October 2009 - OpenBSC - lists.osmocom.org

[PATCH 0/1] Add bport0/1 support for bs11_config

by Daniel Willmann

Hello, second try to add support to bs11_config for bport0/1 configuration. This time with enum abis_bs11_line_cfg. It seems sometimes creating bport1 fails, even LMT shows create obj greyed out. Don't know why yet. Regards, Daniel Willmann Daniel Willmann (1): Add {create,delete}-bport1 and bport0-{star,multidrop} to bs11-config openbsc/include/openbsc/abis_nm.h | 10 +++++++++- openbsc/src/abis_nm.c | 31 +++++++++++++++++++++++++++++-- openbsc/src/bs11_config.c | 26 ++++++++++++++++++++++++++ 3 files changed, 64 insertions(+), 3 deletions(-)

13 years, 4 months

4
5
0 0

RFC: Establishing logging standards

by Holger Freyther

Hey, I think in the next days I will go around the sourcecode and change a couple of logging messages. My two primary goals are increase the usefulness to figure out what was going wrong and the second to be able to put some of these into the syslog. Should we use DEBUG* to also log to syslog or introduce a new set of macros? Log Levels: I think Harald has expressed the wish to introduce log levels. Should we follow the log levels of syslog(3)? Messages: I would like to collect formats for various actions. Currently I'm thinking of the following but would like to have more input. subscriber: When talking about a subscriber use TMSI, IMSI and Extension. lchan: Include refcount, channel type, link_id, subscriber sccp: Talk about SCCP source local reference and pointer transaction: Print the transaction? gsm0408: Print the lchan which prints the subscriber? comments? holger

14 years, 5 months

3
8
0 0

[PATCH] implemented GSM340_TP_VPF_ABSOLUTE

by Steffen 'stefreak' Neubauer

From: Steffen Neubauer <stefreak(a)stefreak.de> - Added function "gsm340_scts" to decode the service center time stamp into a UTC/GMT timestamp - in function gsm340_validity_period: can now decode validity period format absolute. I hope it's good ;) Greetings, Steffen

14 years, 5 months

2
4
0 0

GPRS branch status updates

by Harald Welte

Hi all! I've pushed the current state of GPRS support into the 'gprs' branch. All the 'core' changes related to GPRS are already in master, so it mainly really adds the GPRS protocols (gprs_{ns,bssgp,llc}.[ch]) as well as the handling of the most importnat 04.08 GMM messages (gsm_04_08_gprs.[ch]) as well as the state management for the SGSN MM context (gprs_sgsn.[ch]). The status of the code is as follows: * NS link and BSSGP link are established between OpenBSC and the nanoBTS * LLC frames from the MS get delivered to the OpenBSC LLC code * GMM messages sent over LLC are delivered to the GMM code * The GMM code tries to respond with useful answers, permitting GPRS attach as well as routing area update What's missing: * any kind of GGSN functionality, i.e. gatewaying to PPP daemon for actual user payloads * persistant storage of SGSN MM context information, especially the attach/detach status, routing area and P-TMSI of a subscriber * PDP context activation/deactivation * flow control for the BTS as well as for each MS (BSSGP level) * retransmissions and things like acknowledged mode of LLC * support for multiple BTS There's really only one extremely ugly hack in the code right now, and that is that the IP address of the BTS is hard-coded in the ipac_gprs_send() function. You will have to enter the IP address of your BTS there to make packets in the SGSN->BTS direction delivered. Apart from that, I think the code is at a state where other interested developers can start playing with it. I am leaving to Korea on a customer assingment tomorrow and will unlikely have time to work on any GPRS code throughout the next two weeks. To get the code going, you should do the following things: * chceck out the gprs branch * hard-code your ip address into ipac_gprs_send() as indicated above * change your openbsc.cfg to use the last timeslot (TS 7) as "TCH/F_PDCH" instead of just "TCH/F" Patches / Bug reports / ... welcome Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 5 months

2
4
0 0

AW: OpenBSC RTP / MNCC integration

by Andreas.Eversberg

hi harald, > sorry for not getting back earlier. I honestly did not realize that there > was a second attachment to your mail. We typically use inline patches, and one > patch per mail on this list. Once again, sorry for the delay. next time i will send the patches inline... > I'm now looking at the code in detail, I shall be getting back to you at some > point during the next days. in order to remove md5 code, you can use a simple XOR to mix the input data. i think it is good enough to not select the same random number as the base station. regards, andreas

14 years, 5 months

2
1
0 0

OpenBSC unsubscribe notification

by mailman-bounces＠lists.gnumonks.org

xavier.carcelle(a)openpattern.org has been removed from OpenBSC.

14 years, 5 months

1
0
0 0

(no subject)

by Andreas.Eversberg

hi there, i found the problem with the delayed audio between application and the nanoBTS. the reason was the timestamp. a delay in openbsc causes packets to be delayed 1/2 seconds, so many packet of 1/2 seconds arrived at nanoBTS after the delay at once, nanoBTS buffers them. the reason for the delay was the "usleep(100000)" hack inside input/ipaccess.c. the patch will use the tx_timer instead, so openbsc and application will not stall. this timer was already used with BS11 messages. (there it uses 50 miliseconds instead of 100 miliseconds.) sending 10 messages to nanoBTS will take almost one second. can we decrease the tx_timer value for nanoBTS? how many packets can handle nanoBTS per second? also i fixed some bugs in the rtp patch. use rtp_2.patch for commission/discussion instead. regards, andreas

14 years, 5 months

2
1
0 0

UMTS BTS for sale on ebay

by Marc Juul

Hi. Just wanted to let you know about a $500 UMTS BTS for sale on ebay: http://cgi.ebay.com/ALCATEL-LUCENT-ANDREW-UMTS-BTS-1120-BASE-STATION_W0QQit… In case you were looking for one. -- Juul juul(a)labitat.dk

14 years, 5 months

2
1
0 0

[PATCH] ip.access: Header has a 16bit length in network byte order

by Sylvain Munaut

From: Sylvain Munaut <tnt(a)246tNt.com> This is confirmed by looking at the source of their dissector. The length can go up to 273 bytes apparently (again, according to the source of their dissector). Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/include/openbsc/ipaccess.h | 3 +-- openbsc/src/input/ipaccess.c | 10 +++++----- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h index eb17167..3956877 100644 --- a/openbsc/include/openbsc/ipaccess.h +++ b/openbsc/include/openbsc/ipaccess.h @@ -4,8 +4,7 @@ #include "e1_input.h" struct ipaccess_head { - u_int8_t zero; - u_int8_t len; + u_int16_t len; /* network byte order */ u_int8_t proto; u_int8_t data[0]; } __attribute__ ((packed)); diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c index 1265982..ea44f1e 100644 --- a/openbsc/src/input/ipaccess.c +++ b/openbsc/src/input/ipaccess.c @@ -259,7 +259,7 @@ struct msgb *ipaccess_read_msg(struct bsc_fd *bfd, int *error) { struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "Abis/IP"); struct ipaccess_head *hh; - int ret = 0; + int len, ret = 0; if (!msg) { *error = -ENOMEM; @@ -284,8 +284,9 @@ struct msgb *ipaccess_read_msg(struct bsc_fd *bfd, int *error) /* then read te length as specified in header */ msg->l2h = msg->data + sizeof(*hh); - ret = recv(bfd->fd, msg->l2h, hh->len, 0); - if (ret < hh->len) { + len = ntohs(hh->len); + ret = recv(bfd->fd, msg->l2h, len, 0); + if (ret < len) { fprintf(stderr, "short read!\n"); msgb_free(msg); *error = -EIO; @@ -374,8 +375,7 @@ void ipaccess_prepend_header(struct msgb *msg, int proto) /* prepend the ip.access header */ hh = (struct ipaccess_head *) msgb_push(msg, sizeof(*hh)); - hh->zero = 0; - hh->len = msg->len - sizeof(*hh); + hh->len = htons(msg->len - sizeof(*hh)); hh->proto = proto; } -- 1.6.5.1

14 years, 5 months

2
1
0 0

AW: [RFC] Subscriber Reference Counting

by Andreas.Eversberg

> Currently the branch is doing: > - Stops borrowing the gsm_subscriber to the lchan > - Fixes leaks in the vty_interface_layer3.c code for subscriber action > - Fixes a subscriber leak (actually two) in mncc_send. > > if wanted I can attach the patches to this mail to ease reviewing. what branch is it? do i need additional patches? i use the master with the RTP patch applied.

14 years, 5 months

2
1
0 0

AW: [RFC] Subscriber Reference Counting

by Andreas.Eversberg

hi holger, i would like to test it. but before i can do that, i need to know what ressource are actually counted. for example: a transaction holds one ressource, paging holds one ressource, as well as a channel that is associated to that subscriber's transaction. what about sms? shold an object of "struct gsm_sms" be counted as one ressource, or each sender/receiver within this structure, or all together (one for the sms, one for the sender and one for the receiver)? i need a list of all subscriber ressources for gsm_04_11.c regards, andreas

14 years, 5 months

2
1
0 0

OpenBSC system_information branch

by Harald Welte

Hi! I've updated the system_information branch. The purpose of this branch is to move away from static u_int8_t arrays that are used as templates for the SYSTEM INFORMATION messages. Thise arrays are reminiscent of the old days of bs11_init, where everything had been done this way. The current head of system_information is now managing to actually do that. The full SI1-SI4 on the BCCH as well as the SI5/SI6 on the SACCH are now created from scratch (see code in system_information.c) The content of the SI is "phase 1" content, i.e. before rest octets were introduced I've also written some code to generate the rest octets, as well as a some "rest octet encoding aware" bit vector routines that understand the meaning of 0/1/L/H. However, those rest octet routines are not yet used. They need some careful testing before use. Testing is actually quite hard, as not even wireshark has dissector for the system information messages (anyone interested in contributing on this? It's needed for airprobe, too) One interesting bit that stalled development for quite some time: If you send a SACCH FILLing with length > 18 bytes, then the nanoBTS will actually crash somewhere in the layer 2, sending you long error strings with addresses (stack?) as error reports before rebooting :) Feel free to start testing the system_information branch if you're interested. I'd be happy to hear any "master works for my phone, but system_information branch confuses my phone" kind of reports. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 5 months

3
3
0 0

Status of wireshark patches

by Harald Welte

Hi! Holger has asked me to send an update on the status of the wireshark patches that we have in git: gsm_a_rr-rrlp.patch and abisip.patch are mainline wireshark, they can be removed from our git tree. abis_oml.patch: * does not yet dissect all the different 12.21 IEs, especially not all of the standard IEs * does not yet differentiate between BTS types. We need a preference where we can select the BTS model in order to really pars all the messages, plus vendor dependent IE tables * might possibly use non-standard C language syntax and thus not be portable to micrsofot compilers on windows. not sure what the wireshark requirements are in that regard rsli-ipaccess.patch: * does not support all of the ip.access RSL extensions yet * no major reason why it should nt be merged to wireshark * additional ip.access RSL extensions can be sent as incremental patches lucent-hmb.patch * this is just a minimal stub, should be completed more before submitting anywhere -- - Harald Welte <laforge(a)gpl-violations.org> http://gpl-violations.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 5 months

1
0
0 0

Errors reports by clang --analyze in abis_nm.c

by Holger Freyther

Hey, the clang C frontend has found some issues in our OpenBSC code. I think we will need to have a table for BS11 and one for ipaccess with the shared/speced elements being in both tables. Here is the list of things I can resolve myself right now: [NM_ATT_IPACC_FREQ_CTRL] = { TLV_TYPE_FIXED, 2 } [NM_ATT_IPACC_FREQ_CTRL] = { TLV_TYPE_TV, }, these vendor specific commands have the same value: [NM_ATT_IPACC_NS_CFG] = { TLV_TYPE_TL16V }, [NM_ATT_BS11_BIT_ERR_THESH] = { TLV_TYPE_FIXED, 2 }, [NM_ATT_IPACC_BSSGP_CFG] = { TLV_TYPE_TL16V }, [NM_ATT_BS11_BOOT_SW_VERS] = { TLV_TYPE_TLV }, ^~~~~~~~~~~~ [NM_ATT_IPACC_RLC_CFG] = { TLV_TYPE_TL16V }, [NM_ATT_BS11_CCLK_ACCURACY] = { TLV_TYPE_TV }, ^~~~~~~~~~~ [NM_ATT_IPACC_ALM_THRESH_LIST]= { TLV_TYPE_TL16V }, [NM_ATT_BS11_CCLK_TYPE] = { TLV_TYPE_TV }, ^~~~~~~~~~~ [NM_ATT_IPACC_CODING_SCHEMES] = { TLV_TYPE_TL16V }, [0xa8] = { TLV_TYPE_TLV }, [NM_ATT_IPACC_UPTIME] = { TLV_TYPE_TL16V }, [NM_ATT_BS11_L1_PROT_TYPE] = { TLV_TYPE_TV }, [NM_ATT_IPACC_RLC_CFG_3] = { TLV_TYPE_TL16V }, [NM_ATT_BS11_LINE_CFG] = { TLV_TYPE_TV }, [0x85] = { TLV_TYPE_TV }, [NM_ATT_IPACC_STREAM_ID] = { TLV_TYPE_TV, },

14 years, 5 months

2
1
0 0

[RFC] Subscriber Reference Counting

by Holger Freyther

Hi, IIRC Harald et all. were seeing GSM subscriber leakage at HAR2009 and we have not yet explored the cause of this problem. I would like to have no subscriber leaks for the congress and propose the following changes. I have pushed the "holger/subscr-ref-handling" branch to our repository and would be happy if people could give it a spin. My testing here is pretty limited. Currently I have two commits. The second is removing a leak in the vty console for SMS sending and subscriber usage and the other patch is trying to stop borrowing someone else's gsm_subscriber reference. More details below. Currently we do lchan->subscr = new_subscr and then we have two flavors of checking if the channel is already used. I have changed this to use a new assignment function that will do the check consistently and updated call sites. I would establish the following guideline for gsm_subscriber handling: In every method where subscr_get* is called the subscriber must be released at the exit with subscr_put unless the referenced provider is assigned to a struct that is created in the same method, then the subscriber must be released next to the talloc_free. More details: - paging.c seems fine - gsm_subscriber_chan seems fine - gsm_04_08_utils.c seems fine - gsm_04_08.c seems fine now as well. subscr_get/_put should be balanced - gsm_04_11.c if we leak a subscriber we also leak a sms I have not checked all SMS paths to be sure we don't leak there. I would be very happy if people could test this. z,

14 years, 5 months

1
0
0 0

[PATCH 1/4] ip.access: Fix bad call to patch_nm_tables when configuring channel

by Sylvain Munaut

From: Sylvain Munaut <tnt(a)246tNt.com> The bts variable isn't even defined at that point causing crashes. The patch_nm_tables is called for BTS object class. Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/bsc_init.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c index 1394dd8..0adc656 100644 --- a/openbsc/src/bsc_init.c +++ b/openbsc/src/bsc_init.c @@ -378,7 +378,6 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj, trx = ts->trx; if (new_state->operational == 1 && new_state->availability == NM_AVSTATE_DEPENDENCY) { - patch_nm_tables(bts); enum abis_nm_chan_comb ccomb = abis_nm_chcomb4pchan(ts->pchan); abis_nm_set_channel_attr(ts, ccomb); -- 1.6.4

14 years, 5 months

2
8
0 0

Re: RRLP

by Dieter Spaar

Hello Sylvain, On Mon, 26 Oct 2009 10:19:55 +0100, "Sylvain Munaut" <246tnt(a)gmail.com> wrote: > > So a lot of phones seem to support this and with assistance data could > maybe provide a location. > Did you try to correlate IMEI manufacturer part with the messages ? No, not yet. > Do you have any log of a successful response ? Maybe I screw up the > encoding of the position somehow. Yes, here is an example. This is the response from the phone 42 11 00 00 6A 57 9F B6 41 29 B1 B0 10 8D 84 00 6C 9C 9C 01 B1 0C This is decoded PDU (asn1c was used): PDU ::= { referenceNumber: 2 component: MsrPosition-Rsp ::= { locationInfo: LocationInfo ::= { refFrame: 0 gpsTOW: 6969247 fixType: 1 posEstimate: 90 4A 6C 6C 04 23 61 00 1B 27 27 00 6C 43 } } } And those are the coordinates from "posEstimate" (I did not care about the height): 52.329040 - 52 19'44" N 5.819342 - 5 49' 9" E Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

14 years, 5 months

1
0
0 0

Re: RRLP

by Dieter Spaar

Hello, here is a summary of the RRLP requests from HAR2009. It is the summary from a time periode of about 10 hours near the end of the event. Total number of RRLP responses: 2179 "methodNotSupported" response: 122 "notEnoughSats" response: 667 "gpsAssDataMissing" response: 1368 Successful positions returned: 22 Number of different phones: 86 Phones which returned "methodNotSupported": 5 Phones which returned a position: 7 Requested assitance data for the "gpsAssDataMissing" response: 530 Navigation Model, Reference Location, Reference Time 468 Navigation Model, Reference Location 141 Navigation Model 123 Almanac, Navigation Model, Reference Location, Reference Time 58 Almanac, Navigation Model, Reference Location, Reference Time, Real-Time Integrity 27 Almanac, Navigation Model, Reference Location 13 Almanac, UTC Model, Ionospheric Model, Navigation Model, Reference Location, Reference Time, Real-Time Integrity 5 Reference Location 3 Navigation Model, Reference Time And this was the request sent to the phones: PDU: 40 01 78 A8 referenceNumber 2 msrPositionReq methodType msBased Accuracy 60 positionMethod gps measureResponseTime 2 useMultipleSets oneSet Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

14 years, 5 months

2
1
0 0

Re: RRLP

by Dieter Spaar

Hello Sylvain, On Sun, 25 Oct 2009 19:50:53 +0100, "Sylvain Munaut" <246tnt(a)gmail.com> wrote: > Does anyone have a clue ? You already had a look at TS 44.031 ? It describes the RRLP procedures in detail. It also mentiones that the RRLP maximum PDU size is 242 bytes and that you have to use RRLP pseudo-segmentation to deliver larger PDUs, however it also mentiones that "legacy" MS and SMLC may exceed this PDU size. Best regards, Dieter -- Dieter Spaar, Germany spaar(a)mirider.augusta.de

14 years, 5 months

1
0
0 0

RRLP

by Sylvain Munaut

Hi, I've been working on improving RRLP support lately. Most precisely, providing real assistance data sourced directly from a GPS receiver attached to the control PC. My problem right now is that the generated APDU is about 1500 bytes and obviously there is no way that fits in a single L3 frame. GSM 04.08 9.1.53 describes the format of the APDU and there is a 4 bits flag fields, which from what I understand occupies the 4 upper fields of the first octet and that allows fragmentation. From reading the IE description in 10.5.2.49 I should set : 0x10 for the first segment 0x30 for the intermediate segments 0x20 for the last segment Which is what I tried, by modifying the gsm48_send_rr_app_info function like this : http://yourpaste.net/3558/ Unfortunately, I couldn't make it work. When I set the segment size to try and have L3 frame of 251 bytes, I get some RSL error back and when I use a smaller size, the MS seems to interpret each segment separately and not reconstituting them ... Does anyone have a clue ? Sylvain Here's a log, where you see the MS answering independently to the 3 segments (with errors since you can't just decode partial data ...): <0002> gsm_04_08.c:280 lchan (bts=0,trx=0,ts=0,ch=0) decreases usage to: 0 <0004> gsm_04_08.c:901 -> LOCATION UPDATE ACCEPT <0002> gsm_04_08_utils.c:144 (bts 0 trx 0 ts 0 pd 05) Sending 0x02 to MS. l3_len = 14 <0004> gsm_04_08.c:1222 -> MM INFO <0002> gsm_04_08_utils.c:144 (bts 0 trx 0 ts 0 pd 05) Sending 0x32 to MS. l3_len = 22 <0008> gsm_04_08.c:1651 TX APPLICATION INFO id=0x00, len=688 <0008> gsm_04_08.c:1669 TX APPLICATION INFO Segment ofs=0 len=230 id=10 <0002> gsm_04_08_utils.c:144 (bts 0 trx 0 ts 0 pd 06) Sending 0x38 to MS. l3_len = 234 <0008> gsm_04_08.c:1669 TX APPLICATION INFO Segment ofs=230 len=230 id=30 <0002> gsm_04_08_utils.c:144 (bts 0 trx 0 ts 0 pd 06) Sending 0x38 to MS. l3_len = 234 <0008> gsm_04_08.c:1669 TX APPLICATION INFO Segment ofs=460 len=228 id=20 <0002> gsm_04_08_utils.c:144 (bts 0 trx 0 ts 0 pd 06) Sending 0x38 to MS. l3_len = 232 <0001> abis_rsl.c:1282 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=0 DATA INDICATION <0004> gsm_04_08.c:1438 TMSI Reallocation Completed. Subscriber: 206205003327508 <0001> abis_rsl.c:1282 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=0 DATA INDICATION <0020> gsm_04_08.c:1594 RX APPLICATION INFO id/flags=0x00 apdu_len=2 apdu=48 20 <0010> abis_rsl.c:997 channel=(bts=0,trx=0,ts=0) chan_nr=0x28 CONNECTION FAIL: CAUSE=0x01(Radio Link Failure) RELEASING. <0010> abis_rsl.c:720 RF Channel Release CMD channel=(bts=0,trx=0,ts=0) chan_nr=0x28 <0010> abis_rsl.c:997 channel=(bts=0,trx=0,ts=0) chan_nr=0x28 RF CHANNEL RELEASE ACK <0001> abis_rsl.c:1282 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=0 DATA INDICATION <0020> gsm_04_08.c:1594 RX APPLICATION INFO id/flags=0x00 apdu_len=2 apdu=88 10 <0010> abis_rsl.c:720 RF Channel Release CMD channel=(bts=0,trx=0,ts=0) chan_nr=0x28 <0010> abis_rsl.c:997 channel=(bts=0,trx=0,ts=0) chan_nr=0x28 RF CHANNEL RELEASE ACK <0001> abis_rsl.c:1282 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=0 DATA INDICATION <0020> gsm_04_08.c:1594 RX APPLICATION INFO id/flags=0x00 apdu_len=2 apdu=c8 00 <0001> abis_rsl.c:1282 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 sapi=0 RELEASE INDICATION <0010> abis_rsl.c:720 RF Channel Release CMD channel=(bts=0,trx=0,ts=0) chan_nr=0x20 <0010> abis_rsl.c:997 channel=(bts=0,trx=0,ts=0) chan_nr=0x20 RF CHANNEL RELEASE ACK <0002> gsm_subscriber_base.c:150 subscr 201 usage decreased usage to: 0

14 years, 5 months

1
0
0 0

ip.access nanobts 1800 model 139, get "disabled" states

by Oystein Homelien

Hello, I am trying to get my nanobts 1800 model 139 working. It is set up for dhcp and correctly contacts my openbsc instance. I get lots of "disabled" states and I am curious if you have any hints for me. I suspect there may be a bts firmware version problem. Any help is appreciated! See log below. ipaccess_find: MAC Address='00:02:95:00:xx:xx' IP Address='xxxx' Unit ID='1801/0/0' Location 1='' Location 2='BTS_NBT131G' Equipment Version='111_029_21' Software Version='120a002_v149b32d0' Unit Name='nbts-00-02-95-x' Serial Number='x' config: ! OpenBSC configuration saved from vty ! ! password foo ! line vty no login ! network network country code 242 mobile network code 99 short name analyzer long name AnaLyzer auth policy accept-all encryption a5 0 bts 0 type nanobts band 1800 cell_identity 0 location_area_code 1 training_sequence_code 7 base_station_id_code 63 ms max power 12 channel allocator ascending ip.access unit_id 1801 0 trx 0 arfcn 576 max_power_red 12 rsl e1 line 0 timeslot 1 sub-slot full rsl e1 tei 1 timeslot 0 phys_chan_config CCCH+SDCCH4 e1 line 0 timeslot 1 sub-slot full timeslot 1 phys_chan_config SDCCH8 e1 line 0 timeslot 2 sub-slot 1 timeslot 2 phys_chan_config TCH/F e1 line 0 timeslot 2 sub-slot 2 timeslot 3 phys_chan_config TCH/F e1 line 0 timeslot 2 sub-slot 3 timeslot 4 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 0 timeslot 5 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 1 timeslot 6 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 2 timeslot 7 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 3 log: <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=GPRS NSE(f0) INST=(00,ff,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS CELL(f1) INST=(00,00,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS NSVC(f2) INST=(00,00,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS NSVC(f2) INST=(00,01,ff) STATE CHG: <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) Software Activated Report <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Off line(03) <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:863 Software Activate Request NACKing for GPRS obj_class 0xf0 <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) Software Activated Report <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1671 Set BTS Attr (bts=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x01 obj_inst=(0x00, 0xff, 0xff) <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) Software Activated Report <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x04 obj_inst=(0x00, 0x00, 0xff) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x00) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=1) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x01) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=2) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x02) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=3) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x03) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=4) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x04) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=5) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=6) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x06) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=7) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x07) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) Software Activated Report <0020> abis_nm.c:1688 Set TRX Attr (bts=0,trx=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x02 obj_inst=(0x00, 0x00, 0xff) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:2477 IPACCESS(0xe1): RSL CONNECT ACK IP=123.234.10.101 PORT=3003 <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked yours, oystein

14 years, 5 months

3
8
0 0

Final (?) USSD-branch patch

by Mike Haben

- Improved handling of extension-number string (as per review) - Guard against a buffer-overflow if mobile sends a too-long USSD - declare some function-parameters const - fix gsm_ts_name function to display the right BTS number (bts->nr rather than bts->bts_nr) Hope this all looks OK... Best regards, Mike H.

14 years, 5 months

1
0
0 0

[PATCH] USSD - address remaining review points, and guard against buffer overflow Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 10 ++++++---- openbsc/include/openbsc/gsm_subscriber.h | 7 ++++--- openbsc/src/gsm_04_80.c | 9 ++++++--- openbsc/src/gsm_data.c | 2 +- openbsc/src/ussd.c | 6 +++--- 5 files changed, 20 insertions(+), 14 deletions(-) mode change 100644 => 100755 openbsc/include/openbsc/gsm_04_80.h mode change 100644 => 100755 openbsc/include/openbsc/gsm_subscriber.h mode change 100644 => 100755 openbsc/src/gsm_04_80.c mode change 100644 => 100755 openbsc/src/gsm_data.c mode change 100644 => 100755 openbsc/src/ussd.c diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h old mode 100644 new mode 100755 index 9bdf2c2..c240bbe --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -125,17 +125,19 @@ #include <openbsc/msgb.h> +#define MAX_LEN_USSD_STRING 31 + struct ussd_request { - char text[32]; + char text[MAX_LEN_USSD_STRING + 1]; u_int8_t transaction_id; u_int8_t invoke_id; }; -int gsm0480_decode_ussd_request(struct msgb *msg, +int gsm0480_decode_ussd_request(const struct msgb *msg, struct ussd_request *request); -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, +int gsm0480_send_ussd_response(const struct msgb *in_msg, const char* response_text, const struct ussd_request *req); -int gsm0480_send_ussd_reject(struct msgb *msg, +int gsm0480_send_ussd_reject(const struct msgb *msg, const struct ussd_request *request); #endif diff --git a/openbsc/include/openbsc/gsm_subscriber.h b/openbsc/include/openbsc/gsm_subscriber.h old mode 100644 new mode 100755 index ea70c3a..b181917 --- a/openbsc/include/openbsc/gsm_subscriber.h +++ b/openbsc/include/openbsc/gsm_subscriber.h @@ -8,13 +8,14 @@ #define GSM_IMEI_LENGTH 17 #define GSM_IMSI_LENGTH 17 #define GSM_NAME_LENGTH 128 -#define GSM_EXTENSION_LENGTH 128 + +#define GSM_EXTENSION_LENGTH 6 +#define GSM_MIN_EXTEN 20000 +#define GSM_MAX_EXTEN 49999 /* reserved according to GSM 03.03 § 2.4 */ #define GSM_RESERVED_TMSI 0xFFFFFFFF -#define GSM_MIN_EXTEN 20000 -#define GSM_MAX_EXTEN 49999 #define GSM_SUBSCRIBER_FIRST_CONTACT 0x00000001 #define tmsi_from_string(str) strtoul(str, NULL, 10) diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c old mode 100644 new mode 100755 index 5d85c82..7f5089d --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -70,7 +70,7 @@ static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, u_int8_t tag, /* Decode a mobile-originated USSD-request message */ -int gsm0480_decode_ussd_request(struct msgb *msg, struct ussd_request *req) +int gsm0480_decode_ussd_request(const struct msgb *msg, struct ussd_request *req) { int rc = 0; u_int8_t *parse_ptr = msgb_l3(msg); @@ -230,6 +230,9 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; + /* Prevent a mobile-originated buffer-overrun! */ + if (num_chars > MAX_LEN_USSD_STRING) + num_chars = MAX_LEN_USSD_STRING; gsm_7bit_decode(req->text, &(uss_req_data[7]), num_chars); /* append null-terminator */ @@ -242,7 +245,7 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, } /* Send response to a mobile-originated ProcessUnstructuredSS-Request */ -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, +int gsm0480_send_ussd_response(const struct msgb *in_msg, const char* response_text, const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); @@ -295,7 +298,7 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, return gsm48_sendmsg(msg, NULL); } -int gsm0480_send_ussd_reject(struct msgb *in_msg, +int gsm0480_send_ussd_reject(const struct msgb *in_msg, const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c old mode 100644 new mode 100755 index 6767c3f..2344d96 --- a/openbsc/src/gsm_data.c +++ b/openbsc/src/gsm_data.c @@ -224,7 +224,7 @@ static char ts2str[255]; char *gsm_ts_name(struct gsm_bts_trx_ts *ts) { snprintf(ts2str, sizeof(ts2str), "(bts=%d,trx=%d,ts=%d)", - ts->trx->bts->bts_nr, ts->trx->nr, ts->nr); + ts->trx->bts->nr, ts->trx->nr, ts->nr); return ts2str; } diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c old mode 100644 new mode 100755 index e414b1c..a3d11f0 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -63,9 +63,9 @@ int handle_rcv_ussd(struct msgb *msg) static int send_own_number(const struct msgb *msg, const struct ussd_request *req) { char *own_number = msg->lchan->subscr->extension; - /* Need trailing CR as EOT character */ - char response_string[] = "Your extension is xxxxx\r"; + char response_string[GSM_EXTENSION_LENGTH + 20]; - memcpy(response_string + 18, own_number, 5); + /* Need trailing CR as EOT character */ + snprintf(response_string, sizeof(response_string), "Your extension is %s\r", own_number); return gsm0480_send_ussd_response(msg, response_string, req); } -- 1.6.0.4 --------------090904070701030605040309--

14 years, 5 months

1
0
0 0

Re: cheap ip.access nano BTS on ebay

by Bjoern Heller

Hallo, ich bitte dich/alle aber da nicht zu viel Wirbel drum zu machen, damit die nicht bei ihrem eventuell vorhandenem restlichen Bestand die Preise hoch ziehen... http://stores.ebay.de/BLLCORP Gruss Bjoern Am 22.10.2009 um 23:33 schrieb Martin Kluge: > Hi Bjoern, > > könntest Du mit evtl. mal den Namen/Kontaktdaten des Händlers > schicken? > > > Vielen Dank, > Martin > > On Thu, Oct 22, 2009 at 04:21:00PM +0200, Bjoern Heller wrote: >> Hello, >> >> yesterday I got a ip.access nano BTS >> MODEL 165B V33 PCS 1900 >> for 133 Euro (incl. shipping) on Ebay. >> >> The seller has maybe more in stock... >> >> I know, that it`s only 1900 band but maybe interesting for some >> people. >> >> regards >> Bjoern >> >> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >> Björn Heller >> Jabber: tec(a)jabber.hellercom.de >> > > -- > Dipl. Inf. (FH) Martin Kluge > > Email : mk(a)elxsi.de > Phone : +49 (700) 00101000 > Fax : +49 (941) 599267834 > Website : http://www.elxsi.de > GPG Key : http://www.elxsi.de/key.pub > RIPE : KLM-RIPE / AS35292 > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

14 years, 5 months

1
0
0 0

AW: Running an licensed experimental GSM network at 26c3

by Andreas.Eversberg

hi, i also did my part: http://events.ccc.de/congress/2009/wiki/index.php/Linux-Call-Router harald, you may add yours to the projects category: http://events.ccc.de/congress/2009/wiki/index.php/Category:Projects. if you would like to join with me, then go ahead, link your project to my page and increase the number of seats, and note on both project pages that both projects are together in one area. if anyone requires special equipment, let me know or bring it yourself. e.g. if we like to play with OpenBTS in conjunction with Asterisk, we need another server, since my server is in use for the ISDN/ASTERISK/DECT <-> GSM link. andreas -----Ursprüngliche Nachricht----- Von: Alexander Chemeris [mailto:alexander.chemeris@gmail.com] Gesendet: Montag, 12. Oktober 2009 22:18 An: Harald Welte Cc: Andreas.Eversberg; openbsc; openbts-discuss(a)lists.sourceforge.net Betreff: Re: Running an licensed experimental GSM network at 26c3 Hi Harald, David, Andreas, On Sun, Oct 11, 2009 at 13:19, Harald Welte <laforge(a)gnumonks.org> wrote: > On Sat, Oct 10, 2009 at 09:33:31PM +0400, Alexander Chemeris wrote: >> We'll bring one or two our USRPs for OpenBTS testing even if David Burgess >> won't be able to come, and we would love to be located near OpenBSC guys >> and you. But that'll be our first time at 26C3 and we're little bit >> lost - should we send some request to get the space? > > I think the process for applying for tablespace in the hackcenter has not yet > started. > > Meanwhile I've created a http://events.ccc.de/congress/2009/wiki/index.php/GSM > wiki page where we can add stuff to, similar to the 25C3 and HAR2009. Great, thank you. I'll keep my eye on it.

14 years, 5 months

2
2
0 0

cheap ip.access nano BTS on ebay

by Bjoern Heller

Hello, yesterday I got a ip.access nano BTS MODEL 165B V33 PCS 1900 for 133 Euro (incl. shipping) on Ebay. The seller has maybe more in stock... I know, that it`s only 1900 band but maybe interesting for some people. regards Bjoern - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

14 years, 5 months

1
0
0 0

Patch to USSD branch - eliminates static variables

by Mike Haben

Hi Harald, thanks for the review comments. Patch (attached) for the USSD branch addresses the first issue you highlighted - static variables have been eliminated. Best regards, Mike H.

14 years, 5 months

2
1
0 0

[PATCH] USSD code - eliminate static variables, as per Harald's review Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 15 +++++- openbsc/src/gsm_04_80.c | 90 ++++++++++++++++++----------------- openbsc/src/ussd.c | 19 ++++---- 3 files changed, 68 insertions(+), 56 deletions(-) diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h index 11962d8..9bdf2c2 100644 --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -125,8 +125,17 @@ #include <openbsc/msgb.h> -char* gsm0480_rcv_ussd(struct msgb *msg); -int gsm0480_send_ussd_response(struct msgb *msg, const char* response_text); -int gsm0480_send_ussd_reject(struct msgb *msg); +struct ussd_request { + char text[32]; + u_int8_t transaction_id; + u_int8_t invoke_id; +}; + +int gsm0480_decode_ussd_request(struct msgb *msg, + struct ussd_request *request); +int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, + const struct ussd_request *req); +int gsm0480_send_ussd_reject(struct msgb *msg, + const struct ussd_request *request); #endif diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c index 052b0a7..5d85c82 100644 --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -37,16 +37,16 @@ #include <openbsc/gsm_04_08.h> #include <openbsc/gsm_04_80.h> -static char ussd_string_buff[32]; -static u_int8_t last_transaction_id; -static u_int8_t last_invoke_id; - /* Forward declarations */ -static int parse_ussd(u_int8_t *ussd); -static int parse_ussd_information_elements(u_int8_t *ussd_ie); -static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length); -static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length); -static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length); +static int parse_ussd(u_int8_t *ussd, struct ussd_request *req); +static int parse_ussd_info_elements(u_int8_t *ussd_ie, + struct ussd_request *req); +static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length, + struct ussd_request *req); +static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length, + struct ussd_request *req); +static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, + struct ussd_request *req); static inline unsigned char *msgb_wrap_with_TL(struct msgb *msgb, u_int8_t tag) { @@ -69,26 +69,24 @@ static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, u_int8_t tag, } -/* Receive a mobile-originated USSD message and return the decoded text */ -char *gsm0480_rcv_ussd(struct msgb *msg) +/* Decode a mobile-originated USSD-request message */ +int gsm0480_decode_ussd_request(struct msgb *msg, struct ussd_request *req) { int rc = 0; u_int8_t *parse_ptr = msgb_l3(msg); - memset(ussd_string_buff, 0, sizeof(ussd_string_buff)); - if ((*parse_ptr & 0x0F) == GSM48_PDISC_NC_SS) { - last_transaction_id = *parse_ptr & 0x70; - rc = parse_ussd(parse_ptr + 1); + req->transaction_id = *parse_ptr & 0x70; + rc = parse_ussd(parse_ptr+1, req); } if (!rc) DEBUGP(DMM, "Error occurred while parsing received USSD!\n"); - return ussd_string_buff; + return rc; } -static int parse_ussd(u_int8_t *ussd) +static int parse_ussd(u_int8_t *ussd, struct ussd_request *req) { int rc = 1; u_int8_t msg_type = ussd[0] & 0xBF; /* message-type - section 3.4 */ @@ -97,11 +95,11 @@ static int parse_ussd(u_int8_t *ussd) case GSM0480_MTYPE_RELEASE_COMPLETE: DEBUGP(DMM, "USS Release Complete\n"); /* could also parse out the optional Cause/Facility data */ - ussd_string_buff[0] = 0xFF; + req->text[0] = 0xFF; break; case GSM0480_MTYPE_REGISTER: case GSM0480_MTYPE_FACILITY: - rc &= parse_ussd_information_elements(ussd+1); + rc &= parse_ussd_info_elements(ussd+1, req); break; default: fprintf(stderr, "Unknown GSM 04.80 message-type field 0x%02x\n", @@ -113,7 +111,7 @@ static int parse_ussd(u_int8_t *ussd) return rc; } -static int parse_ussd_information_elements(u_int8_t *ussd_ie) +static int parse_ussd_info_elements(u_int8_t *ussd_ie, struct ussd_request *req) { int rc; /* Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 */ @@ -124,7 +122,7 @@ static int parse_ussd_information_elements(u_int8_t *ussd_ie) case GSM48_IE_CAUSE: break; case GSM0480_IE_FACILITY: - rc = parse_facility_ie(ussd_ie+2, iei_length); + rc = parse_facility_ie(ussd_ie+2, iei_length, req); break; case GSM0480_IE_SS_VERSION: break; @@ -138,7 +136,8 @@ static int parse_ussd_information_elements(u_int8_t *ussd_ie) return rc; } -static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) +static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length, + struct ussd_request *req) { int rc = 1; u_int8_t offset = 0; @@ -150,7 +149,9 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) switch (component_type) { case GSM0480_CTYPE_INVOKE: - rc &= parse_ss_invoke(facility_ie+2, component_length); + rc &= parse_ss_invoke(facility_ie+2, + component_length, + req); break; case GSM0480_CTYPE_RETURN_RESULT: break; @@ -171,7 +172,8 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) } /* Parse an Invoke component - see table 3.3 */ -static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) +static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length, + struct ussd_request *req) { int rc = 1; u_int8_t offset; @@ -183,7 +185,7 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) } offset = invoke_data[1] + 2; - last_invoke_id = invoke_data[2]; + req->invoke_id = invoke_data[2]; /* optional part */ if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) @@ -195,7 +197,8 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) switch (operation_code) { case GSM0480_OP_CODE_PROCESS_USS_REQ: rc = parse_process_uss_req(invoke_data + offset + 3, - length - offset - 3); + length - offset - 3, + req); break; default: fprintf(stderr, "GSM 04.80 operation code 0x%02x " @@ -214,36 +217,33 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) } /* Parse the parameters of a Process UnstructuredSS Request */ -static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) +static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, + struct ussd_request *req) { - int rc = 1; + int rc = 0; int num_chars; u_int8_t dcs; - /* FIXME: most phones send USSD text as a 7-bit encoded octet string; - * the following code also handles the case of plain ASCII text - * (IA5String), but other encodings might be used */ - if (uss_req_data[0] == GSM_0480_SEQUENCE_TAG) { if (uss_req_data[2] == ASN1_OCTET_STRING_TAG) { dcs = uss_req_data[4]; if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; - gsm_7bit_decode(ussd_string_buff, + gsm_7bit_decode(req->text, &(uss_req_data[7]), num_chars); + /* append null-terminator */ + req->text[num_chars+1] = 0; + rc = 1; } } - } else if (uss_req_data[0] == ASN1_IA5_STRING_TAG) { - num_chars = uss_req_data[1]; - memcpy(ussd_string_buff, &(uss_req_data[2]), num_chars); - } - + } return rc; } /* Send response to a mobile-originated ProcessUnstructuredSS-Request */ -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) +int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, + const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; @@ -278,7 +278,7 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG); /* Pre-pend the invoke ID */ - msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, req->invoke_id); /* Wrap this up as a Return Result component */ msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_RESULT); @@ -288,13 +288,15 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) /* And finally pre-pend the L3 header */ gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); - gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->proto_discr = GSM48_PDISC_NC_SS | req->transaction_id + | (1<<7); /* TI direction = 1 */ gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); } -int gsm0480_send_ussd_reject(struct msgb *in_msg) +int gsm0480_send_ussd_reject(struct msgb *in_msg, + const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; @@ -307,7 +309,7 @@ int gsm0480_send_ussd_reject(struct msgb *in_msg) GSM_0480_GEN_PROB_CODE_UNRECOGNISED); /* Before it insert the invoke ID */ - msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, req->invoke_id); /* Wrap this up as a Reject component */ msgb_wrap_with_TL(msg, GSM0480_CTYPE_REJECT); @@ -318,7 +320,7 @@ int gsm0480_send_ussd_reject(struct msgb *in_msg) /* And finally pre-pend the L3 header */ gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); gh->proto_discr = GSM48_PDISC_NC_SS; - gh->proto_discr |= last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->proto_discr |= req->transaction_id | (1<<7); /* TI direction = 1 */ gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c index 9dc2205..e414b1c 100644 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -38,33 +38,34 @@ const char USSD_TEXT_OWN_NUMBER[] = "*#100#"; /* Forward declarations of network-specific handler functions */ -static int send_own_number(struct msgb *msg); +static int send_own_number(const struct msgb *msg, const struct ussd_request *req); /* Entrypoint - handler function common to all mobile-originated USSDs */ int handle_rcv_ussd(struct msgb *msg) { - char *ussd_text_rcvd = gsm0480_rcv_ussd(msg); + struct ussd_request req; - if (ussd_text_rcvd[0] == 0xFF) /* Release-Complete */ + gsm0480_decode_ussd_request(msg, &req); + if (req.text[0] == 0xFF) /* Release-Complete */ return 0; - if (strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) { + if (strstr(USSD_TEXT_OWN_NUMBER, req.text) != NULL) { DEBUGP(DMM, "USSD: Own number requested\n"); - return send_own_number(msg); + return send_own_number(msg, &req); } else { - DEBUGP(DMM, "Unhandled USSD %s\n", ussd_text_rcvd); - return gsm0480_send_ussd_reject(msg); + DEBUGP(DMM, "Unhandled USSD %s\n", req.text); + return gsm0480_send_ussd_reject(msg, &req); } } /* A network-specific handler function */ -static int send_own_number(struct msgb *msg) +static int send_own_number(const struct msgb *msg, const struct ussd_request *req) { char *own_number = msg->lchan->subscr->extension; /* Need trailing CR as EOT character */ char response_string[] = "Your extension is xxxxx\r"; memcpy(response_string + 18, own_number, 5); - return gsm0480_send_ussd_response(msg, response_string); + return gsm0480_send_ussd_response(msg, response_string, req); } -- 1.6.0.4 --------------080700070202040005090208--

14 years, 5 months

1
0
0 0

Progress on the GPRS side

by Harald Welte

Hi all! With the current code in the 'gprs' branch, I am able to get the NS (08.16) and BSSGP (08.18) layers up and running with the nanoBTS. The NS RESET and TEST procedures are running fine, as well as the BSSGP RESET and BLOCK procedures. I now need to work on patching the system information to indicate GPRS support and add a SI13 message. Hopefully at that point, it is possible to receive LLC frames that are being sent by the MS. Ignoring Mobility Management for now and considering only single-BTS operation of GPRS, the biggest remaining items are: * understand LLC better and implement it * implement SNDCP * how to interface the actual network (using pty's with pppd on top) * make things more dynamic rather than static at compile time Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 5 months

1
0
0 0

progress: nanoBTS multi-TRX configuration

by Harald Welte

Hi all, JFYI: There's some progress on the nanoBTS multi-TRX configuration. It seems it was my mistake. Setting the TRX0 unit ID to 1801/0/0 and the TRX1 unit ID to 1801/0/1 works using ipaccess-config. If you then connect the TIB cable (TRX0 TIB out -> TRX1 TIB in) and reboot both nanoBTS, you will get a single A-bis OML connection from 1801/0/0 where you get software activate requests for both transceivers. Somehow we're not handling them correctly yet from our abis_nm code, but that should be easy to solve. I'm working at it. So Dieter and others: No need to worry about this at the moment, we're very close now and I think it is no problem for the 26C3. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 6 months

1
1
0 0

Re: Mobile-originated USSD - double D'oh!

by Harald Welte

Hi Mike! Some comments: * it would have been good to Cc the mailinglist when you re-posted the patch, this way more eyes are on the code * I've looked at it but unfortunately there's a number of issues. That's why I've committed it to a new 'ussd' branch in git. * I've pushed an incremental patch as commit that cleans up the coding style issues that I had seen with the code There are also issues with the actual code that I'd like to see addressed, preferrably by incremental patches to my ussd branch: * the use of static global variables like ussd_string_buf in gsm_04_80.c Code like this will prove very difficult to ever use concurrently at some later point. global variables in the main program (or similar) are fine, but in actual 'library' style code, we should not keep code in static global variables across multiple calls. In such a case, the state needs to be associated with some of the data structures we have in memory anyway. ussd_string_buff looks like something the caller should allocate and pass into gsm0480_rcv_ussd(). Also, since rcv_ussd() only decodes, it should probably be called gsm0480_decode_ussd(). Things like the static last_transaction_id also will cause race conditions once multiple people send USSD requests at the same time. This data needs to be per subscriber, or per lchan, I presume. * the assumption that extension numbers are not longer than 5 characters in ussd.c is really not good. Please check the specs what is the maximum length of the phone number in this context, add a #define and then make sure the string buffer is large enough for it. Also, I prefer snprintf() to having XXXX that then get overwritten by memcopy :) If you could send patches for those two issues (one patch for each logical change), I would appreciate that and in the end merge the ussd branch into master. Thanks. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 6 months

1
0
0 0

FOSDEM: Who's coming ?

by Sylvain Munaut

Hi everyone, As I mentionned in the earlier post, I think it'd be great if we could use FOSDEM to get known more. These projects covers a wide area, from quite low level RF stuff, signal processing to higher level GSM protocols ...so the work is certainly not missing :) So what I'd like to know is who's planning on coming (yes/no/maybe) to FOSDEM and if you'd be ready to help out or have equipment you could bring. Exactly _what_ we could do will most likely depend on the number of answer to this mail :) I've included OpenBTS, OpenBSC and airprobe here because they're the three projects I know that deal with the 'network' part of GSM (as opposed to the MS side for things like OpenMoko, Android, ...). And even if they currently don't share that much code, the GSM knowledge you gain by contributing to one of these can be directly applicable to help out in the others. Cheers ! Sylvain

14 years, 6 months

1
0
0 0

Mobile-originated USSD - corrected, now works 100%

by Mike Haben

(Hopefully) last patch attached - now sends the correct op-code in response, works with all 6 phones I have tried. Interesting that 5 out of 6 were happy with a completely different op-code and payload... Mike H.

14 years, 6 months

2
2
0 0

Re: [Openbts-discuss] [Fwd: [FOSDEM] News : Call For Participation]

by Sylvain Munaut

For info: Ok, I called the IBPT and I got the procedure to follow to request frequencies. The 900 MHz is entirely allocated to commercial operators but in the 1800 spectrum there are possibilities to get experimental licenses for a small fee so I'm filling up the paper work ASAP. For OpenBTS to work in the 1800 band we may need more stable clock source (which I don't have yet). For OpenBSC, I have a 1800 nanoBTS. Sylvain On Mon, Oct 12, 2009 at 8:38 PM, Sylvain Munaut <246tnt(a)gmail.com> wrote: > On Mon, Oct 12, 2009 at 7:20 PM, Michel Daggelinckx <03taxi(a)gmail.com> wrote: >> >> >> FOSDEM [1], the most developer-oriented Free and Opensource conference in >> Europe, is taking place in Brussels, Belgium [2] on *Saturday 6 and Sunday 7 >> February 2010*. Apart from having many invited speakers, the conference >> offers developer rooms, stands and lightning talks to projects from the Free >> and Opensource community. This results in a staggering number of 250+ >> lectures! >> >> We hereby welcome proposals from speakers and projects to talk in a main >> track, man a stand, or hold a lightning talk. /Information on developer >> rooms >> will become available later, as we are slightly reworking the concept/. > > In relation to that, I'm trying to get an experimental license from the IBPT to > operate on the GSM spectrum during the conference. I didn't find much in the > legislation about this kind of licence in Belgium, but I must call > back the guy tomorrow ... > > I didn't take any contact with the fosdem yet to have a spot or > anything, I wanted to > hear back from the ibpt first. > > If other people are motivated, there is definitely something to do there. > I have equipment to run both OpenBTS and OpenBSC and I'm located in Belgium, > so I'll definitely be there. > > > Sylvain >

14 years, 6 months

3
2
0 0

[PATCH] Corrected response to mobile-originated USSD ProcessUnstructuredSS Request - return same op code Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/src/gsm_04_80.c | 31 +++++++++++++++++++------------ openbsc/src/ussd.c | 4 ++-- 2 files changed, 21 insertions(+), 14 deletions(-) diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c index d922ae5..d0dcbc2 100755 --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -90,11 +90,11 @@ char* gsm0480_rcv_ussd(struct msgb *msg) static int parse_ussd(u_int8_t *ussd) { int rc = 1; - u_int8_t msg_type = ussd[0] & 0xBF; // message-type - section 3.4 + u_int8_t msg_type = ussd[0] & 0xBF; /* message-type - section 3.4 */ switch(msg_type) { case GSM0480_MTYPE_RELEASE_COMPLETE: - DEBUGP(DMM, "USS Release Complete\n"); // could also parse out the optional Cause/Facility data + DEBUGP(DMM, "USS Release Complete\n"); /* could also parse out the optional Cause/Facility data */ ussd_string_buff[0] = 0xFF; break; case GSM0480_MTYPE_REGISTER: @@ -115,7 +115,7 @@ static int parse_ussd_information_elements(u_int8_t *ussd_ie) { int rc; - u_int8_t iei = ussd_ie[0]; // Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 + u_int8_t iei = ussd_ie[0]; /* Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 */ u_int8_t iei_length = ussd_ie[1]; switch(iei) { case GSM48_IE_CAUSE: @@ -141,7 +141,7 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) u_int8_t offset = 0; do { - u_int8_t component_type = facility_ie[offset]; // Component Type tag - table 3.7 + u_int8_t component_type = facility_ie[offset]; /* Component Type tag - table 3.7 */ u_int8_t component_length = facility_ie[offset+1]; switch(component_type) { case GSM0480_CTYPE_INVOKE: @@ -178,7 +178,7 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) last_invoke_id = invoke_data[2]; if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) /* optional part */ - offset += invoke_data[offset+1] + 2; // skip over it + offset += invoke_data[offset+1] + 2; /* skip over it */ if (invoke_data[offset] == GSM0480_OPERATION_CODE) { /* mandatory part */ u_int8_t operation_code = invoke_data[offset+2]; @@ -208,13 +208,11 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) int num_chars; u_int8_t dcs; -// DEBUGP(DMM, "USSD request params %s\n", hexdump(uss_req_data, length)); /* FIXME: most phones send USSD text as a 7-bit encoded octet string; the following code also handles the case of plain ASCII text (IA5String), but other encodings might be used */ if (uss_req_data[0] == GSM_0480_SEQUENCE_TAG) { if (uss_req_data[2] == ASN1_OCTET_STRING_TAG) { dcs = uss_req_data[4]; -// DEBUGP(DMM, "Data coding scheme = 0x%2.2X\n", dcs); if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; gsm_7bit_decode(ussd_string_buff, &(uss_req_data[7]), num_chars); @@ -228,6 +226,7 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) return rc; } +/* Send response to a mobile-originated ProcessUnstructuredSS-Request */ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) { struct msgb *msg = gsm48_msgb_alloc(); @@ -235,20 +234,28 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) u_int8_t *ptr8; int response_len; - response_len = strlen(response_text); + response_len = (strlen(response_text) * 7) / 8; + if (((strlen(response_text) * 7) % 8) != 0) + response_len += 1; msg->bts_link = in_msg->bts_link; msg->lchan = in_msg->lchan; /* First put the payload text into the message */ ptr8 = msgb_put(msg, response_len); - memcpy(ptr8, response_text, response_len); + gsm_7bit_encode(ptr8, response_text); - /* Then wrap it as an IA5 String */ - msgb_wrap_with_TL(msg, ASN1_IA5_STRING_TAG); + /* Then wrap it as an Octet String */ + msgb_wrap_with_TL(msg, ASN1_OCTET_STRING_TAG); + + /* Pre-pend the DCS octet string */ + msgb_push_TLV1(msg, ASN1_OCTET_STRING_TAG, 0x0F); + + /* Then wrap these as a Sequence */ + msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG); /* Pre-pend the operation code */ - msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, GSM0480_OP_CODE_PROCESS_USS_DATA); + msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, GSM0480_OP_CODE_PROCESS_USS_REQ); /* Wrap the operation code and IA5 string as a sequence */ msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG); diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c index ba2f045..5f9a457 100755 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -45,7 +45,7 @@ int handle_rcv_ussd(struct msgb *msg) { char* ussd_text_rcvd = gsm0480_rcv_ussd(msg); - if(ussd_text_rcvd[0] == 0xFF) // Release-Complete + if(ussd_text_rcvd[0] == 0xFF) /* Release-Complete */ return 0; if(strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) { @@ -60,7 +60,7 @@ int handle_rcv_ussd(struct msgb *msg) /* A network-specific handler function */ static int send_own_number(struct msgb *msg) { - char response_string[] = "Your extension is xxxxx"; + char response_string[] = "Your extension is xxxxx\r"; /* Need trailing CR as EOT character */ char* own_number = msg->lchan->subscr->extension; memcpy(response_string + 18, own_number, 5); -- 1.6.0.4 --------------050801040303060009020404--

14 years, 6 months

1
0
0 0

[ANNOUNCE] Report on OpenBSC powered GSM network at HAR2009

by Harald Welte

Hi! I finally finished the report from the GSM test network that we operated at HAR2009 using OpenBSC and two BS-11. The report is available for download from http://openbsc.gnumonks.org/trac/attachment/wiki/HAR2009/har2009-gsm-report… Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 6 months

1
0
0 0

AW: Running an licensed experimental GSM network at 26c3

by Andreas.Eversberg

>I believe in the positive impact of OpenBTS and OpenBSC interoperability for >the both communities and as encouraging factor for possible future OpenBTS >test sites. > >We're ready to work with you beforehand to minimize on-site efforts. > >PS Where can we find agenda? Official 26C3 site is nearly empty. hi all, on the congress i use linux-call-router to route isdn traffic from versatel to berlin and vice versa for free as part of versatel sponsoring. i would like to join the POC (phone operation center) in the upper hall again this year. there we sit close to the "eventphone" guys, so we can easier communicate and do cabeling of our hardware. it would be nice to have also the openbsc and openbts projects close to us. we could easier interact and build one test networks. since eventphone uses an own linux-call-router hardware, i can use my test machine without disturbing the external isdn connection to versatel. it is equipped with two E1 cards, one for interconnection with eventphone, the second one can be used for BS11. eventphone has a big DECT pbx running and provides mobile access. what do you think? andreas

14 years, 6 months

4
5
0 0

Patches - add support for mobile-originated USSD

by Mike Haben

Hello again, More patches - these two (combined) add support for mobile-originated USSD. The demonstration application, implemented in ussd.c, is that sending *#100# to the network will display your 5-digit extension. It's not 100% finished - I've tested it on 6 handsets, 5 of them work perfectly, but the 6th (Samsung i520) doesn't seem to receive the response, so more experimenting to be done... Best regards to all, Mike H.

14 years, 6 months

3
5
0 0

[PATCH] Changes to USSD support modules following initial review Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 129 +++++++++++++++++-- openbsc/include/openbsc/ussd.h | 2 + openbsc/src/gsm_04_80.c | 246 ++++++++++------------------------ openbsc/src/ussd.c | 16 ++- 4 files changed, 201 insertions(+), 192 deletions(-) diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h index 43b5b74..11962d8 100755 --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -1,24 +1,129 @@ #ifndef _GSM_04_80_H #define _GSM_04_80_H -#include <openbsc/msgb.h> +/* GSM TS 04.80 definitions (Supplementary Services Specification, Formats and Coding) */ + +/* Section 3.4 */ +#define GSM0480_MTYPE_RELEASE_COMPLETE 0x2A +#define GSM0480_MTYPE_FACILITY 0x3A +#define GSM0480_MTYPE_REGISTER 0x3B + +/* Section 3.5 */ +#define GSM0480_IE_FACILITY 0x1C +#define GSM0480_IE_SS_VERSION 0x7F + +/* Section 3.6.2 */ +#define GSM0480_CTYPE_INVOKE 0xA1 +#define GSM0480_CTYPE_RETURN_RESULT 0xA2 +#define GSM0480_CTYPE_RETURN_ERROR 0xA3 +#define GSM0480_CTYPE_REJECT 0xA4 + +/* Section 3.6.3 */ +#define GSM0480_COMPIDTAG_INVOKE_ID 0x02 +#define GSM0480_COMPIDTAG_LINKED_ID 0x80 + +/* Section 3.6.4 */ +#define GSM0480_OPERATION_CODE 0x02 -/* GSM TS 04.80 definitions (Supplementary Services specification, Formats and coding */ /* Section 3.6.5 */ #define GSM_0480_SEQUENCE_TAG 0x30 #define GSM_0480_SET_TAG 0x31 +/* Section 3.6.6 */ +#define GSM_0480_ERROR_CODE_TAG 0x02 + +/* Section 3.6.7 */ +/* Table 3.13 */ +#define GSM_0480_PROBLEM_CODE_TAG_GENERAL 0x80 +#define GSM_0480_PROBLEM_CODE_TAG_INVOKE 0x81 +#define GSM_0480_PROBLEM_CODE_TAG_RETURN_RESULT 0x82 +#define GSM_0480_PROBLEM_CODE_TAG_RETURN_ERROR 0x83 + +/* Table 3.14 */ +#define GSM_0480_GEN_PROB_CODE_UNRECOGNISED 0x00 +#define GSM_0480_GEN_PROB_CODE_MISTYPED 0x01 +#define GSM_0480_GEN_PROB_CODE_BAD_STRUCTURE 0x02 + +/* Table 3.15 */ +#define GSM_0480_INVOKE_PROB_CODE_DUPLICATE_INVOKE_ID 0x00 +#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_OPERATION 0x01 +#define GSM_0480_INVOKE_PROB_CODE_MISTYPED_PARAMETER 0x02 +#define GSM_0480_INVOKE_PROB_CODE_RESOURCE_LIMITATION 0x03 +#define GSM_0480_INVOKE_PROB_CODE_INITIATING_RELEASE 0x04 +#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_LINKED_ID 0x05 +#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_RESPONSE 0x06 +#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_OPERATION 0x07 + +/* Table 3.16 */ +#define GSM_0480_RESULT_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 +#define GSM_0480_RESULT_PROB_CODE_RETURN_RESULT_UNEXPECTED 0x01 +#define GSM_0480_RESULT_PROB_CODE_MISTYPED_PARAMETER 0x02 + +/* Table 3.17 */ +#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 +#define GSM_0480_ERROR_PROB_CODE_RETURN_ERROR_UNEXPECTED 0x01 +#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_ERROR 0x02 +#define GSM_0480_ERROR_PROB_CODE_UNEXPECTED_ERROR 0x03 +#define GSM_0480_ERROR_PROB_CODE_MISTYPED_PARAMETER 0x04 + +/* Section 4.5 */ +#define GSM0480_OP_CODE_REGISTER_SS 0x0A +#define GSM0480_OP_CODE_ERASE_SS 0x0B +#define GSM0480_OP_CODE_ACTIVATE_SS 0x0C +#define GSM0480_OP_CODE_DEACTIVATE_SS 0x0D +#define GSM0480_OP_CODE_INTERROGATE_SS 0x0E +#define GSM0480_OP_CODE_NOTIFY_SS 0x10 +#define GSM0480_OP_CODE_REGISTER_PASSWORD 0x11 +#define GSM0480_OP_CODE_GET_PASSWORD 0x12 +#define GSM0480_OP_CODE_PROCESS_USS_DATA 0x13 +#define GSM0480_OP_CODE_FORWARD_CHECK_SS_IND 0x26 +#define GSM0480_OP_CODE_PROCESS_USS_REQ 0x3B +#define GSM0480_OP_CODE_USS_REQUEST 0x3C +#define GSM0480_OP_CODE_USS_NOTIFY 0x3D +#define GSM0480_OP_CODE_FORWARD_CUG_INFO 0x78 +#define GSM0480_OP_CODE_SPLIT_MPTY 0x79 +#define GSM0480_OP_CODE_RETRIEVE_MPTY 0x7A +#define GSM0480_OP_CODE_HOLD_MPTY 0x7B +#define GSM0480_OP_CODE_BUILD_MPTY 0x7C +#define GSM0480_OP_CODE_FORWARD_CHARGE_ADVICE 0x7D + +#define GSM0480_ERR_CODE_UNKNOWN_SUBSCRIBER 0x01 +#define GSM0480_ERR_CODE_ILLEGAL_SUBSCRIBER 0x09 +#define GSM0480_ERR_CODE_BEARER_SERVICE_NOT_PROVISIONED 0x0A +#define GSM0480_ERR_CODE_TELESERVICE_NOT_PROVISIONED 0x0B +#define GSM0480_ERR_CODE_ILLEGAL_EQUIPMENT 0x0C +#define GSM0480_ERR_CODE_CALL_BARRED 0x0D +#define GSM0480_ERR_CODE_ILLEGAL_SS_OPERATION 0x10 +#define GSM0480_ERR_CODE_SS_ERROR_STATUS 0x11 +#define GSM0480_ERR_CODE_SS_NOT_AVAILABLE 0x12 +#define GSM0480_ERR_CODE_SS_SUBSCRIPTION_VIOLATION 0x13 +#define GSM0480_ERR_CODE_SS_INCOMPATIBILITY 0x14 +#define GSM0480_ERR_CODE_FACILITY_NOT_SUPPORTED 0x15 +#define GSM0480_ERR_CODE_ABSENT_SUBSCRIBER 0x1B +#define GSM0480_ERR_CODE_SYSTEM_FAILURE 0x22 +#define GSM0480_ERR_CODE_DATA_MISSING 0x23 +#define GSM0480_ERR_CODE_UNEXPECTED_DATA_VALUE 0x24 +#define GSM0480_ERR_CODE_PW_REGISTRATION_FAILURE 0x25 +#define GSM0480_ERR_CODE_NEGATIVE_PW_CHECK 0x26 +#define GSM0480_ERR_CODE_NUM_PW_ATTEMPTS_VIOLATION 0x2B +#define GSM0480_ERR_CODE_UNKNOWN_ALPHABET 0x47 +#define GSM0480_ERR_CODE_USSD_BUSY 0x48 +#define GSM0480_ERR_CODE_MAX_MPTY_PARTICIPANTS 0x7E +#define GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE 0x7F + /* ASN.1 type-tags */ -#define ASN1_BOOLEAN_TAG 0x01 -#define ASN1_INTEGER_TAG 0x02 -#define ASN1_BIT_STRING_TAG 0x03 -#define ASN1_OCTET_STRING_TAG 0x04 -#define ASN1_NULL_TYPE_TAG 0x05 -#define ASN1_OBJECT_ID_TAG 0x06 -#define ASN1_UTF8_STRING_TAG 0x0C -#define ASN1_PRINTABLE_STRING_TAG 0x13 -#define ASN1_IA5_STRING_TAG 0x16 -#define ASN1_UNICODE_STRING_TAG 0x1E +#define ASN1_BOOLEAN_TAG 0x01 +#define ASN1_INTEGER_TAG 0x02 +#define ASN1_BIT_STRING_TAG 0x03 +#define ASN1_OCTET_STRING_TAG 0x04 +#define ASN1_NULL_TYPE_TAG 0x05 +#define ASN1_OBJECT_ID_TAG 0x06 +#define ASN1_UTF8_STRING_TAG 0x0C +#define ASN1_PRINTABLE_STRING_TAG 0x13 +#define ASN1_IA5_STRING_TAG 0x16 +#define ASN1_UNICODE_STRING_TAG 0x1E + +#include <openbsc/msgb.h> char* gsm0480_rcv_ussd(struct msgb *msg); int gsm0480_send_ussd_response(struct msgb *msg, const char* response_text); diff --git a/openbsc/include/openbsc/ussd.h b/openbsc/include/openbsc/ussd.h index dfd34f3..e7bd6d6 100755 --- a/openbsc/include/openbsc/ussd.h +++ b/openbsc/include/openbsc/ussd.h @@ -1,6 +1,8 @@ #ifndef _USSD_H #define _USSD_H +/* Handler function for mobile-originated USSD messages */ + #include <openbsc/msgb.h> int handle_rcv_ussd(struct msgb *msg); diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c index a6dffa8..d922ae5 100755 --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -3,6 +3,7 @@ /* (C) 2008-2009 by Harald Welte <laforge(a)gnumonks.org> * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke(a)selfish.org> + * (C) 2009 by Mike Haben <michael.haben(a)btinternet.com> * * All Rights Reserved * @@ -36,112 +37,6 @@ #include <openbsc/gsm_04_08.h> #include <openbsc/gsm_04_80.h> -/* GSM TS 04.80 definitions (Supplementary Services specification, Formats and coding */ - -/* Section 3.4 */ -#define GSM0480_MTYPE_RELEASE_COMPLETE 0x2A -#define GSM0480_MTYPE_FACILITY 0x3A -#define GSM0480_MTYPE_REGISTER 0x3B - -/* Section 3.5 */ -#define GSM0480_IE_FACILITY 0x1C -#define GSM0480_IE_SS_VERSION 0x7F - -/* Section 3.6.2 */ -#define GSM0480_CTYPE_INVOKE 0xA1 -#define GSM0480_CTYPE_RETURN_RESULT 0xA2 -#define GSM0480_CTYPE_RETURN_ERROR 0xA3 -#define GSM0480_CTYPE_REJECT 0xA4 - -/* Section 3.6.3 */ -#define GSM0480_COMPIDTAG_INVOKE_ID 0x02 -#define GSM0480_COMPIDTAG_LINKED_ID 0x80 - -/* Section 3.6.4 */ -#define GSM0480_OPERATION_CODE 0x02 - -/* Section 3.6.6 */ -#define GSM_0480_ERROR_CODE_TAG 0x02 - -/* Section 3.6.7 */ -/* Table 3.13 */ -#define GSM_0480_PROBLEM_CODE_TAG_GENERAL 0x80 -#define GSM_0480_PROBLEM_CODE_TAG_INVOKE 0x81 -#define GSM_0480_PROBLEM_CODE_TAG_RETURN_RESULT 0x82 -#define GSM_0480_PROBLEM_CODE_TAG_RETURN_ERROR 0x83 - -/* Table 3.14 */ -#define GSM_0480_GEN_PROB_CODE_UNRECOGNISED 0x00 -#define GSM_0480_GEN_PROB_CODE_MISTYPED 0x01 -#define GSM_0480_GEN_PROB_CODE_BAD_STRUCTURE 0x02 - -/* Table 3.15 */ -#define GSM_0480_INVOKE_PROB_CODE_DUPLICATE_INVOKE_ID 0x00 -#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_OPERATION 0x01 -#define GSM_0480_INVOKE_PROB_CODE_MISTYPED_PARAMETER 0x02 -#define GSM_0480_INVOKE_PROB_CODE_RESOURCE_LIMITATION 0x03 -#define GSM_0480_INVOKE_PROB_CODE_INITIATING_RELEASE 0x04 -#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_LINKED_ID 0x05 -#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_RESPONSE 0x06 -#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_OPERATION 0x07 - -/* Table 3.16 */ -#define GSM_0480_RESULT_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 -#define GSM_0480_RESULT_PROB_CODE_RETURN_RESULT_UNEXPECTED 0x01 -#define GSM_0480_RESULT_PROB_CODE_MISTYPED_PARAMETER 0x02 - -/* Table 3.17 */ -#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 -#define GSM_0480_ERROR_PROB_CODE_RETURN_ERROR_UNEXPECTED 0x01 -#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_ERROR 0x02 -#define GSM_0480_ERROR_PROB_CODE_UNEXPECTED_ERROR 0x03 -#define GSM_0480_ERROR_PROB_CODE_MISTYPED_PARAMETER 0x04 - -/* Section 4.5 */ -#define GSM0480_OP_CODE_REGISTER_SS 0x0A -#define GSM0480_OP_CODE_ERASE_SS 0x0B -#define GSM0480_OP_CODE_ACTIVATE_SS 0x0C -#define GSM0480_OP_CODE_DEACTIVATE_SS 0x0D -#define GSM0480_OP_CODE_INTERROGATE_SS 0x0E -#define GSM0480_OP_CODE_NOTIFY_SS 0x10 -#define GSM0480_OP_CODE_REGISTER_PASSWORD 0x11 -#define GSM0480_OP_CODE_GET_PASSWORD 0x12 -#define GSM0480_OP_CODE_PROCESS_USS_DATA 0x13 -#define GSM0480_OP_CODE_FORWARD_CHECK_SS_IND 0x26 -#define GSM0480_OP_CODE_PROCESS_USS_REQ 0x3B -#define GSM0480_OP_CODE_USS_REQUEST 0x3C -#define GSM0480_OP_CODE_USS_NOTIFY 0x3D -#define GSM0480_OP_CODE_FORWARD_CUG_INFO 0x78 -#define GSM0480_OP_CODE_SPLIT_MPTY 0x79 -#define GSM0480_OP_CODE_RETRIEVE_MPTY 0x7A -#define GSM0480_OP_CODE_HOLD_MPTY 0x7B -#define GSM0480_OP_CODE_BUILD_MPTY 0x7C -#define GSM0480_OP_CODE_FORWARD_CHARGE_ADVICE 0x7D - -#define GSM0480_ERR_CODE_UNKNOWN_SUBSCRIBER 0x01 -#define GSM0480_ERR_CODE_ILLEGAL_SUBSCRIBER 0x09 -#define GSM0480_ERR_CODE_BEARER_SERVICE_NOT_PROVISIONED 0x0A -#define GSM0480_ERR_CODE_TELESERVICE_NOT_PROVISIONED 0x0B -#define GSM0480_ERR_CODE_ILLEGAL_EQUIPMENT 0x0C -#define GSM0480_ERR_CODE_CALL_BARRED 0x0D -#define GSM0480_ERR_CODE_ILLEGAL_SS_OPERATION 0x10 -#define GSM0480_ERR_CODE_SS_ERROR_STATUS 0x11 -#define GSM0480_ERR_CODE_SS_NOT_AVAILABLE 0x12 -#define GSM0480_ERR_CODE_SS_SUBSCRIPTION_VIOLATION 0x13 -#define GSM0480_ERR_CODE_SS_INCOMPATIBILITY 0x14 -#define GSM0480_ERR_CODE_FACILITY_NOT_SUPPORTED 0x15 -#define GSM0480_ERR_CODE_ABSENT_SUBSCRIBER 0x1B -#define GSM0480_ERR_CODE_SYSTEM_FAILURE 0x22 -#define GSM0480_ERR_CODE_DATA_MISSING 0x23 -#define GSM0480_ERR_CODE_UNEXPECTED_DATA_VALUE 0x24 -#define GSM0480_ERR_CODE_PW_REGISTRATION_FAILURE 0x25 -#define GSM0480_ERR_CODE_NEGATIVE_PW_CHECK 0x26 -#define GSM0480_ERR_CODE_NUM_PW_ATTEMPTS_VIOLATION 0x2B -#define GSM0480_ERR_CODE_UNKNOWN_ALPHABET 0x47 -#define GSM0480_ERR_CODE_USSD_BUSY 0x48 -#define GSM0480_ERR_CODE_MAX_MPTY_PARTICIPANTS 0x7E -#define GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE 0x7F - static char ussd_string_buff[32]; static u_int8_t last_transaction_id; static u_int8_t last_invoke_id; @@ -153,23 +48,40 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length); static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length); static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length); +static inline unsigned char *msgb_wrap_with_TL(struct msgb *msgb, u_int8_t tag) +{ + msgb->data -= 2; + msgb->data[0] = tag; + msgb->data[1] = msgb->len; + msgb->len += 2; + return msgb->data; +} + +static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, u_int8_t tag, u_int8_t value) +{ + msgb->data -= 3; + msgb->len += 3; + msgb->data[0] = tag; + msgb->data[1] = 1; + msgb->data[2] = value; + return msgb->data; +} + + /* Receive a mobile-originated USSD message and return the decoded text */ char* gsm0480_rcv_ussd(struct msgb *msg) { int rc = 0; u_int8_t* parse_ptr = msgb_l3(msg); -// DEBUGP(DMM, "USSD %s\n", hexdump(msg->data, msg->len)); // temporary, just see what we're receiving... - memset(ussd_string_buff, 0, sizeof(ussd_string_buff)); - if((*parse_ptr & 0x0F) == GSM48_PDISC_NC_SS) - { - last_transaction_id = *parse_ptr & 0xF0; + if ((*parse_ptr & 0x0F) == GSM48_PDISC_NC_SS) { + last_transaction_id = *parse_ptr & 0x70; rc = parse_ussd(parse_ptr + 1); } - if(!rc) + if (!rc) DEBUGP(DMM, "Error occurred while parsing received USSD!\n"); return ussd_string_buff; @@ -228,8 +140,7 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) int rc = 1; u_int8_t offset = 0; - do - { + do { u_int8_t component_type = facility_ie[offset]; // Component Type tag - table 3.7 u_int8_t component_length = facility_ie[offset+1]; switch(component_type) { @@ -248,10 +159,8 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) rc = 0; break; } - offset += (component_length+2); - } - while(offset < length); + } while(offset < length); return rc; } @@ -261,19 +170,17 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) { int rc = 1; - if(invoke_data[0] != GSM0480_COMPIDTAG_INVOKE_ID) // mandatory part - { + if (invoke_data[0] != GSM0480_COMPIDTAG_INVOKE_ID) { /* mandatory part */ fprintf(stderr, "Unexpected GSM 04.80 Component-ID tag 0x%02x (expecting Invoke ID tag)\n", invoke_data[0]); } u_int8_t offset = invoke_data[1] + 2; last_invoke_id = invoke_data[2]; - if(invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) // optional part + if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) /* optional part */ offset += invoke_data[offset+1] + 2; // skip over it - if(invoke_data[offset] == GSM0480_OPERATION_CODE) // mandatory part - { + if (invoke_data[offset] == GSM0480_OPERATION_CODE) { /* mandatory part */ u_int8_t operation_code = invoke_data[offset+2]; switch(operation_code) { case GSM0480_OP_CODE_PROCESS_USS_REQ: @@ -285,11 +192,9 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) rc = 0; break; } - } - else - { + } else { fprintf(stderr, "Unexpected GSM 04.80 Component-ID tag 0x%02x (expecting Operation Code tag)\n", - invoke_data[0]); + invoke_data[0]); rc = 0; } @@ -306,21 +211,16 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) // DEBUGP(DMM, "USSD request params %s\n", hexdump(uss_req_data, length)); /* FIXME: most phones send USSD text as a 7-bit encoded octet string; the following code also handles the case of plain ASCII text (IA5String), but other encodings might be used */ - if(uss_req_data[0] == GSM_0480_SEQUENCE_TAG) - { - if(uss_req_data[2] == ASN1_OCTET_STRING_TAG) - { + if (uss_req_data[0] == GSM_0480_SEQUENCE_TAG) { + if (uss_req_data[2] == ASN1_OCTET_STRING_TAG) { dcs = uss_req_data[4]; // DEBUGP(DMM, "Data coding scheme = 0x%2.2X\n", dcs); - if((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) - { + if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; gsm_7bit_decode(ussd_string_buff, &(uss_req_data[7]), num_chars); } } - } - else if(uss_req_data[0] == ASN1_IA5_STRING_TAG) - { + } else if (uss_req_data[0] == ASN1_IA5_STRING_TAG) { num_chars = uss_req_data[1]; memcpy(ussd_string_buff, &(uss_req_data[2]), num_chars); } @@ -340,30 +240,32 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) msg->bts_link = in_msg->bts_link; msg->lchan = in_msg->lchan; - gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); - gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | 0x80; // TI direction = 1 - gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; - - ptr8 = msgb_put(msg, 14); - ptr8[0] = GSM0480_IE_FACILITY; - ptr8[1] = response_len + 12; - ptr8[2] = GSM0480_CTYPE_RETURN_RESULT; - ptr8[3] = response_len + 10; - ptr8[4] = GSM0480_COMPIDTAG_INVOKE_ID; - ptr8[5] = 1; - ptr8[6] = last_invoke_id; - ptr8[7] = GSM_0480_SEQUENCE_TAG; - ptr8[8] = response_len + 5; - ptr8[9] = GSM0480_OPERATION_CODE; - ptr8[10] = 1; - ptr8[11] = GSM0480_OP_CODE_PROCESS_USS_DATA; - ptr8[12] = ASN1_IA5_STRING_TAG; - ptr8[13] = response_len; - + /* First put the payload text into the message */ ptr8 = msgb_put(msg, response_len); memcpy(ptr8, response_text, response_len); -// DEBUGP(DMM, "USSD response %s\n", hexdump(msg->data, msg->len)); // temporary, just to see what we're sending back + /* Then wrap it as an IA5 String */ + msgb_wrap_with_TL(msg, ASN1_IA5_STRING_TAG); + + /* Pre-pend the operation code */ + msgb_push_TLV1(msg, GSM0480_OPERATION_CODE, GSM0480_OP_CODE_PROCESS_USS_DATA); + + /* Wrap the operation code and IA5 string as a sequence */ + msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG); + + /* Pre-pend the invoke ID */ + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); + + /* Wrap this up as a Return Result component */ + msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_RESULT); + + /* Wrap the component in a Facility message */ + msgb_wrap_with_TL(msg, GSM0480_IE_FACILITY); + + /* And finally pre-pend the L3 header */ + gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); + gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); } @@ -372,28 +274,26 @@ int gsm0480_send_ussd_reject(struct msgb *in_msg) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; - u_int8_t *ptr8; msg->bts_link = in_msg->bts_link; msg->lchan = in_msg->lchan; - gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); - gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | 0x80; // TI direction = 1 - gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; + /* First insert the problem code */ + msgb_push_TLV1(msg, GSM_0480_PROBLEM_CODE_TAG_GENERAL, GSM_0480_GEN_PROB_CODE_UNRECOGNISED); + + /* Before it insert the invoke ID */ + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); - ptr8 = msgb_put(msg, 10); - ptr8[0] = GSM0480_IE_FACILITY; - ptr8[1] = 8; - ptr8[2] = GSM0480_CTYPE_REJECT; - ptr8[3] = 6; - ptr8[4] = GSM0480_COMPIDTAG_INVOKE_ID; - ptr8[5] = 1; - ptr8[6] = last_invoke_id; - ptr8[7] = GSM_0480_PROBLEM_CODE_TAG_GENERAL; - ptr8[8] = 1; - ptr8[9] = GSM_0480_GEN_PROB_CODE_UNRECOGNISED; - -// DEBUGP(DMM, "USSD reject %s\n", hexdump(msg->data, msg->len)); // temporary, just to see what we're sending back + /* Wrap this up as a Reject component */ + msgb_wrap_with_TL(msg, GSM0480_CTYPE_REJECT); + + /* Wrap the component in a Facility message */ + msgb_wrap_with_TL(msg, GSM0480_IE_FACILITY); + + /* And finally pre-pend the L3 header */ + gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); + gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); } diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c index 761a0e7..ba2f045 100755 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -2,6 +2,7 @@ /* (C) 2008-2009 by Harald Welte <laforge(a)gnumonks.org> * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke(a)selfish.org> + * (C) 2009 by Mike Haben <michael.haben(a)btinternet.com> * * All Rights Reserved * @@ -21,6 +22,7 @@ * */ +/* This module defines the network-specific handling of mobile-originated USSD messages. */ #include <stdio.h> #include <stdlib.h> @@ -31,10 +33,14 @@ #include <openbsc/gsm_subscriber.h> #include <openbsc/debug.h> +/* Declarations of USSD strings to be recognised */ const char USSD_TEXT_OWN_NUMBER[] = "*#100#"; +/* Forward declarations of network-specific handler functions */ static int send_own_number(struct msgb *msg); + +/* Entrypoint - handler function common to all mobile-originated USSDs */ int handle_rcv_ussd(struct msgb *msg) { char* ussd_text_rcvd = gsm0480_rcv_ussd(msg); @@ -42,20 +48,16 @@ int handle_rcv_ussd(struct msgb *msg) if(ussd_text_rcvd[0] == 0xFF) // Release-Complete return 0; - DEBUGP(DMM, "Received USSD text %s\n", ussd_text_rcvd); // show text payload entered on MS - - if(strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) - { + if(strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) { DEBUGP(DMM, "USSD: Own number requested\n"); return send_own_number(msg); - } - else - { + } else { DEBUGP(DMM, "Unhandled USSD %s\n", ussd_text_rcvd); return gsm0480_send_ussd_reject(msg); } } +/* A network-specific handler function */ static int send_own_number(struct msgb *msg) { char response_string[] = "Your extension is xxxxx"; -- 1.6.0.4 --------------090900090905050500050904--

14 years, 6 months

1
0
0 0

BS11 does not work, but everything looks normal.

by dexter

Hi folks. I can't get my setup working. Everything works, the BS11 boots up well, openBSC loads well. At the software side, everything looks perfect. But the setup does not work. I have testet my BSC now with 3 different BS11. One of the BS11 is brandnew (Has been set in standalone directly after installing the firmware.)! I found this and i think that this is an explaination of the problem: http://lists.gnumonks.org/pipermail/openbsc/2009-August/000783.html Finally my question is if anone of you ever observed a semilar effect. regards. Philipp

14 years, 6 months

7
10
0 0

official ip.access wireshark Abis/IP dissector

by Harald Welte

Hi! Quite some time ago (must be 2-3 months ago), I have officially inquired at ip.access about the source code of their wireshark modifications, as per the GNU GPL. It took them some time, but they eventually responded recently. Today I finally received a CD-ROM with the source code. I've uploaded it to the OpenBSC wiki, and it is now available from http://openbsc.gnumonks.org/trac/attachment/wiki/nanoBTS/wireshark-1.0.6ipa… Had I known earlier that ip.access has actually written a GPL licensed dissector, many hours (rather days/weeks) of reverse engineering time would have been saved. I have not yet had time to review it thoroughly, though I plan to merge/port the interesting bits of it with my dissectors for A-bis OML and ip.access RSL extensions and eventually submit it to wireshark mainline. If you use this source code, please don't just simply take it and push it to upstream wireshark, as that would conflict with the patches that we have in openbsc git at the moment. Have fun with it, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 6 months

1
0
0 0

nanoBTS Multi-TRX configuration?

by Harald Welte

Hi! Does anyone on this list have experience with nanoBTS Multi-TRX configurations? I've built a TIB cable (10pin RJ69 to 10pin, 1:1 wiring, i.e. pin1 is pin1 on the other plug, pin2 is pin 2, etc.) and connected the two BTS. When I power them up simultaneously, they still come up as two individual BTS with each their own unit ID. I've tried to set the unit ID to something like 1801/0/0 on the first one, and 1801/1/0 on the second. However, any non-zero TRX ID of the unit ID is rejected by the BTS. Any hint how I can make them behave like one BTS with two TRX is appreciated. I'm expecting only one OML Link but of course two RSL links (one for each TRX). Thanks in advance, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

14 years, 6 months

1
0
0 0

(no subject)

by Andreas.Eversberg

hi, i am no shure if i already sent this mail, but i can't find it anywhere. this fixes the delay of audio caused by stalling of the openbsc process. the use of 'usleep(100000)' for slowing down transmission to nanoBTS is replaced by the tx-delay timer. i did this on bs11 code, so i did it the same way. it actually queues frames for transmission not nanoBTS. on transmission a timer is started and when this timer expires, the next frame in the queue is transmitted (timer restarted) until the queue is empty. regards andreas

14 years, 6 months

2
1
0 0

Running an licensed experimental GSM network at 26c3

by Bjoern Heller

Hello everyone, I just want to ask, if there is a general interest in operating a licensed GSM-Network at the chaos congress. Is there anything planned for 26c3 (openBSC desk etc.)? Maybe there is a good chance to get a temp. license for the 900 GSM band from BNetzA. I had little time in the past year to work on openBSC, but in the coming months there will be more time for fun ;) Best regards Bjoern - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

14 years, 6 months

5
12
0 0

nanoBTS 140 is working now

by Philipp Hug

Hi everyone, Thanks to some hints from Sylvain my nanoBTS 140 is working now. We found the following problems: * Software Activation request is not complete ( it needs to contain tag + FILE_ID and FILE_VERSION). See patch sent by Sylvain. * It's relevant which Software is activated, but our logic to always use the first SW Description record works most of the time because the nanoBTS will move the software that was activated the last time to the first position. So maybe we need hard-code which software to prefer for activation or we put some warnings in the wiki. What's left is that after some time the BTRS reports an error and goes to Disabled state, but I have to investigate that more. Philipp

14 years, 6 months

3
8
0 0

[PATCH] Support for mobile-originated USSD - working demonstration (*#100# to get own number) Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 19 +++- openbsc/src/gsm_04_80.c | 252 +++++++++++++++++++++-------------- openbsc/src/ussd.c | 15 ++- 3 files changed, 180 insertions(+), 106 deletions(-) mode change 100644 => 100755 openbsc/include/openbsc/ussd.h mode change 100644 => 100755 openbsc/src/gsm_04_08.c mode change 100644 => 100755 openbsc/src/ussd.c diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h index d16a876..43b5b74 100755 --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -3,8 +3,25 @@ #include <openbsc/msgb.h> +/* GSM TS 04.80 definitions (Supplementary Services specification, Formats and coding */ +/* Section 3.6.5 */ +#define GSM_0480_SEQUENCE_TAG 0x30 +#define GSM_0480_SET_TAG 0x31 + +/* ASN.1 type-tags */ +#define ASN1_BOOLEAN_TAG 0x01 +#define ASN1_INTEGER_TAG 0x02 +#define ASN1_BIT_STRING_TAG 0x03 +#define ASN1_OCTET_STRING_TAG 0x04 +#define ASN1_NULL_TYPE_TAG 0x05 +#define ASN1_OBJECT_ID_TAG 0x06 +#define ASN1_UTF8_STRING_TAG 0x0C +#define ASN1_PRINTABLE_STRING_TAG 0x13 +#define ASN1_IA5_STRING_TAG 0x16 +#define ASN1_UNICODE_STRING_TAG 0x1E + char* gsm0480_rcv_ussd(struct msgb *msg); int gsm0480_send_ussd_response(struct msgb *msg, const char* response_text); -int gsm0480_send_ussd_error(struct msgb *msg); +int gsm0480_send_ussd_reject(struct msgb *msg); #endif diff --git a/openbsc/include/openbsc/ussd.h b/openbsc/include/openbsc/ussd.h old mode 100644 new mode 100755 diff --git a/openbsc/src/gsm_04_08.c b/openbsc/src/gsm_04_08.c old mode 100644 new mode 100755 diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c index c2c2a86..a6dffa8 100755 --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -39,26 +39,63 @@ /* GSM TS 04.80 definitions (Supplementary Services specification, Formats and coding */ /* Section 3.4 */ -#define GSM0480_MTYPE_RELEASE_COMPLETE 0x2A -#define GSM0480_MTYPE_FACILITY 0x3A -#define GSM0480_MTYPE_REGISTER 0x3B +#define GSM0480_MTYPE_RELEASE_COMPLETE 0x2A +#define GSM0480_MTYPE_FACILITY 0x3A +#define GSM0480_MTYPE_REGISTER 0x3B /* Section 3.5 */ -#define GSM0480_IE_FACILITY 0x1C -#define GSM0480_IE_SS_VERSION 0x7F +#define GSM0480_IE_FACILITY 0x1C +#define GSM0480_IE_SS_VERSION 0x7F /* Section 3.6.2 */ -#define GSM0480_CTYPE_INVOKE 0xA1 -#define GSM0480_CTYPE_RETURN_RESULT 0xA2 -#define GSM0480_CTYPE_RETURN_ERROR 0xA3 -#define GSM0480_CTYPE_REJECT 0xA4 +#define GSM0480_CTYPE_INVOKE 0xA1 +#define GSM0480_CTYPE_RETURN_RESULT 0xA2 +#define GSM0480_CTYPE_RETURN_ERROR 0xA3 +#define GSM0480_CTYPE_REJECT 0xA4 /* Section 3.6.3 */ -#define GSM0480_COMPIDTAG_INVOKE_ID 0x02 -#define GSM0480_COMPIDTAG_LINKED_ID 0x80 +#define GSM0480_COMPIDTAG_INVOKE_ID 0x02 +#define GSM0480_COMPIDTAG_LINKED_ID 0x80 /* Section 3.6.4 */ -#define GSM0480_OPERATION_CODE 0x02 +#define GSM0480_OPERATION_CODE 0x02 + +/* Section 3.6.6 */ +#define GSM_0480_ERROR_CODE_TAG 0x02 + +/* Section 3.6.7 */ +/* Table 3.13 */ +#define GSM_0480_PROBLEM_CODE_TAG_GENERAL 0x80 +#define GSM_0480_PROBLEM_CODE_TAG_INVOKE 0x81 +#define GSM_0480_PROBLEM_CODE_TAG_RETURN_RESULT 0x82 +#define GSM_0480_PROBLEM_CODE_TAG_RETURN_ERROR 0x83 + +/* Table 3.14 */ +#define GSM_0480_GEN_PROB_CODE_UNRECOGNISED 0x00 +#define GSM_0480_GEN_PROB_CODE_MISTYPED 0x01 +#define GSM_0480_GEN_PROB_CODE_BAD_STRUCTURE 0x02 + +/* Table 3.15 */ +#define GSM_0480_INVOKE_PROB_CODE_DUPLICATE_INVOKE_ID 0x00 +#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_OPERATION 0x01 +#define GSM_0480_INVOKE_PROB_CODE_MISTYPED_PARAMETER 0x02 +#define GSM_0480_INVOKE_PROB_CODE_RESOURCE_LIMITATION 0x03 +#define GSM_0480_INVOKE_PROB_CODE_INITIATING_RELEASE 0x04 +#define GSM_0480_INVOKE_PROB_CODE_UNRECOGNISED_LINKED_ID 0x05 +#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_RESPONSE 0x06 +#define GSM_0480_INVOKE_PROB_CODE_UNEXPECTED_LINKED_OPERATION 0x07 + +/* Table 3.16 */ +#define GSM_0480_RESULT_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 +#define GSM_0480_RESULT_PROB_CODE_RETURN_RESULT_UNEXPECTED 0x01 +#define GSM_0480_RESULT_PROB_CODE_MISTYPED_PARAMETER 0x02 + +/* Table 3.17 */ +#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_INVOKE_ID 0x00 +#define GSM_0480_ERROR_PROB_CODE_RETURN_ERROR_UNEXPECTED 0x01 +#define GSM_0480_ERROR_PROB_CODE_UNRECOGNISED_ERROR 0x02 +#define GSM_0480_ERROR_PROB_CODE_UNEXPECTED_ERROR 0x03 +#define GSM_0480_ERROR_PROB_CODE_MISTYPED_PARAMETER 0x04 /* Section 4.5 */ #define GSM0480_OP_CODE_REGISTER_SS 0x0A @@ -105,11 +142,13 @@ #define GSM0480_ERR_CODE_MAX_MPTY_PARTICIPANTS 0x7E #define GSM0480_ERR_CODE_RESOURCES_NOT_AVAILABLE 0x7F -static char ussd_string_buff[256]; +static char ussd_string_buff[32]; +static u_int8_t last_transaction_id; +static u_int8_t last_invoke_id; /* Forward declarations */ -static int parse_ussd(u_int8_t *ussd, u_int8_t length); -static int parse_ussd_information_elements(u_int8_t *ussd_ie, u_int8_t length); +static int parse_ussd(u_int8_t *ussd); +static int parse_ussd_information_elements(u_int8_t *ussd_ie); static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length); static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length); static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length); @@ -117,34 +156,26 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length); /* Receive a mobile-originated USSD message and return the decoded text */ char* gsm0480_rcv_ussd(struct msgb *msg) { - int rc = 1; - u_int8_t tag; - u_int8_t length; - u_int8_t offset = 2; // don't yet understand the first 2 bytes, so ignore them for now + int rc = 0; + u_int8_t* parse_ptr = msgb_l3(msg); - DEBUGP(DMM, "USSD %s\n", hexdump(msg->data, msg->len)); // preliminary! Just see what we're receiving... +// DEBUGP(DMM, "USSD %s\n", hexdump(msg->data, msg->len)); // temporary, just see what we're receiving... memset(ussd_string_buff, 0, sizeof(ussd_string_buff)); - do + if((*parse_ptr & 0x0F) == GSM48_PDISC_NC_SS) { - tag = msg->data[offset]; - length = msg->data[offset+1]; - if((msg->data[offset+2] & 0x0f) == GSM48_PDISC_NC_SS) // not sure if this is correct??? - rc &= parse_ussd(&(msg->data[offset+3]), length-3); - offset += (length+2); + last_transaction_id = *parse_ptr & 0xF0; + rc = parse_ussd(parse_ptr + 1); } - while(offset < msg->len); - if(rc) - DEBUGP(DMM, "USSD received OK, response not yet implemented\n"); - else + if(!rc) DEBUGP(DMM, "Error occurred while parsing received USSD!\n"); return ussd_string_buff; } -static int parse_ussd(u_int8_t *ussd, u_int8_t length) +static int parse_ussd(u_int8_t *ussd) { int rc = 1; u_int8_t msg_type = ussd[0] & 0xBF; // message-type - section 3.4 @@ -152,10 +183,11 @@ static int parse_ussd(u_int8_t *ussd, u_int8_t length) switch(msg_type) { case GSM0480_MTYPE_RELEASE_COMPLETE: DEBUGP(DMM, "USS Release Complete\n"); // could also parse out the optional Cause/Facility data + ussd_string_buff[0] = 0xFF; break; case GSM0480_MTYPE_REGISTER: case GSM0480_MTYPE_FACILITY: - rc &= parse_ussd_information_elements(ussd+1, length-1); + rc &= parse_ussd_information_elements(ussd+1); break; default: fprintf(stderr, "Unknown GSM 04.80 message-type field 0x%02x\n", @@ -167,34 +199,26 @@ static int parse_ussd(u_int8_t *ussd, u_int8_t length) return rc; } -static int parse_ussd_information_elements(u_int8_t *ussd_ie, u_int8_t length) +static int parse_ussd_information_elements(u_int8_t *ussd_ie) { - int rc = 1; - u_int8_t offset = 0; + int rc; - do - { - u_int8_t iei = ussd_ie[offset]; // Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 - u_int8_t iei_length = ussd_ie[offset+1]; - switch(iei) { - case GSM48_IE_CAUSE: - break; - case GSM0480_IE_FACILITY: - rc &= parse_facility_ie(ussd_ie+2, iei_length); - break; - case GSM0480_IE_SS_VERSION: - break; - default: - fprintf(stderr, "Unhandled GSM 04.08 or 04.80 Information Element Identifier 0x%02x\n", - iei); - rc = 0; - break; - } - - - offset += (iei_length+2); + u_int8_t iei = ussd_ie[0]; // Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 + u_int8_t iei_length = ussd_ie[1]; + switch(iei) { + case GSM48_IE_CAUSE: + break; + case GSM0480_IE_FACILITY: + rc = parse_facility_ie(ussd_ie+2, iei_length); + break; + case GSM0480_IE_SS_VERSION: + break; + default: + fprintf(stderr, "Unhandled GSM 04.08 or 04.80 Information Element Identifier 0x%02x\n", + iei); + rc = 0; + break; } - while(offset < length); return rc; } @@ -243,6 +267,7 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) invoke_data[0]); } u_int8_t offset = invoke_data[1] + 2; + last_invoke_id = invoke_data[2]; if(invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) // optional part offset += invoke_data[offset+1] + 2; // skip over it @@ -252,7 +277,7 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) u_int8_t operation_code = invoke_data[offset+2]; switch(operation_code) { case GSM0480_OP_CODE_PROCESS_USS_REQ: - rc = parse_process_uss_req(invoke_data + 3, length - 3); + rc = parse_process_uss_req(invoke_data + offset + 3, length - offset - 3); break; default: fprintf(stderr, "GSM 04.80 operation code 0x%02x is not yet handled\n", @@ -275,75 +300,100 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) { int rc = 1; + int num_chars; u_int8_t dcs; - /* FIXME: properly parse out the initial tag and length, then the data-coding scheme and finally the text - - following piece of code uses hard-coded offsets into the data */ - dcs = uss_req_data[7]; - DEBUGP(DMM, "Data coding scheme = 0x%2.2X\n", dcs); // temporary - - int num_7_bit_chars = (uss_req_data[9] * 8) / 7; - gsm_7bit_decode(ussd_string_buff, &(uss_req_data[10]), num_7_bit_chars); +// DEBUGP(DMM, "USSD request params %s\n", hexdump(uss_req_data, length)); + /* FIXME: most phones send USSD text as a 7-bit encoded octet string; the following code + also handles the case of plain ASCII text (IA5String), but other encodings might be used */ + if(uss_req_data[0] == GSM_0480_SEQUENCE_TAG) + { + if(uss_req_data[2] == ASN1_OCTET_STRING_TAG) + { + dcs = uss_req_data[4]; +// DEBUGP(DMM, "Data coding scheme = 0x%2.2X\n", dcs); + if((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) + { + num_chars = (uss_req_data[6] * 8) / 7; + gsm_7bit_decode(ussd_string_buff, &(uss_req_data[7]), num_chars); + } + } + } + else if(uss_req_data[0] == ASN1_IA5_STRING_TAG) + { + num_chars = uss_req_data[1]; + memcpy(ussd_string_buff, &(uss_req_data[2]), num_chars); + } return rc; } -/* !!! Not yet complete or even partly working, causes a test phone to reboot! */ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; - struct gsm_network *net = in_msg->lchan->ts->trx->bts->network; u_int8_t *ptr8; - int response_len, response_pad; + int response_len; + response_len = strlen(response_text); + + msg->bts_link = in_msg->bts_link; msg->lchan = in_msg->lchan; gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); - gh->proto_discr = GSM48_PDISC_NC_SS; - gh->msg_type = GSM0480_MTYPE_FACILITY; - -/* FIXME: Need to add lots of stuff here to build up a valid USSD - - GSM0480_IE_FACILITY, GSM0480_CTYPE_INVOKE(?), GSM0480_COMPIDTAG_INVOKE_ID, - GSM0480_OPERATION_CODE, GSM0480_OP_CODE_PROCESS_USS_REQ(?) */ - - response_len = (strlen(response_text)*7)/8; - response_pad = (8 - strlen(net->name_long)*7)%8; - if (response_pad > 0) - response_len++; - /* 10.5.3.5a */ - ptr8 = msgb_put(msg, 19); + gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | 0x80; // TI direction = 1 + gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; + + ptr8 = msgb_put(msg, 14); ptr8[0] = GSM0480_IE_FACILITY; - ptr8[1] = response_len + 17; + ptr8[1] = response_len + 12; ptr8[2] = GSM0480_CTYPE_RETURN_RESULT; - ptr8[3] = response_len + 15; + ptr8[3] = response_len + 10; ptr8[4] = GSM0480_COMPIDTAG_INVOKE_ID; ptr8[5] = 1; - ptr8[6] = 0x80; // invoke-ID -128 - ptr8[7] = 0x30; // don't yet understand where this comes from - ptr8[8] = response_len + 10; + ptr8[6] = last_invoke_id; + ptr8[7] = GSM_0480_SEQUENCE_TAG; + ptr8[8] = response_len + 5; ptr8[9] = GSM0480_OPERATION_CODE; ptr8[10] = 1; - ptr8[11] = GSM0480_OP_CODE_PROCESS_USS_REQ; - ptr8[12] = 0x30; // don't yet understand where this comes from - ptr8[13] = response_len + 5; - ptr8[14] = 0x04; // indicates DCS to follow - ptr8[15] = 1; // length of DCS - ptr8[16] = 0x0F; // DCS - ptr8[17] = 0x04; // indicates string to follow - ptr8[18] = response_len; + ptr8[11] = GSM0480_OP_CODE_PROCESS_USS_DATA; + ptr8[12] = ASN1_IA5_STRING_TAG; + ptr8[13] = response_len; ptr8 = msgb_put(msg, response_len); - gsm_7bit_encode(ptr8, response_text); + memcpy(ptr8, response_text, response_len); - DEBUGP(DMM, "USSD response %s\n", hexdump(msg->data, msg->len)); // preliminary! Just see what we're sending... +// DEBUGP(DMM, "USSD response %s\n", hexdump(msg->data, msg->len)); // temporary, just to see what we're sending back - return -EINVAL; /* Temporary */ -// return gsm48_sendmsg(msg, NULL); + return gsm48_sendmsg(msg, NULL); } -/* !!! Not yet complete or even partly working */ -int gsm0480_send_ussd_error(struct msgb *in_msg) +int gsm0480_send_ussd_reject(struct msgb *in_msg) { - return -EINVAL; + struct msgb *msg = gsm48_msgb_alloc(); + struct gsm48_hdr *gh; + u_int8_t *ptr8; + + msg->bts_link = in_msg->bts_link; + msg->lchan = in_msg->lchan; + + gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh)); + gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | 0x80; // TI direction = 1 + gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; + + ptr8 = msgb_put(msg, 10); + ptr8[0] = GSM0480_IE_FACILITY; + ptr8[1] = 8; + ptr8[2] = GSM0480_CTYPE_REJECT; + ptr8[3] = 6; + ptr8[4] = GSM0480_COMPIDTAG_INVOKE_ID; + ptr8[5] = 1; + ptr8[6] = last_invoke_id; + ptr8[7] = GSM_0480_PROBLEM_CODE_TAG_GENERAL; + ptr8[8] = 1; + ptr8[9] = GSM_0480_GEN_PROB_CODE_UNRECOGNISED; + +// DEBUGP(DMM, "USSD reject %s\n", hexdump(msg->data, msg->len)); // temporary, just to see what we're sending back + + return gsm48_sendmsg(msg, NULL); } diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c old mode 100644 new mode 100755 index 26b4686..761a0e7 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -1,4 +1,4 @@ -/* Handler for mobile-originated USSDs */ +/* Network-specific handling of mobile-originated USSDs. */ /* (C) 2008-2009 by Harald Welte <laforge(a)gnumonks.org> * (C) 2008, 2009 by Holger Hans Peter Freyther <zecke(a)selfish.org> @@ -31,13 +31,17 @@ #include <openbsc/gsm_subscriber.h> #include <openbsc/debug.h> -#define USSD_TEXT_OWN_NUMBER "*#100#" +const char USSD_TEXT_OWN_NUMBER[] = "*#100#"; static int send_own_number(struct msgb *msg); int handle_rcv_ussd(struct msgb *msg) { char* ussd_text_rcvd = gsm0480_rcv_ussd(msg); + + if(ussd_text_rcvd[0] == 0xFF) // Release-Complete + return 0; + DEBUGP(DMM, "Received USSD text %s\n", ussd_text_rcvd); // show text payload entered on MS if(strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) @@ -48,12 +52,15 @@ int handle_rcv_ussd(struct msgb *msg) else { DEBUGP(DMM, "Unhandled USSD %s\n", ussd_text_rcvd); - return gsm0480_send_ussd_error(msg); + return gsm0480_send_ussd_reject(msg); } } static int send_own_number(struct msgb *msg) { + char response_string[] = "Your extension is xxxxx"; + char* own_number = msg->lchan->subscr->extension; - return gsm0480_send_ussd_response(msg, own_number); + memcpy(response_string + 18, own_number, 5); + return gsm0480_send_ussd_response(msg, response_string); } -- 1.6.0.4 --------------040900030502000202050609--

14 years, 6 months

1
0
0 0

audio support for application interface with nanoBTS

by Andreas.Eversberg

hi, here is the patch to support audio exchange between application interface and nanoBTS. the patch changes the audio format from TRAU frame format to RTP payload format on the application interface. also the BS11 TRAU frame is converted to/from RTP payload format (inside trau_mux.c), so an application does not have to care about what BTS is used. here is the format as defined by RFC: (just fyi) first byte has the magic value of 0xd0 plus four upper bits of the LARc[0] element as lower bits. second byte has the lower two bits of the LARc[0] element as upper bits and the upper bits of LARc[1] element as lower bits. third byte has the lower four bits of LARc[1] element as upper bits and so on... this format can directly be transcoded with the open source lossy gsm codec. the rtp_proxy.c now parses RTP frames and generates them. for easier code, i just mirrored the received RTCP frames back to the nanoBTS, mangled of yourse. (oops, maybe i need to change some synchronization source identifiers.) i think there is no problem with that right now. because RFC requires special synchronization source (ssrc) generation, i added md5 code and the (funny) random number generator. (see rtp_proxy.c random32()) as soon as the patch is applied, i will also check in linux-call-router modification for the new audio frame format. note that this code is just quickly tested, it works with both BS11 and nanoBTS and should not crash on corrupt or extended RTP data. the delay of audio data sent to nanoBTS was > 0.5 seconds. i think this is too much. maybe it is because i seamlessly increment the timestamp value in the RTP frame, even if the application dropps (delays) frames. regards, andreas

14 years, 6 months

3
4
0 0

AW: md5 / randomness (Re: audio support for application interfacewith nanoBTS)

by Andreas.Eversberg

On Sunday 04 October 2009 13:51:29 Harald Welte wrote: > one further note on the missing md5 file: > > As it seems it is only used to generate a pseudo-random 32bit value > for use in the SSRC: I'd rather not introduce a copy of MD5 for that. > > There are two options to take: > > 1) simply use the same [not very random] method as we use for the TMSI > > 2) introduce a dependency to openssl and use that. Given that nanoBTS > also support OML/RSL over SSL/TLS, I think sooner or later we will > have to add that dependency anyway. hi, i think that very good random is not required. in our case we don't have large scale RTP conferences with thousands of sources. we have to choose a random number that just differs from the one selected by nanoBTS. (the RTP session will fail afer some seconds when using same SSRC.) andreas

14 years, 6 months

1
0
0 0

[PATCH] abis_nm: Fix ACTIVATE SW parameters

by Sylvain Munaut

From: Sylvain Munaut <tnt(a)246tNt.com> The previous code only sent the FILE_ID tag data part, but according to the GSM 12.21 spec, section 8.3.6, the full SW Description 'object' must be sent so that includes the NM_ATT_SW_DESCR tag, the whole FILE_ID and the whole FILE_VERSION (including tags & length fields). Note that functionnaly on a nanoBTS 139 I couldn't see any difference ... whatever I send in there it works ... Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/abis_nm.c | 13 ++++++++++--- 1 files changed, 10 insertions(+), 3 deletions(-) diff --git a/openbsc/src/abis_nm.c b/openbsc/src/abis_nm.c index 35ed8db..a450452 100755 --- a/openbsc/src/abis_nm.c +++ b/openbsc/src/abis_nm.c @@ -857,6 +857,7 @@ static int abis_nm_rx_sw_act_req(struct msgb *mb) const u_int8_t *sw_config; int sw_config_len; int file_id_len; + int file_ver_len; int nack = 0; int ret; @@ -889,18 +890,24 @@ static int abis_nm_rx_sw_act_req(struct msgb *mb) if (sw_config[0] != NM_ATT_SW_DESCR) DEBUGP(DNM, "SW_DESCR attribute identifier not found!\n"); + if (sw_config[1] != NM_ATT_FILE_ID) DEBUGP(DNM, "FILE_ID attribute identifier not found!\n"); file_id_len = sw_config[2] * 256 + sw_config[3]; + if (sw_config[4+file_id_len] != NM_ATT_FILE_VERSION) + DEBUGP(DNM, "FILE_VERSION attribute identifier not found!\n"); + file_ver_len = sw_config[5+file_id_len] * 256 + sw_config[6+file_id_len]; + /* Assumes first SW file in list is the one to be activated */ - /* sw_config + 4 to skip over 2 attribute ID bytes and 16-bit length field */ + /* The +7 in length is to account for the 3 tags and 2 length fields */ + /* (see GSM 12.21 - 9.4.{62,18,19} for details */ return ipacc_sw_activate(mb->trx->bts, foh->obj_class, foh->obj_inst.bts_nr, foh->obj_inst.trx_nr, foh->obj_inst.ts_nr, - sw_config + 4, - file_id_len); + sw_config, + 7 + file_id_len + file_ver_len); } /* Receive a CHANGE_ADM_STATE_ACK, parse the TLV and update local state */ -- 1.6.4

14 years, 6 months

3
2
0 0

AW: audio support for application interface with nanoBTS

by Andreas.Eversberg

> One thing I noted immediately: The newly-introduced md5c.c file is missing from your diff. Can you please re-submit with that file? Thanks. >(in case you work with git, first 'git add' the file, then 'git diff HEAD', if all your changes are not yet committed) ok, again a corrected verion of the rtp.patch (hopefully complete)

14 years, 6 months

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC October 2009