OpenBSC August 2013

openbsc@lists.osmocom.org

26 participants
50 discussions

Picocell EDGE Omnicell@Work - Nokia/RadioFrame Networks, Inc.
by Luca Bongiorni 04 Aug '13

04 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey folks, I have just received this new piece of hardware and I wanted to share some preliminary info about it. As far as I noticed, the picocell was used by Orange UK some years ago. As you will see from the photos below the board has different populated pins, which one of them seems a 14-pin JTAG connector. (I apologise for the low quality of the images, but at the moment is the best I can do) At the moment I am unable to fully test it cause logic analyzer, jtag and uart connectors are physically not with me. In the meanwhile I will get them, I was wondering if someone of you guys already had the opportunity to play with it. Or have more info/specs/etc. about it. - ------------------------------------- IC PRIXPH425BT (Intel): - ------------------------------------- http://media.digikey.com/pdf/Data%20Sheets/Intel%20PDFs/IXP42X,%20IXC1100.p… http://media.digikey.com/pdf/Data%20Sheets/Intel%20PDFs/IXP42X,%20IXC1100%2… - ------------------------------------- PHOTOS - ------------------------------------- http://imageshack.us/a/img856/5395/d0xt.jpg http://imageshack.us/a/img266/8011/x64h.jpg http://imageshack.us/a/img801/9504/0zir.jpg http://imageshack.us/a/img839/4488/sq4r.jpg - ------------------------------------- NMAP SCAN - ------------------------------------- These are the ports available on the LAN side: PORT STATE SERVICE VERSION 22/tcp open ssh Dropbear sshd 0.47 (protocol 2.0) 23/tcp open telnet NASLite-SMB/Sveasoft Alchemy firmware telnetd 53/tcp open domain dnsmasq 2.31 80/tcp open http Boa HTTPd 0.93.15 443/tcp open ssl/http Boa HTTPd 0.93.15 I have already tried a known vuln for Boa HTTPd 0.93.15 to bypass auth, but since the webapp is customized, that flaw is no longer available. At the moment I am trying to bruteforce ssh/telnet, but I guess it would not get any result. Overall, while continuing to disassemble and test it, If someone have some hints or material to share, is welcome. Cheers, Luca -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJR/izEAAoJEPLE1Qsi6ZiTOBYP+wTEeqOYpUxULV24dF8FBu/W ZwL18Dw8zZAp2AEn7C4bGbajH/OAmrTz0Ae0a/jiZCxDEtN7MlF82+9cy8aQvQh/ xMeA3BiA9HlmDKJJO3fsCBoUNXXLIMt4/8F779qPtE2kNRGCkwafVkID93kU2qtA KGUsLeXHZyOzTbxtvwzxwQmAAyna3I2Z4jLzj3O61fpElR2CwFLSokcAqfYp1wNL gw/ofYZhBISqsCn403DMRcZTrfiO8YuqG0I3gdOtrrI2u2UPW3U6OGgtNi3Lz0Gn vLCeS5PMjrhdDKGGEd0IJRZu20QWKJVHUeksQ+fVI6o28TQ84bmvkohkuE8mhzYA rVPzva9+QJbGCHce0+UX3mSjtNl4Tsr1qJ6+useqQaa0KmHLR5SRMEBRAdvMAVQ7 5cgetujabmwyzeNtZECIxZlLmpfscm2ckiSYvnnH4gM3xhS0FZ6i3a5zSCdzCNHT RqFOlBLAUHopS9p5AoAQP5nWqK+xuj3iVWGq++pk6Q/aK7kvMNtlAIpQNhcDN236 9iHloZfeW/eIIBVhtNe6NEuAt4ry8hbeiuGjzJtAR+WAR/PwCtgdEQdOZnLD2LWV FhVNsGySrVvP63gZqhhsW8sUpP8IUaTzoKBgyZ7+fLDoRdqKFVcs+xhqzIfV5dm8 YumNguOR7GwCcAGgBW8g =d+QM -----END PGP SIGNATURE-----

1 0

Re: Osmo-nitb v_0.13.0.48-9e22 broke compatibility with Nokia
by Sipos Csaba 02 Aug '13

02 Aug '13

Hi Peter, > Ok. Do you have a later message from the following line? > LOGP(DLLAPD, LOGL_INFO, "I received in state %s\n", lapd_state_names[dl->state]); Sure, this is how it looks with all relevant debugging enabled: Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:1465 I received in state LAPD_STATE_MF_EST Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:1548 incrementing V(R) to 1 Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:222 stop T203 Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:206 start T203 Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:1557 message in single I frame Fri Aug 2 16:50:13 2013 <001b> e1_input.c:594 RX: 80 80 00 08 81 00 00 01 5f 23 01 01 sapi=62 tei=1 Fri Aug 2 16:50:13 2013 <0005> bts_nokia_site.c:1668 Nokia: Abis received! Fri Aug 2 16:50:13 2013 <0005> bts_nokia_site.c:1688 ABIS_OM_MDISC_FOM Fri Aug 2 16:50:13 2013 <0005> bts_nokia_site.c:1515 (0x81) NOKIA_BTS_ACK Fri Aug 2 16:50:13 2013 <0005> bts_nokia_site.c:1547 ACK = 1 Fri Aug 2 16:50:13 2013 <0005> bts_nokia_site.c:1588 Nokia: STOP OML & RSL lapd (cause: RESET) Fri Aug 2 16:50:13 2013 <0018> input/lapd.c:513 LAPD DL-RELEASE request TEI=1 SAPI=62 Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:2183 Message DL-RELEASE-REQUEST received in state LAPD_STATE_MF_EST Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:2024 perform local release Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:229 new state LAPD_STATE_MF_EST -> LAPD_STATE_IDLE Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:222 stop T203 Fri Aug 2 16:50:13 2013 <0018> input/lapd.c:628 LAPD DL-RELEASE confirm TEI=1 SAPI=62 Fri Aug 2 16:50:13 2013 <001b> e1_input.c:585 DL_REL: sapi(62) tei(1) Fri Aug 2 16:50:13 2013 <001b> bsc_init.c:318 Lost some E1 TEI link: 1 0x887f038 Fri Aug 2 16:50:13 2013 <0018> lapd_core.c:1781 lapd_send_i() called from line 1615 Segmentation fault (core dumped) bsc_init.c probably complaining because the LAPD connection is closed, but the OML context does not. Maybe this is the root cause of the problem: if the OML context not disconnected with the LAPD connection, it still listens on the OML timeslot and if something got received, it tries to process it. But still: this is not how it should work. The OML context is not closed, because we are waiting for the already resetting BTS, then the OML lapd got restarted again (after the RESET_TIMER expired). My opinion is that after we closed the lapd connection, it should not reactivate itself, if data appears on the OML TS. BR, Csaba

1 0

IMEI in HLR
by Ash Gibbons 02 Aug '13

02 Aug '13

Not really, if I have a temporary subscriber coming onto the network, I would like to be able just to use their IMEI instead of going through the trouble of getting their IMSI.

1 0

IMEI in HLR
by Ash Gibbons 02 Aug '13

02 Aug '13

T hats a shame. Reading http://openbsc.osmocom.org/trac/wiki/osmo-nitb it states; " We obtain the IMSI and IMEI of every LOCATION UPDATING REQUEST, and then if neccessary create a new entry for the equipment as well as the subscribers in the respective tables. " Is there a specific table that all rejected handsets go into or a mixture of Equipment, EquipmentWatch, Meta and Subcriber? Many thanks,

1 0

IMEI in HLR
by Ash Gibbons 02 Aug '13

02 Aug '13

Is there a way to add subscribers by just using their IMEI, this is a lot easier to obtain the the IMSI. I can see there is and Equipment and EquipmentWatch table in hlr.sqlite in the Osmo-NITB folder, but there is no Authorised field like in the Subscribers table. Many thanks,

2 1

Re: Osmo-nitb v_0.13.0.48-9e22 broke compatibility with Nokia InSite
by Sipos Csaba 01 Aug '13

01 Aug '13

Hi Holger, I was able to narrow it down, and it seems this is the patch that causing the problem: http://cgit.osmocom.org/libosmocore/commit/?id=f5a079f739c57d8be7c59149fd45… Up to that patch it works (more or less), but after I applied it, I got this seg faults. I don't know how to do back traces but I try to get some info about this topic and will send the results. Csaba

3 12

Adding SDR Drivers
by Ash Gibbons 01 Aug '13

01 Aug '13

Hello, I am wonder how to add support for other Transceivers, in particular the BladeRF ( http://nuand.com/ ). If anyone has a start point for me to learn how to do this, it would be fantastic! Many thanks

2 1

Re: SGSN Crash Report
by Holger Hans Peter Freyther 01 Aug '13

01 Aug '13

On Tue, Jul 02, 2013 at 11:51:49PM -0700, Caleb Pal wrote: > Holger, Hi, I have a reliable re-producer of the issue. It happens when the PCU is dead and we still receive segmented data from the GGSN. The re-producer is inside a branch of mine of the OsmoPCU code[1]. The commit message has some information about how to re-produce (what is missing is the ACL config of the SGSN to allow this test). Maybe you want to try to fix the issue based on this setup? kind regards holger [1] http://git.osmocom.org/osmo-pcu/commit/?h=zecke/features/emulator&id=a727a2…

2 3

[PATCH] SNDCP: don't msgb_free() if gprs_llc_tx_ui() fails.
by Harald Welte 01 Aug '13

01 Aug '13

the gprs_llc_tx_ui() will call down to BSSGP/NS, which in turn will call msgb_free() themselves in their error path, so the msgb is already freed at that time. As discussed on the mailing list quite some time ago, msgb ownership policy/rules and implementation need to be more clearly defined, and this definition adopted in the implementation. Thanks to Holger for reproducing this. --- openbsc/src/gprs/gprs_sndcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openbsc/src/gprs/gprs_sndcp.c b/openbsc/src/gprs/gprs_sndcp.c index 853f8db..6564ffb 100644 --- a/openbsc/src/gprs/gprs_sndcp.c +++ b/openbsc/src/gprs/gprs_sndcp.c @@ -420,7 +420,8 @@ static int sndcp_send_ud_frag(struct sndcp_frag_state *fs) rc = gprs_llc_tx_ui(fmsg, lle->sapi, 0, fs->mmcontext); if (rc < 0) { /* abort in case of error, do not advance frag_nr / next_byte */ - msgb_free(fmsg); + /* do not msgb_free() here, as the lower layer is doing + * that if an actual transmission error occurs */ return rc; } -- 1.8.3.2 -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

help needed to configure osmo-bsc (MGCP)
by Dmitri Soloviev 31 Jul '13

31 Jul '13

hi Harald, I'm running OpenBSC in BSC-only mode, where my A-interface gateway substitutes an MSC (soft switch) to BSC. On the other side, A-interface gateway has a legacy BSSAP/e1 connectivity. OpenBSC configuration file is derived from doc/examples/osmo-bsc/osmo-bsc.cfg everything is fine with control over sccp/ip, but MGCP gateway port (2427) is not binded to a public ip. so, my questions are - in which way media control is assumed to be performed? - how this control is reflected in osmo-bsc.cfg in fact, I'm expecting osmo-BSC to run exactly as the BSC from ip.access, that establishes SCCP/ip link and accepts MGCP commands from a soft switch Thank you, Dmitri

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC August 2013