nitb/ctrl: Fix access to freed memory in verify_subscriber_modify

Currently the temporary string 'tmp' is freed before parts of it are
referenced. This lets address sanitizer complain when evaluating
strlen(imsi), where imsi points into the 'tmp' data block.

This patch moves the talloc_free to the end of the function and uses
a rc variable instead of using early returns.

Addresses:
testSubscriberAddRemove (__main__.TestCtrlNITB) ... Launch:
./src/osmo-nitb/osmo-nitb -c
  ./doc/examples/osmo-nitb/nanobts/openbsc.cfg -l test_hlr.sqlite3
Connecting to host 127.0.0.1:4249
Sending "SET 1000 subscriber-modify-v1 2620345,445566"
Decoded replies:  {}
ERROR

Sponsored-by: On-Waves ehf
sgsn: Unassign the LLME after GMM Status without mmctx

Currently the LLME is not deleted when a GMM Status message is
received for which a mmctx cannot be found. This can fill the LLME
list with unneeded entries.

This patch adds code to unassign the LLME in that case.

Ticket: OW#1324
Sponsored-by: On-Waves ehf
gbproxy: Fixed VTY doc for delete-gbproxy-link

The command definition delete_gb_link_by_id_cmd lacks a description
for the sgsn-nsei token.

This patch adds the missing description.

Addresses:
Verifying src/gprs/osmo-gbproxy -c doc/examples/osmo-gbproxy/osmo-gbproxy.cfg, test verify_doc
Documentation error (missing docs):
<command id='delete-gbproxy-link &lt;0-65534&gt; (tlli|imsi|sgsn-nsei) IDENT'>
        <param name='IDENT' doc='(null)' />

Sponsored-by: On-Waves ehf
sgsn: Do not die in _bssgp_tx_dl_ud on TLLI mismatch (TODO)

Currently an OSMO_ASSERT fails, if the message's and the mmctx's
TLLIs do not match.

This commit turns the assertion into an ERROR log message and uses
the default values for IMSI, DRX, and RA CAP instead of the MM
context values in this case.

TODO:
  - find the real source for the problem
  - add test cases derived from what is being described in the ticket

Ticket: OW#1322
Sponsored-by: On-Waves ehf
sgsn: Added TODOs (TODO)

TODO:
  - fix and remove TODOs
  - add test cases for Detach(reattach)
  - add test cases for PDP context deletion (OW#1311)
  - add test cases for Fix P-TMSI generation for repeated Attach Accept
    messages (OW#1322)
  - add test cases for Cancel pending timer in sgsn_mm_ctx_free
  - remove this commit

Sponsored-by: On-Waves ehf
sgsn: Reorganize and fix gsm48_gmm_authorize (TODO)

Currently the order of the 'if' clauses in gsm48_gmm_authorize
doesn't match the order in which the conditional parts are entered.
This makes it difficult to maintain. In addition the t3350_mode is
not stored in every path, so that this information is lost when the
identification procedure is started. Since the default value
coincidentally is GMM_T3350_MODE_ATT, this doesn't hurt for Attach
Requests which are the only messages that initially trigger the
authentication yet.

This patch changes the order of the 'if' clause to match the
processing order, it removes the t3350_mode parameter entirely and
introduces a mm->pending_req field. The latter must be set when the
request that causes the authorization before calling
gsm48_gmm_authorize. The gprs_t3350_mode enum is extended by
GMM_T3350_MODE_NONE (value 0, which is the default) to make it
possible to detect related initialisation errors or race conditions.

TODO:
 - There isn't much defference between t3350_mode (refers to the
   timer) and pending_req (refers to the procedure),
   where mm->T == 3350 => mm->t3350_mode == f(mm->pending_req).
   Check whether one of them can be dropped.

Sponsored-by: On-Waves ehf
sgsn: Cleanup GMM state transitions (TODO)

Currently the GMM state is set to GMM-REGISTERED when an Attach
Accept or a RA Update Accept message is sent, even if a new P-TMSI is
included. In this case 04.08 requires (see 4.7.3.1.3 and 4.7.5.1.3),
that the state is set to GMM-COMMON-PROCEDURE-INITIATED when the
Accept is sent. When the Complete is received, the SGSN shall set
the state to GMM-REGISTERED.

This patch modifies the state updates accordingly.

TODO:
 - add test cases

Sponsored-by: On-Waves ehf
sgsn: Make authorization asynchronous (EXPERIMENTAL)

Currently the authorization of an IMSI is done by checking ACLs from
within gsm48_rx_gmm_att_req when receiving an Attach Request
containing an IMSI.

This patch moves the check to gsm48_gmm_authorize, so that it is
initiated before the Attach Accept would be sent, but after
eventually completing the identification procedures. The
authorization now works by invoking the callback function
sgsn_update_subscriber_data when such information in gathered. This
currently happens directly from sgsn_auth_request() but would work
asynchronously, too.

The change has been successfully tested with a single phone (E71).

Sponsored-by: On-Waves ehf