OpenBSC October 2009

openbsc@lists.osmocom.org

25 participants
64 discussions

ip.access nanobts 1800 model 139, get "disabled" states

by Oystein Homelien

Hello, I am trying to get my nanobts 1800 model 139 working. It is set up for dhcp and correctly contacts my openbsc instance. I get lots of "disabled" states and I am curious if you have any hints for me. I suspect there may be a bts firmware version problem. Any help is appreciated! See log below. ipaccess_find: MAC Address='00:02:95:00:xx:xx' IP Address='xxxx' Unit ID='1801/0/0' Location 1='' Location 2='BTS_NBT131G' Equipment Version='111_029_21' Software Version='120a002_v149b32d0' Unit Name='nbts-00-02-95-x' Serial Number='x' config: ! OpenBSC configuration saved from vty ! ! password foo ! line vty no login ! network network country code 242 mobile network code 99 short name analyzer long name AnaLyzer auth policy accept-all encryption a5 0 bts 0 type nanobts band 1800 cell_identity 0 location_area_code 1 training_sequence_code 7 base_station_id_code 63 ms max power 12 channel allocator ascending ip.access unit_id 1801 0 trx 0 arfcn 576 max_power_red 12 rsl e1 line 0 timeslot 1 sub-slot full rsl e1 tei 1 timeslot 0 phys_chan_config CCCH+SDCCH4 e1 line 0 timeslot 1 sub-slot full timeslot 1 phys_chan_config SDCCH8 e1 line 0 timeslot 2 sub-slot 1 timeslot 2 phys_chan_config TCH/F e1 line 0 timeslot 2 sub-slot 2 timeslot 3 phys_chan_config TCH/F e1 line 0 timeslot 2 sub-slot 3 timeslot 4 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 0 timeslot 5 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 1 timeslot 6 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 2 timeslot 7 phys_chan_config TCH/F e1 line 0 timeslot 3 sub-slot 3 log: <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=GPRS NSE(f0) INST=(00,ff,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS CELL(f1) INST=(00,00,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS NSVC(f2) INST=(00,00,ff) STATE CHG: <0020> abis_nm.c:805 OC=GPRS NSVC(f2) INST=(00,01,ff) STATE CHG: <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Not installed(07) <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) Software Activated Report <0020> abis_nm.c:805 OC=SITE MANAGER(00) INST=(ff,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Off line(03) <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:863 Software Activate Request NACKing for GPRS obj_class 0xf0 <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) Software Activated Report <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1671 Set BTS Attr (bts=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x01 obj_inst=(0x00, 0xff, 0xff) <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:863 Software Activate Request ACKing and Activating <0020> abis_nm.c:887 Found SW config: 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 34 34 64 30 00 42 12 00 08 31 32 30 61 30 30 31 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 42 12 00 08 31 32 30 61 30 30 32 00 13 00 0a 76 31 34 39 62 33 32 64 30 00 <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=BTS(01) INST=(00,ff,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) Software Activated Report <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x04 obj_inst=(0x00, 0x00, 0xff) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x00) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=1) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x01) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=2) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x02) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=3) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x03) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=4) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x04) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=5) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=6) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x06) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) Software Activated Report <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:1768 Set Chan Attr (bts=0,trx=0,ts=7) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x03 obj_inst=(0x00, 0x00, 0x07) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) Software Activated Report <0020> abis_nm.c:1688 Set TRX Attr (bts=0,trx=0) <0020> abis_nm.c:1855 Sending OPSTART obj_class=0x02 obj_inst=(0x00, 0x00, 0xff) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:2477 IPACCESS(0xe1): RSL CONNECT ACK IP=123.234.10.101 PORT=3003 <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=BASEBAND TRANSCEIVER(04) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,00) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,01) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,02) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,03) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,04) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,05) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,06) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=CHANNEL(03) INST=(00,00,07) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) <0020> abis_nm.c:805 OC=RADIO CARRIER(02) INST=(00,00,ff) STATE CHG: OP_STATE=Disabled AVAIL=Dependency(05) ADM=Unlocked yours, oystein

15 years, 10 months

Final (?) USSD-branch patch

by Mike Haben

- Improved handling of extension-number string (as per review) - Guard against a buffer-overflow if mobile sends a too-long USSD - declare some function-parameters const - fix gsm_ts_name function to display the right BTS number (bts->nr rather than bts->bts_nr) Hope this all looks OK... Best regards, Mike H.

15 years, 10 months

[PATCH] USSD - address remaining review points, and guard against buffer overflow Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 10 ++++++---- openbsc/include/openbsc/gsm_subscriber.h | 7 ++++--- openbsc/src/gsm_04_80.c | 9 ++++++--- openbsc/src/gsm_data.c | 2 +- openbsc/src/ussd.c | 6 +++--- 5 files changed, 20 insertions(+), 14 deletions(-) mode change 100644 => 100755 openbsc/include/openbsc/gsm_04_80.h mode change 100644 => 100755 openbsc/include/openbsc/gsm_subscriber.h mode change 100644 => 100755 openbsc/src/gsm_04_80.c mode change 100644 => 100755 openbsc/src/gsm_data.c mode change 100644 => 100755 openbsc/src/ussd.c diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h old mode 100644 new mode 100755 index 9bdf2c2..c240bbe --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -125,17 +125,19 @@ #include <openbsc/msgb.h> +#define MAX_LEN_USSD_STRING 31 + struct ussd_request { - char text[32]; + char text[MAX_LEN_USSD_STRING + 1]; u_int8_t transaction_id; u_int8_t invoke_id; }; -int gsm0480_decode_ussd_request(struct msgb *msg, +int gsm0480_decode_ussd_request(const struct msgb *msg, struct ussd_request *request); -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, +int gsm0480_send_ussd_response(const struct msgb *in_msg, const char* response_text, const struct ussd_request *req); -int gsm0480_send_ussd_reject(struct msgb *msg, +int gsm0480_send_ussd_reject(const struct msgb *msg, const struct ussd_request *request); #endif diff --git a/openbsc/include/openbsc/gsm_subscriber.h b/openbsc/include/openbsc/gsm_subscriber.h old mode 100644 new mode 100755 index ea70c3a..b181917 --- a/openbsc/include/openbsc/gsm_subscriber.h +++ b/openbsc/include/openbsc/gsm_subscriber.h @@ -8,13 +8,14 @@ #define GSM_IMEI_LENGTH 17 #define GSM_IMSI_LENGTH 17 #define GSM_NAME_LENGTH 128 -#define GSM_EXTENSION_LENGTH 128 + +#define GSM_EXTENSION_LENGTH 6 +#define GSM_MIN_EXTEN 20000 +#define GSM_MAX_EXTEN 49999 /* reserved according to GSM 03.03 § 2.4 */ #define GSM_RESERVED_TMSI 0xFFFFFFFF -#define GSM_MIN_EXTEN 20000 -#define GSM_MAX_EXTEN 49999 #define GSM_SUBSCRIBER_FIRST_CONTACT 0x00000001 #define tmsi_from_string(str) strtoul(str, NULL, 10) diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c old mode 100644 new mode 100755 index 5d85c82..7f5089d --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -70,7 +70,7 @@ static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, u_int8_t tag, /* Decode a mobile-originated USSD-request message */ -int gsm0480_decode_ussd_request(struct msgb *msg, struct ussd_request *req) +int gsm0480_decode_ussd_request(const struct msgb *msg, struct ussd_request *req) { int rc = 0; u_int8_t *parse_ptr = msgb_l3(msg); @@ -230,6 +230,9 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; + /* Prevent a mobile-originated buffer-overrun! */ + if (num_chars > MAX_LEN_USSD_STRING) + num_chars = MAX_LEN_USSD_STRING; gsm_7bit_decode(req->text, &(uss_req_data[7]), num_chars); /* append null-terminator */ @@ -242,7 +245,7 @@ static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, } /* Send response to a mobile-originated ProcessUnstructuredSS-Request */ -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, +int gsm0480_send_ussd_response(const struct msgb *in_msg, const char* response_text, const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); @@ -295,7 +298,7 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, return gsm48_sendmsg(msg, NULL); } -int gsm0480_send_ussd_reject(struct msgb *in_msg, +int gsm0480_send_ussd_reject(const struct msgb *in_msg, const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c old mode 100644 new mode 100755 index 6767c3f..2344d96 --- a/openbsc/src/gsm_data.c +++ b/openbsc/src/gsm_data.c @@ -224,7 +224,7 @@ static char ts2str[255]; char *gsm_ts_name(struct gsm_bts_trx_ts *ts) { snprintf(ts2str, sizeof(ts2str), "(bts=%d,trx=%d,ts=%d)", - ts->trx->bts->bts_nr, ts->trx->nr, ts->nr); + ts->trx->bts->nr, ts->trx->nr, ts->nr); return ts2str; } diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c old mode 100644 new mode 100755 index e414b1c..a3d11f0 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -63,9 +63,9 @@ int handle_rcv_ussd(struct msgb *msg) static int send_own_number(const struct msgb *msg, const struct ussd_request *req) { char *own_number = msg->lchan->subscr->extension; - /* Need trailing CR as EOT character */ - char response_string[] = "Your extension is xxxxx\r"; + char response_string[GSM_EXTENSION_LENGTH + 20]; - memcpy(response_string + 18, own_number, 5); + /* Need trailing CR as EOT character */ + snprintf(response_string, sizeof(response_string), "Your extension is %s\r", own_number); return gsm0480_send_ussd_response(msg, response_string, req); } -- 1.6.0.4 --------------090904070701030605040309--

15 years, 10 months

Re: cheap ip.access nano BTS on ebay

by Bjoern Heller

Hallo, ich bitte dich/alle aber da nicht zu viel Wirbel drum zu machen, damit die nicht bei ihrem eventuell vorhandenem restlichen Bestand die Preise hoch ziehen... http://stores.ebay.de/BLLCORP Gruss Bjoern Am 22.10.2009 um 23:33 schrieb Martin Kluge: > Hi Bjoern, > > könntest Du mit evtl. mal den Namen/Kontaktdaten des Händlers > schicken? > > > Vielen Dank, > Martin > > On Thu, Oct 22, 2009 at 04:21:00PM +0200, Bjoern Heller wrote: >> Hello, >> >> yesterday I got a ip.access nano BTS >> MODEL 165B V33 PCS 1900 >> for 133 Euro (incl. shipping) on Ebay. >> >> The seller has maybe more in stock... >> >> I know, that it`s only 1900 band but maybe interesting for some >> people. >> >> regards >> Bjoern >> >> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >> Björn Heller >> Jabber: tec(a)jabber.hellercom.de >> > > -- > Dipl. Inf. (FH) Martin Kluge > > Email : mk(a)elxsi.de > Phone : +49 (700) 00101000 > Fax : +49 (941) 599267834 > Website : http://www.elxsi.de > GPG Key : http://www.elxsi.de/key.pub > RIPE : KLM-RIPE / AS35292 > - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

15 years, 10 months

AW: Running an licensed experimental GSM network at 26c3

by Andreas.Eversberg

hi, i also did my part: http://events.ccc.de/congress/2009/wiki/index.php/Linux-Call-Router harald, you may add yours to the projects category: http://events.ccc.de/congress/2009/wiki/index.php/Category:Projects. if you would like to join with me, then go ahead, link your project to my page and increase the number of seats, and note on both project pages that both projects are together in one area. if anyone requires special equipment, let me know or bring it yourself. e.g. if we like to play with OpenBTS in conjunction with Asterisk, we need another server, since my server is in use for the ISDN/ASTERISK/DECT <-> GSM link. andreas -----Ursprüngliche Nachricht----- Von: Alexander Chemeris [mailto:alexander.chemeris@gmail.com] Gesendet: Montag, 12. Oktober 2009 22:18 An: Harald Welte Cc: Andreas.Eversberg; openbsc; openbts-discuss(a)lists.sourceforge.net Betreff: Re: Running an licensed experimental GSM network at 26c3 Hi Harald, David, Andreas, On Sun, Oct 11, 2009 at 13:19, Harald Welte <laforge(a)gnumonks.org> wrote: > On Sat, Oct 10, 2009 at 09:33:31PM +0400, Alexander Chemeris wrote: >> We'll bring one or two our USRPs for OpenBTS testing even if David Burgess >> won't be able to come, and we would love to be located near OpenBSC guys >> and you. But that'll be our first time at 26C3 and we're little bit >> lost - should we send some request to get the space? > > I think the process for applying for tablespace in the hackcenter has not yet > started. > > Meanwhile I've created a http://events.ccc.de/congress/2009/wiki/index.php/GSM > wiki page where we can add stuff to, similar to the 25C3 and HAR2009. Great, thank you. I'll keep my eye on it.

15 years, 10 months

cheap ip.access nano BTS on ebay

by Bjoern Heller

Hello, yesterday I got a ip.access nano BTS MODEL 165B V33 PCS 1900 for 133 Euro (incl. shipping) on Ebay. The seller has maybe more in stock... I know, that it`s only 1900 band but maybe interesting for some people. regards Bjoern - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Björn Heller Jabber: tec(a)jabber.hellercom.de

15 years, 10 months

Patch to USSD branch - eliminates static variables

by Mike Haben

Hi Harald, thanks for the review comments. Patch (attached) for the USSD branch addresses the first issue you highlighted - static variables have been eliminated. Best regards, Mike H.

15 years, 10 months

[PATCH] USSD code - eliminate static variables, as per Harald's review Signed-off-by: Mike Haben <michael.haben@btinternet.com>

by Mike Haben

--- openbsc/include/openbsc/gsm_04_80.h | 15 +++++- openbsc/src/gsm_04_80.c | 90 ++++++++++++++++++----------------- openbsc/src/ussd.c | 19 ++++---- 3 files changed, 68 insertions(+), 56 deletions(-) diff --git a/openbsc/include/openbsc/gsm_04_80.h b/openbsc/include/openbsc/gsm_04_80.h index 11962d8..9bdf2c2 100644 --- a/openbsc/include/openbsc/gsm_04_80.h +++ b/openbsc/include/openbsc/gsm_04_80.h @@ -125,8 +125,17 @@ #include <openbsc/msgb.h> -char* gsm0480_rcv_ussd(struct msgb *msg); -int gsm0480_send_ussd_response(struct msgb *msg, const char* response_text); -int gsm0480_send_ussd_reject(struct msgb *msg); +struct ussd_request { + char text[32]; + u_int8_t transaction_id; + u_int8_t invoke_id; +}; + +int gsm0480_decode_ussd_request(struct msgb *msg, + struct ussd_request *request); +int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, + const struct ussd_request *req); +int gsm0480_send_ussd_reject(struct msgb *msg, + const struct ussd_request *request); #endif diff --git a/openbsc/src/gsm_04_80.c b/openbsc/src/gsm_04_80.c index 052b0a7..5d85c82 100644 --- a/openbsc/src/gsm_04_80.c +++ b/openbsc/src/gsm_04_80.c @@ -37,16 +37,16 @@ #include <openbsc/gsm_04_08.h> #include <openbsc/gsm_04_80.h> -static char ussd_string_buff[32]; -static u_int8_t last_transaction_id; -static u_int8_t last_invoke_id; - /* Forward declarations */ -static int parse_ussd(u_int8_t *ussd); -static int parse_ussd_information_elements(u_int8_t *ussd_ie); -static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length); -static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length); -static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length); +static int parse_ussd(u_int8_t *ussd, struct ussd_request *req); +static int parse_ussd_info_elements(u_int8_t *ussd_ie, + struct ussd_request *req); +static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length, + struct ussd_request *req); +static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length, + struct ussd_request *req); +static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, + struct ussd_request *req); static inline unsigned char *msgb_wrap_with_TL(struct msgb *msgb, u_int8_t tag) { @@ -69,26 +69,24 @@ static inline unsigned char *msgb_push_TLV1(struct msgb *msgb, u_int8_t tag, } -/* Receive a mobile-originated USSD message and return the decoded text */ -char *gsm0480_rcv_ussd(struct msgb *msg) +/* Decode a mobile-originated USSD-request message */ +int gsm0480_decode_ussd_request(struct msgb *msg, struct ussd_request *req) { int rc = 0; u_int8_t *parse_ptr = msgb_l3(msg); - memset(ussd_string_buff, 0, sizeof(ussd_string_buff)); - if ((*parse_ptr & 0x0F) == GSM48_PDISC_NC_SS) { - last_transaction_id = *parse_ptr & 0x70; - rc = parse_ussd(parse_ptr + 1); + req->transaction_id = *parse_ptr & 0x70; + rc = parse_ussd(parse_ptr+1, req); } if (!rc) DEBUGP(DMM, "Error occurred while parsing received USSD!\n"); - return ussd_string_buff; + return rc; } -static int parse_ussd(u_int8_t *ussd) +static int parse_ussd(u_int8_t *ussd, struct ussd_request *req) { int rc = 1; u_int8_t msg_type = ussd[0] & 0xBF; /* message-type - section 3.4 */ @@ -97,11 +95,11 @@ static int parse_ussd(u_int8_t *ussd) case GSM0480_MTYPE_RELEASE_COMPLETE: DEBUGP(DMM, "USS Release Complete\n"); /* could also parse out the optional Cause/Facility data */ - ussd_string_buff[0] = 0xFF; + req->text[0] = 0xFF; break; case GSM0480_MTYPE_REGISTER: case GSM0480_MTYPE_FACILITY: - rc &= parse_ussd_information_elements(ussd+1); + rc &= parse_ussd_info_elements(ussd+1, req); break; default: fprintf(stderr, "Unknown GSM 04.80 message-type field 0x%02x\n", @@ -113,7 +111,7 @@ static int parse_ussd(u_int8_t *ussd) return rc; } -static int parse_ussd_information_elements(u_int8_t *ussd_ie) +static int parse_ussd_info_elements(u_int8_t *ussd_ie, struct ussd_request *req) { int rc; /* Information Element Identifier - table 3.2 & GSM 04.08 section 10.5 */ @@ -124,7 +122,7 @@ static int parse_ussd_information_elements(u_int8_t *ussd_ie) case GSM48_IE_CAUSE: break; case GSM0480_IE_FACILITY: - rc = parse_facility_ie(ussd_ie+2, iei_length); + rc = parse_facility_ie(ussd_ie+2, iei_length, req); break; case GSM0480_IE_SS_VERSION: break; @@ -138,7 +136,8 @@ static int parse_ussd_information_elements(u_int8_t *ussd_ie) return rc; } -static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) +static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length, + struct ussd_request *req) { int rc = 1; u_int8_t offset = 0; @@ -150,7 +149,9 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) switch (component_type) { case GSM0480_CTYPE_INVOKE: - rc &= parse_ss_invoke(facility_ie+2, component_length); + rc &= parse_ss_invoke(facility_ie+2, + component_length, + req); break; case GSM0480_CTYPE_RETURN_RESULT: break; @@ -171,7 +172,8 @@ static int parse_facility_ie(u_int8_t *facility_ie, u_int8_t length) } /* Parse an Invoke component - see table 3.3 */ -static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) +static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length, + struct ussd_request *req) { int rc = 1; u_int8_t offset; @@ -183,7 +185,7 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) } offset = invoke_data[1] + 2; - last_invoke_id = invoke_data[2]; + req->invoke_id = invoke_data[2]; /* optional part */ if (invoke_data[offset] == GSM0480_COMPIDTAG_LINKED_ID) @@ -195,7 +197,8 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) switch (operation_code) { case GSM0480_OP_CODE_PROCESS_USS_REQ: rc = parse_process_uss_req(invoke_data + offset + 3, - length - offset - 3); + length - offset - 3, + req); break; default: fprintf(stderr, "GSM 04.80 operation code 0x%02x " @@ -214,36 +217,33 @@ static int parse_ss_invoke(u_int8_t *invoke_data, u_int8_t length) } /* Parse the parameters of a Process UnstructuredSS Request */ -static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length) +static int parse_process_uss_req(u_int8_t *uss_req_data, u_int8_t length, + struct ussd_request *req) { - int rc = 1; + int rc = 0; int num_chars; u_int8_t dcs; - /* FIXME: most phones send USSD text as a 7-bit encoded octet string; - * the following code also handles the case of plain ASCII text - * (IA5String), but other encodings might be used */ - if (uss_req_data[0] == GSM_0480_SEQUENCE_TAG) { if (uss_req_data[2] == ASN1_OCTET_STRING_TAG) { dcs = uss_req_data[4]; if ((dcs == 0x0F) && (uss_req_data[5] == ASN1_OCTET_STRING_TAG)) { num_chars = (uss_req_data[6] * 8) / 7; - gsm_7bit_decode(ussd_string_buff, + gsm_7bit_decode(req->text, &(uss_req_data[7]), num_chars); + /* append null-terminator */ + req->text[num_chars+1] = 0; + rc = 1; } } - } else if (uss_req_data[0] == ASN1_IA5_STRING_TAG) { - num_chars = uss_req_data[1]; - memcpy(ussd_string_buff, &(uss_req_data[2]), num_chars); - } - + } return rc; } /* Send response to a mobile-originated ProcessUnstructuredSS-Request */ -int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) +int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text, + const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; @@ -278,7 +278,7 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) msgb_wrap_with_TL(msg, GSM_0480_SEQUENCE_TAG); /* Pre-pend the invoke ID */ - msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, req->invoke_id); /* Wrap this up as a Return Result component */ msgb_wrap_with_TL(msg, GSM0480_CTYPE_RETURN_RESULT); @@ -288,13 +288,15 @@ int gsm0480_send_ussd_response(struct msgb *in_msg, const char* response_text) /* And finally pre-pend the L3 header */ gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); - gh->proto_discr = GSM48_PDISC_NC_SS | last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->proto_discr = GSM48_PDISC_NC_SS | req->transaction_id + | (1<<7); /* TI direction = 1 */ gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); } -int gsm0480_send_ussd_reject(struct msgb *in_msg) +int gsm0480_send_ussd_reject(struct msgb *in_msg, + const struct ussd_request *req) { struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; @@ -307,7 +309,7 @@ int gsm0480_send_ussd_reject(struct msgb *in_msg) GSM_0480_GEN_PROB_CODE_UNRECOGNISED); /* Before it insert the invoke ID */ - msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, last_invoke_id); + msgb_push_TLV1(msg, GSM0480_COMPIDTAG_INVOKE_ID, req->invoke_id); /* Wrap this up as a Reject component */ msgb_wrap_with_TL(msg, GSM0480_CTYPE_REJECT); @@ -318,7 +320,7 @@ int gsm0480_send_ussd_reject(struct msgb *in_msg) /* And finally pre-pend the L3 header */ gh = (struct gsm48_hdr *) msgb_push(msg, sizeof(*gh)); gh->proto_discr = GSM48_PDISC_NC_SS; - gh->proto_discr |= last_transaction_id | (1<<7); /* TI direction = 1 */ + gh->proto_discr |= req->transaction_id | (1<<7); /* TI direction = 1 */ gh->msg_type = GSM0480_MTYPE_RELEASE_COMPLETE; return gsm48_sendmsg(msg, NULL); diff --git a/openbsc/src/ussd.c b/openbsc/src/ussd.c index 9dc2205..e414b1c 100644 --- a/openbsc/src/ussd.c +++ b/openbsc/src/ussd.c @@ -38,33 +38,34 @@ const char USSD_TEXT_OWN_NUMBER[] = "*#100#"; /* Forward declarations of network-specific handler functions */ -static int send_own_number(struct msgb *msg); +static int send_own_number(const struct msgb *msg, const struct ussd_request *req); /* Entrypoint - handler function common to all mobile-originated USSDs */ int handle_rcv_ussd(struct msgb *msg) { - char *ussd_text_rcvd = gsm0480_rcv_ussd(msg); + struct ussd_request req; - if (ussd_text_rcvd[0] == 0xFF) /* Release-Complete */ + gsm0480_decode_ussd_request(msg, &req); + if (req.text[0] == 0xFF) /* Release-Complete */ return 0; - if (strstr(USSD_TEXT_OWN_NUMBER, ussd_text_rcvd) != NULL) { + if (strstr(USSD_TEXT_OWN_NUMBER, req.text) != NULL) { DEBUGP(DMM, "USSD: Own number requested\n"); - return send_own_number(msg); + return send_own_number(msg, &req); } else { - DEBUGP(DMM, "Unhandled USSD %s\n", ussd_text_rcvd); - return gsm0480_send_ussd_reject(msg); + DEBUGP(DMM, "Unhandled USSD %s\n", req.text); + return gsm0480_send_ussd_reject(msg, &req); } } /* A network-specific handler function */ -static int send_own_number(struct msgb *msg) +static int send_own_number(const struct msgb *msg, const struct ussd_request *req) { char *own_number = msg->lchan->subscr->extension; /* Need trailing CR as EOT character */ char response_string[] = "Your extension is xxxxx\r"; memcpy(response_string + 18, own_number, 5); - return gsm0480_send_ussd_response(msg, response_string); + return gsm0480_send_ussd_response(msg, response_string, req); } -- 1.6.0.4 --------------080700070202040005090208--

15 years, 10 months

Progress on the GPRS side

by Harald Welte

Hi all! With the current code in the 'gprs' branch, I am able to get the NS (08.16) and BSSGP (08.18) layers up and running with the nanoBTS. The NS RESET and TEST procedures are running fine, as well as the BSSGP RESET and BLOCK procedures. I now need to work on patching the system information to indicate GPRS support and add a SI13 message. Hopefully at that point, it is possible to receive LLC frames that are being sent by the MS. Ignoring Mobility Management for now and considering only single-BTS operation of GPRS, the biggest remaining items are: * understand LLC better and implement it * implement SNDCP * how to interface the actual network (using pty's with pppd on top) * make things more dynamic rather than static at compile time Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 10 months

progress: nanoBTS multi-TRX configuration

by Harald Welte

Hi all, JFYI: There's some progress on the nanoBTS multi-TRX configuration. It seems it was my mistake. Setting the TRX0 unit ID to 1801/0/0 and the TRX1 unit ID to 1801/0/1 works using ipaccess-config. If you then connect the TIB cable (TRX0 TIB out -> TRX1 TIB in) and reboot both nanoBTS, you will get a single A-bis OML connection from 1801/0/0 where you get software activate requests for both transceivers. Somehow we're not handling them correctly yet from our abis_nm code, but that should be easy to solve. I'm working at it. So Dieter and others: No need to worry about this at the moment, we're very close now and I think it is no problem for the 26C3. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

15 years, 10 months

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC October 2009