Cellular Network Infrastructure » Core Network (CN) » OsmoMSC

If a BSC has ever sent a BSSMAP RESET to OsmoMSC we acknowledge this with a RESET-ACK. But then it appears we keep its state indefinitely and want to perform a MSC-originated RESET procedure in return. If the BSC never gets back, this process appears to continue indefinitely.

This is bad, as it means that anyone ever sending/spoofing a single "BSSMAP RESET" to OsmoMSC will be able to turn it into an "amplification attack" with OsmoMSC sending BSSMAP RESET in return.

In order to avoid this, we should probably do both of:

• stop re-transmitting the BSSMAP RESET after some point and simply forget about the BSCs
• introduce a "locked down" mode in which we don't accept BSSMAP from any random source out there, but only explicitly configured BSCs (in the VTY)