gbproxy: Discard UL PTP messages with an unknown BVCI

Currently all PTP messages are in general forwarded to the SGSN even
when the BVCI is not known to the gbproxy. Only if message patching
is active and the peer cannot be determined, a log message is
generated, a STATUS message returned, and the message discarded.
The intention for this was to keep the old gbproxy's behaviour if
patching is disabled. But the code gets much more complex this way.
Another drawback is that when the SGSN returns a corresponding STATUS
message, it cannot be routed to the BSS where the original message
came from.

This patch therefore changes the behaviour to reject BSSGP PTP uplink
messages immediately if the BVCI is not known.

Fixes: Coverity CID 1244240
Ticket: OW#1317
Sponsored-by: On-Waves ehf
gbproxy/test: Don't assign a variable within OSMO_ASSERT (Coverity)

Coverity complains about having side effects in OSMO_ASSERT argument
expressions. This would be an issue in this case, because that
variable is only reference in other OSMO_ASSERT expressions.

Nevertheless this patch changes this to assign the variable outside
of OSMO_ASSERT.

Fixes: Coverity CID 1244239
Sponsored-by: On-Waves ehf
gbproxy: Fix segfault for VTY delete-gbproxy-link

Currently the code segfaults when the link shall be deleted by IMSI
when the IMSI has not been set yet.

This patch adds a NULL check to skip the entry before calling
gsm48_mi_to_string,

Adresses:
Program received signal SIGSEGV, Segmentation fault.
0xb693af77 in gsm48_mi_to_string (string=0xbfffe020 "", str_len=200,
mi=0x0, mi_len=0) at gsm48.c:360
    360         mi_type = mi[0] & GSM_MI_TYPE_MASK;
    str_len=200, mi=0x0, mi_len=0) at gsm48.c:360
    self=0x807c9a0 <delete_gb_link_by_id_cmd>, vty=0xb4303c70,
     argc=3, argv=0xbfffe1c0) at gb_proxy_vty.c:670
...

Sponsored-by: On-Waves ehf
gprs: Fix typo in the comment
sgsn: Cancel pending timer in sgsn_mm_ctx_free

Currently the timer is not stopped before the MM context is freed
which can lead to failure if sgsn_mm_ctx_free is called while timer
protected procedures are active.

This patch add code to cancel the timer if necessary from within
sgsn_mm_ctx_free.

Ticket: OW#1322
Sponsored-by: On-Waves ehf
sgsn: Delete PDP contexts properly

Currently the PDP contexts are hard freed (via sgsn_pdp_ctx_free)
at some places in gprs_gmm.c on the reception of a Detach Req and on
re-use of an IMSI that is already associated with an MM context. This
can lead to segfaults when there is a pending request or a data
indication at libgtp.

This patch add a new function sgsn_pdp_ctx_terminate that de-associates
the PTP context from the MM context, deactivates SNDCP, sets pdp->mm
to NULL and then calls sgsn_delete_pdp_ctx. sgsn_libgtp is updated to
check for pdp->mm being non-NULL before dereferencing it. The
sgsn_pdp_ctx_terminate function will be called for each PDP context of
an MM context before this context is going to be deleted via
sgsn_mm_ctx_free. To ensure, that the ctx->llme (which is accessed
during the deactivation of SNDCP) remains valid, the call to
gprs_llgmm_assign is moved after the call to sgsn_mm_ctx_free. The
handling of re-used IMSIs is changed to mimic the processing of a
Detach Req.

Addresses:
<0002> gprs_gmm.c:654 MM(/f6b31ab0) Deleting old MM Context for same
    IMSI p_tmsi_old=0xc6f19134
<000f> gprs_sgsn.c:259 PDP freeing PDP context that still has a
    libgtp handle attached to it, this shouldn't happen!
[...]
SEGFAULT

Ticket: OW#1311
Sponsored-by: On-Waves ehf
sgsn: Send detach(re-attach) instead of gmm status if TLLI unknown

The osmo-sgsn sends Status messages (or nothing in case of non
GMM/GSM) when the TLLI is unknown. This prevents the MS from
reconnecting.

This patch adds the initiation of an MT detach procedure to force a
re-attach to set up a valid LLE context if an LLE or an MM context
cannot be found. Since this can also be triggered by non-GMM SAPI
messages, a GPRS application callback sgsn_force_reattach_oldmsg is
added which in turn calls the GMM layer to generate the GSM 04.08
specific messages.

Note that the MS can be left in REGISTERED state after initially
wanting to detach itself, since it will receive a Detach Req
(re-attach) when sending a DEACT PDP CTX REQ after the SGSN or
gbproxy (P-TMSI patching enabled) has been restarted. This same
behaviour has been observed with another SGSN.

Sponsored-by: On-Waves ehf
gbproxy/test: Add expect_msg checks to test_gbproxy_keep_info

This patch adds assertions to check the LLC/GMM message received from
the gbproxy by the test framework within the function
test_gbproxy_keep_info.

It also fixes the source address of the DETACH ACC messages.

Sponsored-by: On-Waves ehf
gbproxy/test: Add test case for repeated and otherwise bad messages

This adds a test case to check gbproxy's behaviour when processing
two subsequent but identical Attach Accept messages.

Ticket: OW#1322
Sponsored-by: On-Waves ehf
gbproxy: Fix P-TMSI generation for repeated Attach Accept messages

Currently, when P-TMSI patching is enabled, a new BSS P-TMSI is
generated for each Attach Accept. So two duplicated, subsequent
Attach Accept messages will be mapped to different BSS side P-TMSI.
Because the last one will replace former ones in the link_info
struct, the MS will fail to access the SGSN if it uses the former
P-TMSI to derive the new TLLI.

This patch checks the SGSN P-TMSI already assigned to the link_info
and only generates a new BSS P-TMSI on mismatch (or if the BSS P-TMSI
hasn't been set yet).

Ticket: OW#1322
Sponsored-by: On-Waves ehf
gbproxy: Patch BSSGP P-TMSI in PAGING PS messages

Currently the P-TMSI IE in PAGING_PS is not patched.

This commit adds code to patch BSSGP P-TMSI IE in
gbproxy_patch_bssgp independently from the P-TMSI patching at the LLC
layer. It also extends gbproxy_update_link_state_dl to use the IMSI
to find the link_info if the TLLI is not present in the message.

Note that the spec (GSM 08.18, 7.2) requires to use of the P-TMSI
instead of the IMSI to select the MS if that IE is available.
Nevertheless as long as the IMSI is always present in downlink BSSGP
messages and as long as the optional P-TMSI refers to the same MS
(which is the case currently), this is not an issue.

Sponsored-by: On-Waves ehf
sgsn: Avoid duplicated Attach Accept messages

Currently each received Ident Resp triggers an Attach Accept/Reject
if IMSI and IMEI are known. This has led to duplicated Attach Accept
messages when used with the gbproxy (IMSI acquisition active) and
with certain mobile equipment (iOS).

This patch modifies gsm48_rx_gmm_id_resp to discard Ident Resp messages
if all required information (IMEI and IMSI) has been gathered.

Ticket: OW#1322
Sponsored-by: On-Waves ehf
sgsn: Moved IMSI ACL management to sgsn_auth.c

Currently the ACL code is located in sgsn_vty.c.

This commit moves this to a new file sgsn_auth.c as a first step to
make authorization more flexible in order to implement remote
acquisition on subsciber data.

Sponsored-by: On-Waves ehf
sgsn/test: Move MM context allocation into separate function

This refactores serveral code lines needed for the allocation of MM
contexts into the new function alloc_mm_ctx.

Sponsored-by: On-Waves ehf
sgsn/test: Add test case for Detach Request (MO, power-off = 1)

Currently only a Detach Request (MO) message with power_off = 0 is
checked.

This commit adds a new test case with power_off set to 1. It also
adds checks for the number of messages generated by the SGSN to
verify that these messages are handled differently.

Note that the handling of power_off isn't implemented yet. Therefore
the corresponding assertion is being disabled yet.

Sponsored-by: On-Waves ehf
sgsn: Only send Detach Accept (MO) if power_off isn't set

Currently, every time the SGSN received a Detach Request from the MS
via an established logical link, it is answered by a Detach Accept.
This violates the specification (GSM 04.08, 4.7.4.1.2 and .3), which
states, that it should only be sent, if "the detach type IE value
indicates that the detach request has not been sent due to switching
off".

This patch adds a conditional to limit the sending of Detach Accept
accordingly.

Sponsored-by: On-Waves ehf
sgsn: Handle Detach Requests even when there is no mmctx

Currently, when a Detach Request is received with an unknown TLLI,
it is answered by another Detach Request (!), even when a power_off
Type is used.

This patch uses gsm48_rx_gmm_det_req to handle the message instead.
So this function is changed to cope with a NULL mmctx. In that case
it doesn't unassign the llme, so this must be done manually
afterwards.

Sponsored-by: On-Waves ehf
nitb/ctrl: Fix access to freed memory in verify_subscriber_modify

Currently the temporary string 'tmp' is freed before parts of it are
referenced. This lets address sanitizer complain when evaluating
strlen(imsi), where imsi points into the 'tmp' data block.

This patch moves the talloc_free to the end of the function and uses
a rc variable instead of using early returns.

Addresses:
testSubscriberAddRemove (__main__.TestCtrlNITB) ... Launch:
./src/osmo-nitb/osmo-nitb -c
  ./doc/examples/osmo-nitb/nanobts/openbsc.cfg -l test_hlr.sqlite3
Connecting to host 127.0.0.1:4249
Sending "SET 1000 subscriber-modify-v1 2620345,445566"
Decoded replies:  {}
ERROR

Sponsored-by: On-Waves ehf
bsc: Allow to disable sending ping/pong to the MSC

Some switches do not like to receive the IPA PING/PONG messages.
Allow to disable the handling with "no timeout-ping" and create
test cases that verify the switching between the modes. Change the
code to trat <= 0 as an invalid timeout.

Fixes: SYS#713
sgsn: Remove unused static functions from gprs_gmm.c

The following functions are not being used:
 - gsm48_tx_gmm_status_oldmsg
 - gsm48_tx_sm_status_oldmsg

This patch removes the function definitions.

Sponsored-by: On-Waves ehf