mgcp: We only look at the RTP header use that in the comment
mgcp: Move Annex A counting out of patch/count method

mgcp_patch_and_count has grown due supporting linearizing timestamps,
ssrc and other things for equipment like the ip.access nanoBTS. Fight
back and move the Annex A code into a dedicated method.

The result is updated as we now count after all the patching and for
the Annex A code no change in SSRC can be detected.
mgcp: Do not detect the initial package as a wrap around

The Annex A code has a probation period but we don't have it. When
starting with seq_no==0 do not assume that the sequence numbers
have wrapped. Do it by moving the entire checking code into the
else.
mgcp: Count the incoming data instead of the modified one

For jitter, transit and packet loss we should count the data
that arrived and not the data we send towards the remote. This
is changing the jitter timings to what they were before the
re-factoring.

For forced timing we might willingly add jumps in the sequence
number but for jitter and packet loss we are more interested
in the data that traveled through the wire/air.
sgsn: Add boilerplate code for a SGSN test
sgsn: Create testcase that verifies that llmes get deleted

On an "unassignment" this code verifies that the LLME will vanish
from the list of LLMEs. We assume that this doesn't create a
memory leak.
sgsn: Add test that exposes a dangling pointer to the LLME

On detach the LLME get's unassigned (and hence destroyed) but the
GMM context will still point to that dead structure.
sgsn: Free MM context after receiving a Detach Request

On a Detach/Re-attach cycle the Address Sanitizer detected a
use-after-free kind of problem. That is because we tried to
destroy the LLME twice. The first time it is destroyed as part
of the Detach handling ans the second time it is destroyed as
part of destroying the old MM context.

In case the GPRS GMM detach message is lost the SGSN needs
to reply besides not having a MM entry.

The alternative would have been to add NULL checks for all
usages of ctx->llme which would not have helped with the
readability.

Sponsored-by: On-Waves ehf
gbproxy/test: Test IMSI acquisition for RA UDP REQ

When a MS is state GMM_REGISTERED enters a new RA, it sends a RA
Update Request which is then handled by a gbproxy that possibly
doesn't have a matching tlli_info. In this case, depending on the
configuration an identification procedure to acquire the IMSI must be
started.

This adds tests to test_gbproxy_imsi_acquisition():
 - IMSI acquisition triggered by a RA Update Request message
 - Reaction to repeated RA Update Request messages, like it could be
   caused by packet loss between PCU and gbproxy.

Sponsored-by: On-Waves ehf
gbproxy: Restart IMSI acquisition on RA UDP REQ

Currently the IMSI acquisition is not restarted when a RA Update
Request is received. This leads to repeated N(U) in the generated
Ident Request message, which in turn causes the MS to drop the
second of these message. This is bad, when the first Ident Response
has been lost between MS and gbproxy.

This patch changes gbproxy_imsi_acquisition() to handle RA Update
Request messages like Attach Requests.

Sponsored-by: On-Waves ehf
gbproxy/sgsn: Enforce termination when creating a P-TMSI/TLLI

Currently the number of iterations when creating a P-TMSI/TLLI is not
limited. It is nevertheless very unlikely that the loop will not
terminate. On the other hand, the number of iterations of every loop
should have an upper bound (loop variant) which wouldn't be the case
here if an arbitrary random generator was used.

This patch limits the number of iterations to 23 and logs an error if
the creation of the indentifier was aborted due to this limit.

Sponsored-by: On-Waves ehf
gbproxy: Rename identifiers related to IMSI matching

This patch renames gbproxy_check_tlli() to
gbproxy_imsi_matches() and struct tlli_info's
enable_patching to imsi_matches.

It's meant to be more obvious and consistent this way.

Sponsored-by: On-Waves ehf
gbproxy: Remove sgsn_nsei parameter

The function gbproxy_imsi_acquisition() has a parameter sgsn_nsei
that is alyways equal to tlli_info->sgsn_nsei (if tlli_info is not
NULL).

This patch removes this parameter from gbproxy_imsi_acquisition() and
gbproxy_flush_stored_messages() and accesses tlli_info->sgsn_nsei
instead within these functions.

Sponsored-by: On-Waves ehf
gbproxy: Rename functions related to tlli_info

This patch replaces 'tlli' by 'tlli_info' within the following
function identifiers:
  - gbproxy_delete_tlli
  - gbproxy_delete_tllis
  - gbproxy_remove_stale_tllis
  - gbproxy_touch_tlli
  - gbproxy_unregister_tlli
  - gbproxy_remove_matching_tllis
  - gbproxy_find_tlli -> gbproxy_tlli_info_by_tlli
  - gbproxy_find_tlli_by_* -> gbproxy_tlli_info_by_*

These functions refer to the whole logical link info rather than to a
certain TLLI. So they are renamed to be named consistently with
gbproxy_attach_tlli_info and others.

Sponsored-by: On-Waves ehf