.git Ib905b8d8bdf248e8299bf50666ee1bca8298433d	2023-08-29 13:42:41 +00:00
Harald Welte	626f5eb740	db: extend database schema to support 256bit K and/or OP[c] values Other UMTS AKA algorithms than MILENAGE (notably TUAK) support K sizes of up to 256bit, or mandate a OP/OPc size of 256 bit. Let's extend our database schema to accommodate such larger sizes. Change-Id: Ibbde68484c904507a15c35cbfdf88cd47d0c7039	2023-08-29 13:42:41 +00:00
Vadim Yanitskiy	5800f3add5	USSD: fix handling of ussd-DataCodingScheme != 0x0f The usual Data Coding Scheme value in the mobile-originated USSD request (processUnstructuredSS-Request) is 0x0f, which means: 0000 .... = Coding Group: Coding Group 0 (Language using the GSM 7 bit default alphabet) .... 1111 = Language: unspecified However some modems are known to use a different default value, if not specified explicitly (AT+CUSD has optional DCS parameter): 0000 .... = Coding Group: Coding Group 0 (Language using the GSM 7 bit default alphabet) .... 0000 = Language: German (0) In function rx_proc_ss_req(), we should not be using req.ussd_text, because this field has been deprecated and may contain unexpected data. For example, in the abovementioned case it would contain the 7 bit encoded ussd-String 'aa510c061b01'O and osmo-hlr would indeed fail to find a matching route for a non-ASCII string. Instead of relaying on gsm0480_parse_facility_ie(), let's check the Data Coding Scheme value and decode the request string ourselves. Expect the Coding Group 0, but be more tolerant to the indicated language: print a warning and treat it as '1111'B (unspecified). Change-Id: Ib7bac660b1a7942adcfbe7b14f162c95061a25db Related: OS#6075	2023-07-21 12:49:20 +00:00
Vadim Yanitskiy	f8b73f0682	gsup_server: fix msgb memleak in osmo_gsup_server_read_cb() I noticed that inability to send IPA PONG in response to IPA PING from osmo-{msc,sgsn} results in an "IPA Multiplex" chunk being leaked. No matter what's returned from ipa_server_conn_ccm(), we need to free the msgb containing the incoming IPA message. Change-Id: I5c5acbffc2913f78db4894ae3633b5eca9c2e8d6	2023-07-05 01:10:43 +07:00
Vadim Yanitskiy	f4223f5b53	ussd: fix GSUP memleaks in rx_proc_ss_{req,error}() Also take a chance to use a more suitable error cause value. Change-Id: I22ba5ad470989b7e8ba8fe2be170eac4adcb48c5	2023-07-05 00:24:19 +07:00
Vadim Yanitskiy	1c23f304d1	lu_fsm: fix memleak in lu_fsm_wait_insert_data_result() Currently osmo-hlr leaks memory (msgb holding 1203 bytes of data and a struct osmo_gsup_req) on receipt of OSMO_GSUP_MSGT_INSERT_DATA_ERROR. Change-Id: I4c70a06169158c869360707a7a62436dbf13b9b3	2023-07-05 00:15:17 +07:00
Harald Welte	f4159bd54c	src/db.c: Switch from "const char statements" to "const char const" This is primarily to make the linter happy, which spews "static const char * array should probably be static const char * const" errors in gerrit when adding similar new code to this existing file. So let's first convert the old code and then add new code that makes the linter happy. I guess it does have a point, as both the individual string pointers as well as the array of the pointers are constant. Change-Id: I39e9fb6bd8052f4878cfc95061775bf940631ae5	2023-06-14 14:53:07 +02:00
Harald Welte	a854b48762	Port to new libosmogsm 'struct osmo_sub_auth_data2' libosmogsm has recently introdcued a 'struct osmo_sub_auth_data2' as successor to 'struct osmo_sub_auth_data', together with updated osmo_auth_gen_vec2/osmo_auth_gen_vec_auts2 API. The rationale of this new API is to enable * support for AKA algorithms which use K and/or OP[c] values of 256bit (instead of the classic 128bit) * support for RES length sizes of 4 and 16 bytes (instead of the classic 8 bytes) This commit just jumps over to the new API without adding any related functionality to osmo-hlr. The latter is left for subsequent commits. Change-Id: I3207c7bfb73e9ff5471e5c26b66639549e4d48a2 Depends: libosmocore.git Ie775fedba4a3fa12314c0f7c8a369662ef6a40df	2023-06-14 14:53:04 +02:00
Harald Welte	91150802f8	cosmetic: gen_ts_55_205_test_sets/main_template tabs istead of spaces Let's consistently use our normal tab indent style Change-Id: I4172b59131ac4166174c1860fcb07b7bee3df728	2023-06-03 19:32:44 +02:00
Harald Welte	8f3fa656e7	cosmetic: gen_ts_55_205_test_sets/func_template.c: Use tab-indent This templates is used for generating C code, so it should use our normal tab-based code indenting. Change-Id: I0be7eb2d7b551d7eaaee15994ef37262694819f6	2023-06-03 19:29:46 +02:00
Harald Welte	829713a69d	Introduce support for XOR-2G algorithm So far we supported a "xor" algorithm in osmo-hlr, without specifying whether it's the XOR-3G or the (different) XOR-2G algorithm. Furthermore, it was buggy in the sense that it permitted the XOR[-3G] for 2G authentication data in the database. This patch * renames existing "xor" to "xor-3g" * disallows "xor-3g" usage with 2G authentication data * introduces support for XOR-2G as "xor-2g" in the VTY Change-Id: I039a1f84fda54a908a82fe621e7fd078cb85e4c6 Depends: libosmocore.git I0ee0565382c1e4515d44ff9b1752685c0a66ae39	2023-05-30 21:43:14 +02:00
Oliver Smith	5edf387353	systemd: depend on networking-online.target Related: SYS#6400 Change-Id: I29e547242b2ed1cfc4750c7d7e5f8636c2e8f3dc	2023-05-26 14:10:45 +02:00
Alexander Couzens	2989873a68	hlr: use talloc for memory allocation in osmo_gsup_create_insert_subscriber_data_msg Don't use static buffers for APN and MSISDN. When encoding multiple APNs the static buffer might be too small. In prepration to support multiple APNs in subscriber data Change-Id: I00b5c2dfadcf6e0740e93b4c3292d2654d22e80c	2023-05-10 07:58:57 +00:00
Oliver Smith	390f6fcf13	debian: set compat level to 10 Related: OS#5958 Change-Id: I5d26ab03aacf3b8ef8c1c4c669c12090fd0b7899	2023-04-25 16:48:22 +02:00
Vadim Yanitskiy	d10c2ef366	tests/*/Makefile.am: move -I to AM_CPPFLAGS Change-Id: I654053e11b0cc824c198f68e4ff0a0fcb295efb0	2023-03-14 20:11:45 +00:00
Vadim Yanitskiy	974aed9c04	tests/auc/Makefile.am: put object files to LDADD Change-Id: Iaefcfe7a8904841a29094fe40eb5850912544b4c	2023-03-14 20:11:45 +00:00
Pau Espin Pedrol	cf535dbcbd	mslookup: Call osmo_fd_unregister() before closing and changing bfd->fd Change-Id: I26bba0dd092ad5fd6b4959b173fae93b542a93f1	2023-03-14 11:42:24 +01:00
Oliver Smith	a55e63b087	tests/db/db_test.err: adjust to XOR-3G rename Adjust the test to the related libosmocore change. Related: libosmocore I446e54d0ddf4a18c46ee022b1249af73552e3ce1 Change-Id: I68878d24340659f888e5e348b937161cffbd54e2	2023-02-22 16:58:57 +01:00
Oliver Smith	62e5c1b2c7	Run struct_endianness.py Ensure there is no diff to prepare to run this in CI. Related: OS#5884 Change-Id: I4294a18871214b70cef267fcaaaaada42cb61bf9	2023-02-20 10:48:57 +01:00