OpenBSC November 2014

openbsc@lists.osmocom.org

6 participants
17 discussions

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

[PATCH 0/4] core/conv: Fast Viterbi decoding
by Thomas Tsou 26 Apr '16

26 Apr '16

Hi all, This patch set adds to libosmocore an optimized Viterbi decodeer for architecture specific (Intel SSE) and non-specific cases. The implementation covers codes with constraint lengths of K=5 and K=7 and rates 1/4 to 3/4, which make up the majority of GSM use cases. Speedup from the current implementation is in the range of 5 to 20 depending on the processor and code type. API is unchanged. Tested on Haswell (i7-4770K) and Atom (D2550). Additional test codes from osmo-bts are included. Further tests for AWGN bit-error-rate and benchmarks can be found in the following repository. https://github.com/ttsou/osmo-conv-test Here are some examples. Bit error test for GPRS CS2 with SNR of 5 dB and 100000 bursts. $ ./conv_test -c 2 -e -r 5 -i 100000 ================================================= [+] Testing: GPRS CS2 [.] Specs: (N=2, K=5, non-recursive, flushed, not punctured) [.] Input length : ret = 290 exp = 290 -> OK [.] Output length : ret = 588 exp = 588 -> OK [.] BER tests: [..] Testing base: [..] Input BER.......................... 0.042443 [..] Output BER......................... 0.000006 [..] Output FER......................... 0.001350 (135) [..] Testing SIMD: [..] Input BER.......................... 0.042460 [..] Output BER......................... 0.000005 [..] Output FER......................... 0.001240 (124) Timed AFS benchmark with 8 threads and 100000 bursts per thread. $ ./conv_test -b -c 10 -j 8 -i 100000 ================================================= [+] Testing: GSM TCH/AFS 6.7 [.] Specs: (N=4, K=5, recursive, flushed, punctured) [.] Input length : ret = 140 exp = 140 -> OK [.] Output length : ret = 448 exp = 448 -> OK [.] Performance benchmark: [..] Encoding / Decoding 800000 bursts on 8 thread(s): [..] Testing base: [..] Elapsed time....................... 4.320001 secs [..] Rate............................... 25.925920 Mbps [..] Testing SIMD: [..] Elapsed time....................... 0.458272 secs [..] Rate............................... 244.396341 Mbps [..] Speedup............................ 9.426718 -TT

5 13

[PATCH] Use generic auth API
by Max 01 Jun '15

01 Jun '15

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- openbsc/src/libmsc/auth.c | 69 +++++++++++++++++++---------------------------- 1 file changed, 28 insertions(+), 41 deletions(-) diff --git a/openbsc/src/libmsc/auth.c b/openbsc/src/libmsc/auth.c index 10d8edf..d04b2fc 100644 --- a/openbsc/src/libmsc/auth.c +++ b/openbsc/src/libmsc/auth.c @@ -24,47 +24,11 @@ #include <openbsc/debug.h> #include <openbsc/auth.h> #include <openbsc/gsm_data.h> - -#include <osmocom/gsm/comp128.h> +#include <osmocom/crypt/auth.h> #include <stdlib.h> -static int -_use_xor(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) -{ - int i, l = ainfo->a3a8_ki_len; - - if ((l > A38_XOR_MAX_KEY_LEN) || (l < A38_XOR_MIN_KEY_LEN)) { - LOGP(DMM, LOGL_ERROR, "Invalid XOR key (len=%d) %s\n", - ainfo->a3a8_ki_len, - osmo_hexdump(ainfo->a3a8_ki, ainfo->a3a8_ki_len)); - return -1; - } - - for (i=0; i<4; i++) - atuple->sres[i] = atuple->rand[i] ^ ainfo->a3a8_ki[i]; - for (i=4; i<12; i++) - atuple->kc[i-4] = atuple->rand[i] ^ ainfo->a3a8_ki[i]; - - return 0; -} - -static int -_use_comp128_v1(struct gsm_auth_info *ainfo, struct gsm_auth_tuple *atuple) -{ - if (ainfo->a3a8_ki_len != A38_COMP128_KEY_LEN) { - LOGP(DMM, LOGL_ERROR, "Invalid COMP128v1 key (len=%d) %s\n", - ainfo->a3a8_ki_len, - osmo_hexdump(ainfo->a3a8_ki, ainfo->a3a8_ki_len)); - return -1; - } - - comp128(ainfo->a3a8_ki, atuple->rand, atuple->sres, atuple->kc); - - return 0; -} - /* Return values * -1 -> Internal error * 0 -> Not available @@ -76,6 +40,11 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, { struct gsm_auth_info ainfo; int i, rc; + static struct osmo_sub_auth_data auth = { + .type = OSMO_AUTH_TYPE_GSM + }; + struct osmo_auth_vector _vec; + struct osmo_auth_vector *vec = &_vec; /* Get subscriber info (if any) */ rc = db_get_authinfo_for_subscr(&ainfo, subscr); @@ -109,13 +78,23 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, return 0; case AUTH_ALGO_XOR: - if (_use_xor(&ainfo, atuple)) - return 0; + auth.algo = OSMO_AUTH_ALG_XOR; + if ((ainfo.a3a8_ki_len > A38_XOR_MAX_KEY_LEN) || (ainfo.a3a8_ki_len < A38_XOR_MIN_KEY_LEN)) { + LOGP(DMM, LOGL_ERROR, "Invalid XOR key (len=%d) %s\n", + ainfo.a3a8_ki_len, + osmo_hexdump(ainfo.a3a8_ki, ainfo.a3a8_ki_len)); + return -1; + } break; case AUTH_ALGO_COMP128v1: - if (_use_comp128_v1(&ainfo, atuple)) - return 0; + auth.algo = OSMO_AUTH_ALG_COMP128v1; + if (ainfo.a3a8_ki_len != A38_COMP128_KEY_LEN) { + LOGP(DMM, LOGL_ERROR, "Invalid COMP128v1 key (len=%d) %s\n", + ainfo.a3a8_ki_len, + osmo_hexdump(ainfo.a3a8_ki, ainfo.a3a8_ki_len)); + return -1; + } break; default: @@ -124,6 +103,14 @@ int auth_get_tuple_for_subscr(struct gsm_auth_tuple *atuple, return 0; } + memcpy(auth.u.gsm.ki, ainfo.a3a8_ki, sizeof(auth.u.gsm.ki)); + + if (osmo_auth_gen_vec(vec, &auth, atuple->rand) < 0) + return -1; + + memcpy(atuple->sres, vec->sres, 4); + memcpy(atuple->kc, vec->kc, 8); + db_sync_lastauthtuple_for_subscr(atuple, subscr); DEBUGP(DMM, "Need to do authentication and ciphering\n"); -- 1.9.1

3 3

recurring issue with OpenBSC
by Ciaby 06 Apr '15

06 Apr '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi! First a small update: we finally decided to _not_ use token mode, as it confuses a lot of phones, after receiving the token message the SIM goes into an error state and the only way to recover is to reboot the phone. Now we just read the IMSI straight from the SIM (using the card python library, just like osmo-sim-auth does) and register them. Now, the issue we see is that 1-2 users every day reach a point where they can make phone calls and send messages, but they can't receive neither of them. Sometimes the problem can be fixed by running: > subscriber extension <EXT> clear-requests but this only work when there are pending requests. In other cases, the phone has to be rebooted. Did anyone encounter the same issue? Cheers Ciaby -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUef1WAAoJEPU83OtbD4fQ69kQAI7peg30lHwbDPMXnTX80gUu 0dGsiK2iB5oWZ6Ohbs3W+/+xVoMseuG1di6Rk0XT9buN2IOR5fMfAs3INQ2EuAlV qz1RRn5Ux8uV0RJWyAJoSt7eFh3gbnDgsJ+x8SXEHQRw4rYHG2P+HXyEtncW6A6y L8/oPeIxH/LlP/55MP3KUY5BnQmN658LnJU9AFSwPkpjn2f/dj4o6mUdWo8haTTQ UWPWEdhQoeXPBqHsn2cKamT13SmiepMYAGuDEJci9LCS+J8vd70ukAP/oa1L6u1w +3+RbcNvC9fwAKDLU01b/cu630v6/mhk0lxWNlIz/kNL1aHPZe8QhP5sM4SuLtzj UaeHLxp4u2Pb7N31b3qtRA4jgl+5YFla5376F3d00jPSfZpmFggFgdRB2qWhF1m8 WucfzLc41dV1AVTdL90ISSRt1LZ/fLHBea8kgUxK+KrhBO7U7AV3PXk9of4EAf7y VKMX3KZWwtEKhpi0v3PihgW8bS/RaG3zEmsr30QXzXVaZknCfjGi8OOOB0JaHY48 o3g40YpzeyEq1gOyKKfBmtf1qk4GgLyPKfMUoTvXE2oNHmrg3ZlJldABKNzR9qz3 5hsHJ6/QGsBST1E3dphI0Zb6ubLnFwqBl02GyeJELLbtPCLPQMDicx03cqT4BjO3 vzDcPdIWg1sfSomYKMK9 =Zw4T -----END PGP SIGNATURE-----

2 7

Final review of L1SAP ported to current maste
by Harald Welte 25 Mar '15

25 Mar '15

Dear all, the valuable L1SAP abstraction has been sitting out of master for too long time. It is a pity that this has taken so long. I've finally been able to put some time into osmo-bts again and reviewed the following patch series. It consists of mostly Andreas' work, interspersed with smaller patches/fixups that I introduced after the respective original patch from Andreas. I have started a sysmobts between all of the major steps in this patch series and did a short manual tests involving registration (LU) of two MS, mobile-to-mobile call and vty-to-mobile SMS. So far I couldn't see any problems. What has not been tested yet is the PCU interface as well as encryption support. I plan to do this later this week. I intend to merge the code after this current review cycle. Please take your time to have a look and provide feedback (if any), so we can get this over and work on new features again, rather than infrastrutural changes. I didn't yet rebase the osmo-bts-trx interface on top of the L1SAP, as I don't have a hardware setup for it, and I will leave it to the owners of such hardware to publish/push the respective code after L1SAP is merged. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

3 43

Announcing new gr-gsm project
by Perper 30 Nov '14

30 Nov '14

Dear all, Sorry for spamming here but I thought there is possibility that you might be interested. I was working for some time on a project of a set of GNU Radio tools for receiving GSM transmissions. As the project reached the point where it might be useful for the community I have decided to officially announce it. It is available on github with short installation and usage guides: https://github.com/ptrkrysik Currently there is one gr-gsm application that should work out of the box and it is a more reliable replacement of Airprobe. The gr-gsm has some similarities with it. The GSM receiver that I used is considerably corrected version of the receiver that I've long time ago written for the Airprobe project but with removed Airprobe's stuff that shouldn't be in my opinion mixed with the receiver (like decryption, decoding). However the goal of the project is broader than that and it is to provide a set of tools for people interested in processing of GSM signal in GNU Radio. For example - another possible applications of gr-gsm are GSM network monitor or frequency offset calibrator. For people who want to see the application in action without installing it I've prepared a short video presentation: https://www.youtube.com/watch?v=Eofnb7zr8QE&feature=youtu.be If anyone is interested in developing something for/with use of the project I can provide help and information about the project's internals by e-mail. -- Best Regards, Piotr Krysik

1 0

GPRS attach
by ramesh shankar 28 Nov '14

28 Nov '14

Hello Getting error on implementation of gprs cannot handle GMM for unknown MM CTX MS identity cannot be derived by the network can somebody suggest why and what can I do to fix it. log file for sgsn. <0010> gprs_ns.c:199 NSVCI=65534 Creating NS-VC <0010> gprs_ns.c:199 NSVCI=65535 Creating NS-VC <0010> gprs_ns.c:1200 Creating NS-VC for BSS at 192.168.2.12:23000 <0010> gprs_ns.c:774 NSVCI=65535(invalid) Rx NS RESET (NSEI=101, NSVCI=101, cause=O&M intervention) <0010> gprs_ns.c:594 NSEI=101 Tx NS RESET ACK (NSVCI=101) <0010> gprs_ns.c:512 NSEI=101 Starting timer in mode tns-test (30 seconds) <0010> gprs_ns.c:512 NSEI=101 Starting timer in mode tns-test (30 seconds) <0010> gprs_ns.c:1281 NSEI=101 Rx NS UNBLOCK <0011> gprs_bssgp.c:249 BSSGP BVCI=0 Rx RESET cause=Transmission capacity modified <0011> gprs_bssgp.c:344 BSSGP BVCI=2 Rx BVC-UNBLOCK <0011> gprs_bssgp_util.c:103 BSSGP BVCI=2 Tx STATUS, cause=Unknown BVCI <0011> gprs_bssgp.c:249 BSSGP BVCI=2 Rx RESET cause=O&M intervention <0011> gprs_bssgp.c:272 Cell 302-720-7-0 CI 8 on BVCI 2 <0011> gprs_bssgp.c:344 BSSGP BVCI=2 Rx BVC-UNBLOCK <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:790 BSS instructs us to MS default bucket leak rate != 0, restarting DL GPRS! <0011> gprs_bssgp.c:376 BSSGP TLLI=0xb4c2fd41 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0x7439ebCMD=UI DATA <0012> gprs_llc.c:95 TLLI 0xb4c2fd41 is foreign, converting to local TLLI 0xf4c2fd41 <0012> gprs_llc.c:95 TLLI 0xb4c2fd41 is foreign, converting to local TLLI 0xf4c2fd41 <0012> gprs_llc.c:254 LLC RX: unknown TLLI 0xb4c2fd41, creating LLME on the fly <0002> gprs_gmm.c:924 -> GMM RA UPDATE REQUEST type="RA updating" LLC XID RESET REJECT <0002> gprs_gmm.c:861 <- ROUTING AREA UPDATE REJECT <0012> gprs_llc.c:95 TLLI 0xb4c2fd41 is foreign, converting to local TLLI 0xf4c2fd41 <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:376 BSSGP TLLI=0xb4c2fd41 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0x9ab10aCMD=UI DATA <0012> gprs_llc.c:95 TLLI 0xb4c2fd41 is foreign, converting to local TLLI 0xf4c2fd41 <0012> gprs_llc.c:241 LLC RX: Found a local entry for TLLI 0xb4c2fd41 <0012> gprs_llc.c:615 TLLI=f4c2fd41 dropping UI, N(U=0) not in window V(URV(UR:3). <0010> gprs_ns.c:530 NSEI=101 Timer expired in mode tns-test (30 seconds) <0010> gprs_ns.c:473 NSEI=101 Tx NS ALIVE (NSVCI=101) <0010> gprs_ns.c:512 NSEI=101 Starting timer in mode tns-alive (10 seconds) <0010> gprs_ns.c:486 NSEI=101 Tx NS ALIVE_ACK (NSVCI=101) <0010> gprs_ns.c:512 NSEI=101 Starting timer in mode tns-test (30 seconds) <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:376 BSSGP TLLI=0x9ec3b021 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0x79a5b6CMD=UI DATA <0012> gprs_llc.c:95 TLLI 0x9ec3b021 is foreign, converting to local TLLI 0xdec3b021 <0012> gprs_llc.c:95 TLLI 0x9ec3b021 is foreign, converting to local TLLI 0xdec3b021 <0012> gprs_llc.c:254 LLC RX: unknown TLLI 0x9ec3b021, creating LLME on the fly <0002> gprs_gmm.c:924 -> GMM RA UPDATE REQUEST type="RA updating" LLC XID RESET REJECT <0002> gprs_gmm.c:861 <- ROUTING AREA UPDATE REJECT <0012> gprs_llc.c:95 TLLI 0x9ec3b021 is foreign, converting to local TLLI 0xdec3b021 <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:376 BSSGP TLLI=0x7b549435 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0xd1bcf4CMD=UI DATA <0012> gprs_llc.c:254 LLC RX: unknown TLLI 0x7b549435, creating LLME on the fly <0002> gprs_gmm.c:640 -> GMM ATTACH REQUEST MI(302720xxxxxxxxx) type="GPRS attach" <0002> gprs_gmm.c:444 <- GPRS IDENTITY REQUEST: mi_type=02 <0011> gprs_bssgp.c:376 BSSGP TLLI=0x7b549435 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0x4567cfCMD=UI DATA <0002> gprs_gmm.c:1033 Cannot handle GMM for unknown MM CTX <0002> gprs_gmm.c:277 <- GPRS MM STATUS (cause: MS identity cannot be derived by the network) <0011> gprs_bssgp.c:753 BSSGP BVCI=2 Rx Flow Control BVC <0011> gprs_bssgp.c:376 BSSGP TLLI=0x9ec20d01 Rx UPLINK-UNITDATA <0012> gprs_llc.c:568 LLC SAPI=1 C FCS=0x365438CMD=UI DATA <0012> gprs_llc.c:95 TLLI 0x9ec20d01 is foreign, converting to local TLLI 0xdec20d01 <0012> gprs_llc.c:95 TLLI 0x9ec20d01 is foreign, converting to local TLLI 0xdec20d01 <0012> gprs_llc.c:254 LLC RX: unknown TLLI 0x9ec20d01, creating LLME on the fly <0002> gprs_gmm.c:924 -> GMM RA UPDATE REQUEST type="RA updating" LLC XID RESET REJECT <0002> gprs_gmm.c:861 <- ROUTING AREA UPDATE REJECT ramesh

1 0

Problems with token mode
by Ciaby 21 Nov '14

21 Nov '14

Hi, It's me again :) We deployed the first installation with token mode, and we're running into a quite nasty issue: osmo-nitb does its job for a while, but then it goes to 100% cpu and it has to be killed. This doesn't happen in the lab, obviously, but it's happening in a village of about 10.000 people. Any clue? past experiences? Thanks! Ciaby

2 3

[PATCH] vty: Check with the application before writing the config
by Holger Hans Peter Freyther 21 Nov '14

21 Nov '14

From: Holger Hans Peter Freyther <holger(a)moiji-mobile.com> For the BSC/NITB application we see that people modify the band without modifying the ARFCN. This creates an unbootable config. Using the new hook the BSC/NITB can check if the config is consistent and prevent the config file being written. Related: SYS#739 --- TODO-RELEASE | 1 + include/osmocom/vty/vty.h | 2 ++ src/vty/command.c | 9 +++++++++ 3 files changed, 12 insertions(+) diff --git a/TODO-RELEASE b/TODO-RELEASE index 72a27a4..290fb0e 100644 --- a/TODO-RELEASE +++ b/TODO-RELEASE @@ -1,2 +1,3 @@ #library what description / commit summary line libosmocore abi-change logging: Add ability to save/print current log filters +libosmovty abi-change vty: Check with the application before writing the config diff --git a/include/osmocom/vty/vty.h b/include/osmocom/vty/vty.h index ea02e4a..1dcc230 100644 --- a/include/osmocom/vty/vty.h +++ b/include/osmocom/vty/vty.h @@ -159,6 +159,8 @@ struct vty_app_info { enum node_type (*go_parent_cb)(struct vty *vty); /*! \brief call-back to determine if node is config node */ int (*is_config_node)(struct vty *vty, int node); + /*! \brief Check if the config is consistent before write */ + int (*config_is_consistent)(struct vty *vty); }; /* Prototypes. */ diff --git a/src/vty/command.c b/src/vty/command.c index 44a1b6c..3ff5f77 100644 --- a/src/vty/command.c +++ b/src/vty/command.c @@ -2497,6 +2497,15 @@ DEFUN(config_write_file, char *failed_file; int rc; + if (host.app_info->config_is_consistent) { + rc = host.app_info->config_is_consistent(vty); + if (!rc) { + vty_out(vty, "Configuration is not consistent%s", + VTY_NEWLINE); + return CMD_WARNING; + } + } + if (host.config == NULL) { vty_out(vty, "Can't save to configuration file, using vtysh.%s", VTY_NEWLINE); -- 2.1.3

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC November 2014