OpenBSC November 2013

openbsc@lists.osmocom.org

21 participants
29 discussions

[PATCH 1/4] rtp: Fixed size check in padded RTP packets

by Jacob Erlbeck

This patch fixes a corner case (padding 1, payload size incl padding 0) which is not being detected correctly. Sponsored-by: On-Waves ehf --- openbsc/src/libtrau/rtp_proxy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c index 0074b4a..4278fc6 100644 --- a/openbsc/src/libtrau/rtp_proxy.c +++ b/openbsc/src/libtrau/rtp_proxy.c @@ -151,7 +151,7 @@ static int rtp_decode(struct msgb *msg, uint32_t callref, struct msgb **data) } } if (rtph->padding) { - if (payload_len < 0) { + if (payload_len < 1) { DEBUGPC(DLMUX, "received RTP frame too short for " "padding length\n"); return -EINVAL; -- 1.7.9.5

11 years, 7 months

Hard reset NanoBTS after forgetting static IP

by Luca Bongiorni

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey there, I have come across a nanoBTS 165AU but since is used and not tested from the previous owner, I guess it has set a static IP. After turned on is booting (RED light) and then remains (ORANGE not flashing) even if the eth is connected to the router. At the moment I am trying with ipaccess-find and BtsInstaller to find in on my LAN . Unfortunately it is not answering and is not even getting an IP from the router by the DHCP daemon. Two possibilities, I have thought: - - an hw/sw issue; - - a Static IP is set. Supposing that is the 2nd possibility, I was thinking: - - to change private class of my LAN, to see if it changes something; - - to make an hard reset of the bts. Do you know if it possible to reset in someway? Ever happened this issue to you guys? Suggestions or insults are welcome. Thanks in advance. Cheers, Luca P.S.: I don't recall exactly, but one time I heard that is possible to reset by short-circuiting some pins of the LAN/48VDC eth connector. Is it right?! -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSE682AAoJEPLE1Qsi6ZiTuKkQAJaYGFTgMF5XlWuZuCI1eSvU lVCvpdB+fDRY7o6iut3y0fGlS1ZOIS8X93c7/T0XKUvSJaZ2ARIGjqi81A4XlkAK pdFvBNPKixYATYZYhP3nIggC1QGK9fuWQSUKVEGgnswsXt0VaJKdEwgn0CX7ttku uoh6FM3vtp30drB4t9oe0bW9M9qzGz6yyw+8asaqQBs8bafOHm4+S4kJsN6lYmPU wY/s8ctzqZerNI0MwBVASZCFldsyWe0NuduquYZlwg4god996srFNkVQL+o9nrmF vmPb896DTsCdivwqs+UyaZOgp1mKxjtfco275pVATG4qSAgz/JYQBxWK6fWQr+Zv PIzQvFLME1kh/29nUihxw93mzju5Rz1naTosx5+Fs7jPjCFocqD5Var3hkU4iu78 kNALJNx6UGOdfbqcInO30ltSm21HH1QBJnIoZf6MblELvHcvHbBNyPB8zM13suoS y3/oD/wcXefQaMaSa5HFc30ydJHBWS+adNlVp3fdYYArZaVkFxaVjJx8fW1juPVx 54aco5j7/tZD5tfg9FCOTHqmAiOVDqjs7nZrOpsRdkdPJHq2uHbGmHGqyhZlVWNv B+9/eiOdQyKZ5R+3vvRrmhBe9g2a28xtRI7N8KxwCov0wbA6R0h8l2UtGza6NTcn EUdW3ptIWP216tSFdVTs =9Ctc -----END PGP SIGNATURE-----

11 years, 7 months

OsmoBTS without HW

by TAMASKOVIC, Dominik

Hi, I am working on my Diploma thesis , which topic is GPRS Emulation software. This project is based on your OsmoBTS project . The idea is to delete/replace the hw-related primitives and features and redirect the whole traffic to the osmocomBB with modifications – this is the work of my colleague . 1st point: My intention is to implement gprs part only. I have analyzed the BTS codes(especially Master, Jolly/l1sap_parts and Jolly/Trx ), i dont know which one will be most suitable to use, but I think the jolly/trx or jolly/l1sap_parts common part will be probably best choise . It implements more common functions in l1sap interface compared to the Master code . Am I right ? 2nd point: I have analyzed the common code, and it is look like the main logic of the PCU(from the BTS side) is implemented in pcu_sock.c and l1sap.c , where the l1sap implements the message parsing and sending to the l1_if of the BTS , and also initializes gsmtap messages . So what I want to do is to create another socket application to connect with osmocomBB(with additional gprs implementation) , which will send/receive the BTS messages from l1sap through our custom "l1 interface" to the osmocomBB phone("how simple") . The PCU part looks, that would not need any intervention. What do you think ? The hardest part will be to achieve , the application will be able to run witout HW (in the case of TRX branch , the bts will be able to connect to "transmiter" ). Since i am now standing on the crossroad, i need advice to make the right discision . Any suggestions and comments are highly appreciated. Best Regards, Dominik Tamaskovic

11 years, 7 months

Huawei "CAMEL" in between USAU and SCP

by Dmitri Soloviev

Hi list I'm hacking a protocol that runs inside Huawei SCP, in between USAU (signaling gateway within IN) and SCP node itself. There is a small file at my disposal (few megs), to study. Unfortunately there is no way to run a trace at the other side of USAU in parallel, so need to guess about fields. Here is the typical IDP found with my guestimations 000000a7 - packet length 0000feab - packet ID 00a1 - length of remained portion 1000 - (***) protocol type, 0x1000 is similar to CAMEL, other protocols are {0100,0200,0300,0400,0500,0600,1000,1200,1300,1400,1500,1700} 01d6f100 - transaction ID 01d6f100 01ff - msg type and direction, 01FF - IDP, where FF means that it goes from gsmSCP to gsmSCP, response is 0100 0000010000000000 - something unknown, some messages may have non-zero values here 8c - length 30 81 - tag+len, something like IDP args 89 8001 01 82 08 84 90 xxxxxxxxxxxx - A pty, MSISDN 83 08 84 13 xxxxxxxxxxxx - B pty, MSISDN 85 01 0a 88 04 00000000 8a 04 84 13 xxxx - E.164 country code bb 05 80038090a3 9c 01 0c 9f32 08 xxxxxxxxxxxxxxxx - IMSI (A) bf33 02 8000 bf34 - a tag that assumes no length/value 22 02 0159 80 08 1000000000000000 81 08 91 xxxxxxxxxxxxxxx - GT of MSC(ssf) a3 09 8007 xxxxxxxxxxxxxx location number ? bf35 03 830111 9f36 05 207a77c430 9f37 08 91 xxxxxxxxxxxxxx - GT of MSC(ssf) 9f39 08 xxxxxxxxxxxxxxxx - some number in unknown format (neither E.164 nor E.212) a-pty MSISDN may be alternatively coded with 9F38 tag The most tricky thing is to decode another protocol types (marked with *** above) that are not so obvious My final goal is to decode both CAP portion and amount of credit available Is there anybody who faced similar task or who can provide additional traces.. or can even make some traces? An ideal case is to perform SS7 and USAU trace in parallel. Or even has some papers on this topic Regards, Dmitri Soloviev

11 years, 7 months

[PATCH] Use generic libosmocom auth API.

by Max

--- openbsc/src/libmsc/auth.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c index 10d8edf..ed25495 100644 --- a/openbsc/src/libmsc/auth.c +++ b/openbsc/src/libmsc/auth.c @@ -24,8 +24,7 @@ #include <openbsc/debug.h> #include <openbsc/auth.h> #include <openbsc/gsm_data.h> - -#include <osmocom/gsm/comp128.h> +#include <osmocom/crypt/auth.h> #include <stdlib.h> @@ -53,6 +52,13 @@ _use_xor(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) static int _use_comp128_v1(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) { + static struct osmo_sub_auth_data auth = { + .type = OSMO_AUTH_TYPE_GSM, + .algo = OSMO_AUTH_ALG_COMP128v1 + }; + struct osmo_auth_vector _vec; + struct osmo_auth_vector *vec = &_vec; + if (ainfo->a3a8_ki_len != A38_COMP128_KEY_LEN) { LOGP(DMM, LOGL_ERROR, "Invalid COMP128v1 key (len=%d) %s\n", ainfo->a3a8_ki_len, @@ -60,9 +66,13 @@ _use_comp128_v1(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) return -1; } - comp128(ainfo->a3a8_ki, atuple->rand, atuple->sres, atuple->kc); + memcpy(auth.u.gsm.ki, ainfo->a3a8_ki, sizeof(auth.u.gsm.ki)); - return 0; + int r = osmo_auth_gen_vec(vec, &auth, atuple->rand); + memcpy(atuple->sres, vec->sres, 4); + memcpy(atuple->kc, vec->kc, 8); + + return r; } /* Return values -- 1.8.3.2 --------------060000020105010100080006--

11 years, 7 months

[PATCH] Use generic osmocom auth api instead of direct call to comp128.

by Max

--- openbsc/src/libmsc/auth.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c index 10d8edf..33d4a3a 100644 --- a/openbsc/src/libmsc/auth.c +++ b/openbsc/src/libmsc/auth.c @@ -24,8 +24,7 @@ #include <openbsc/debug.h> #include <openbsc/auth.h> #include <openbsc/gsm_data.h> - -#include <osmocom/gsm/comp128.h> +#include <osmocom/crypt/auth.h> #include <stdlib.h> @@ -60,9 +59,17 @@ _use_comp128_v1(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) return -1; } - comp128(ainfo->a3a8_ki, atuple->rand, atuple->sres, atuple->kc); - - return 0; + static struct osmo_sub_auth_data auth = { + .type = OSMO_AUTH_TYPE_GSM, + .algo = OSMO_AUTH_ALG_COMP128v1 + }; + memcpy(auth.u.gsm.ki, ainfo->a3a8_ki, sizeof(auth.u.gsm.ki)); + struct osmo_auth_vector _vec; + struct osmo_auth_vector *vec = &_vec; + int r = osmo_auth_gen_vec(vec, &auth, atuple->rand); + memcpy(atuple->sres, vec->sres, 4); + memcpy(atuple->kc, vec->kc, 8); + return r; } /* Return values -- 1.8.3.2 --------------070009030406090002040109--

11 years, 7 months

Meet us at AfricaCom

by Alexander Chemeris

Hi all, Fairwaves team is in Cape Town at AfricaCom from today to Thursday. Drop me an SMS to +7(915)330-7626 and we would be happy to arrange a meeting. Fairwaves is a complete solution provider and "just a BTS" vendor. We provide turn-key GSM networks with VoIP backhaul, as well as BTS/BSC for existing GSM networks extension. Our partnerships with the leading VoIP providers allows us to provide your subscribers with the lowest calling rates. Voice and SMS programming platform we offer, allows you to implement complex value added services simpler, than with Twilio. PS Read about the exciting project we're doing in Mexico with the Rhizomatica.org team: https://fairwaves.ru/wp/telecom-revolution-starts-in-yaviche-mexico/ -- Regards, Alexander Chemeris. CEO, Fairwaves LLC / ООО УмРадио http://fairwaves.ru

11 years, 7 months

Re: Meet us at AfricaCom

by Roelf Diedericks

I met with Alexander today at AfricaCom, and as an interested user of OsmoCOM and the proud owner of a SysmoBTS I can say that the email was certainly of interest to me. It is a very small community, and whilst commercial spamming shouldn't be allowed, I do feel that for the very small special interest group we all participate in, some relaxed attitude may be warranted. The list is currently unobtrusive and if it ever gets as busy as LKML, I'm sure we can do some benevolent dicatatoring. If it were Huawei spamming the list about the conference, then I'd agree, but the Fairwaves guys have generously opened up their hardware designs as well. I don't think it gets more open than that... Regards, Roelf.

11 years, 7 months

Signalling in OpenBSC - LCR - Asterisk

by Leonardo Nve

Has anyone experienced problems with signalling using LCR/Asterisk? In my infrastructure everything goes ok calling from MT to external phones using Asterisk, but when the external one (SIP or extension ended with Hangup() ) the call remains activated at the MT (OpenBSC side). I will make a SIP capture tomorrow, and send it. -- -- Leonardo Nve <lnve(a)s21sec.com> Project Manager ACSS Grupo S21sec Gestión, S.A. Telefono 628275870 -- La información contenida en este mail, así como los archivos adjuntos,es CONFIDENCIAL. Grupo S21sec Gestión, S.A. garantiza la adopción de las medidas necesarias para asegurar el tratamiento confidencial de los datos de carácter personal. En el caso de que el destinatario del correo no sea usted, le rogamos envíe una notificación al remitente y lo destruya de forma inmediata. La lectura y/o manipulación de esta información en la situación señalada anteriormente será considerada ilegal, permitiendo a la empresa remitente realizar acciones legales de diferente envergadura.

11 years, 7 months

[PATCH 1/3] vty: Use new vty_install_default() function

by Jacob Erlbeck

This patch removes the local 'end' and 'exit' implementations and uses the generic ones provided by libosmocore instead, which are enabled automatically when vty_install_default() is used. --- src/e1_input_vty.c | 2 ++ src/ipa_proxy.c | 26 +------------------------- 2 files changed, 3 insertions(+), 25 deletions(-) diff --git a/src/e1_input_vty.c b/src/e1_input_vty.c index b6e1438..faaebd8 100644 --- a/src/e1_input_vty.c +++ b/src/e1_input_vty.c @@ -276,6 +276,8 @@ int e1inp_vty_init(void) { install_element(CONFIG_NODE, &cfg_e1inp_cmd); install_node(&e1inp_node, e1inp_config_write); + + vty_install_default(L_E1INP_NODE); install_element(L_E1INP_NODE, &cfg_e1_line_driver_cmd); install_element(L_E1INP_NODE, &cfg_e1_line_port_cmd); install_element(L_E1INP_NODE, &cfg_e1_line_name_cmd); diff --git a/src/ipa_proxy.c b/src/ipa_proxy.c index 74cf427..a394b8c 100644 --- a/src/ipa_proxy.c +++ b/src/ipa_proxy.c @@ -644,28 +644,6 @@ static int ipa_cfg_write(struct vty *vty) return CMD_SUCCESS; } -DEFUN(ournode_exit, - ournode_exit_cmd, "exit", "Exit current mode and down to previous mode\n") -{ - switch (vty->node) { - case L_IPA_NODE: - vty->node = CONFIG_NODE; - vty->index = NULL; - break; - } - return CMD_SUCCESS; -} - -DEFUN(ournode_end, - ournode_end_cmd, "end", "End current mode and change to enable mode.\n") -{ - switch (vty->node) { - case L_IPA_NODE: - break; - } - return CMD_SUCCESS; -} - void ipa_proxy_vty_init(void) { tall_ipa_proxy_ctx = @@ -681,9 +659,7 @@ void ipa_proxy_vty_init(void) install_element(CONFIG_NODE, &ipa_cfg_cmd); install_node(&ipa_node, ipa_cfg_write); - install_default(L_IPA_NODE); - install_element(L_IPA_NODE, &ournode_exit_cmd); - install_element(L_IPA_NODE, &ournode_end_cmd); + vty_install_default(L_IPA_NODE); install_element(L_IPA_NODE, &ipa_instance_cfg_add_cmd); install_element(L_IPA_NODE, &ipa_route_cfg_add_cmd); } -- 1.7.9.5

11 years, 7 months

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC November 2013