OpenBSC May 2014

openbsc@lists.osmocom.org

19 participants
43 discussions

[openbsc 1/2] rtp_proxy: Prevent out-of-bounds read in rtcp_sdes_cname_mangle

by Daniel Willmann

In rtcp_sdes_cname_mangle when skipping over additional zeroes at the end of a chunk we should not read past the actual message (rtcp_end). Fixes CID #1206579 --- openbsc/src/libtrau/rtp_proxy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openbsc/src/libtrau/rtp_proxy.c b/openbsc/src/libtrau/rtp_proxy.c index 122daf2..1567323 100644 --- a/openbsc/src/libtrau/rtp_proxy.c +++ b/openbsc/src/libtrau/rtp_proxy.c @@ -374,7 +374,7 @@ static int rtcp_sdes_cname_mangle(struct msgb *msg, struct rtcp_hdr *rh, tag = *cur++; if (tag == 0) { /* end of chunk, skip additional zero */ - while (*cur++ == 0) { } + while ((*cur++ == 0) && (cur < rtcp_end)) { } break; } len = *cur++; -- 1.8.4.2

11 years, 1 month

[osmo-bts PATCH 2/2] oml: Allow to send ACK/NACK message through a different socket.

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> This patch, I have done something for reach my goal. I have changed the function oml_fom_ack_nack for returning the ACK/NACK message that we have created. Later I have splited the function send_oml_msg in two different function. One for send the oml messages with abis (send_oml_msg) and another for append the fom header in the message. Before of that we always add the fom before of send the message with Abis always. Later I have modified the code for using the new functions. Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- include/osmo-bts/oml.h | 4 +- src/common/oml.c | 103 ++++++++++++++++++++++++++++++---------------- src/osmo-bts-sysmo/oml.c | 2 +- 3 files changed, 70 insertions(+), 39 deletions(-) diff --git a/include/osmo-bts/oml.h b/include/osmo-bts/oml.h index 4281fd3..1e697d6 100644 --- a/include/osmo-bts/oml.h +++ b/include/osmo-bts/oml.h @@ -5,7 +5,7 @@ int oml_init(void); int down_oml(struct gsm_bts *bts, struct msgb *msg); struct msgb *oml_msgb_alloc(void); -int oml_send_msg(struct msgb *msg, int is_mauf); +int oml_send_msg(struct msgb *msg); int oml_mo_send_msg(struct gsm_abis_mo *mo, struct msgb *msg, uint8_t msg_type); int oml_mo_opstart_ack(struct gsm_abis_mo *mo); int oml_mo_opstart_nack(struct gsm_abis_mo *mo, uint8_t nack_cause); @@ -27,7 +27,7 @@ int oml_tx_state_changed(struct gsm_abis_mo *mo); int oml_mo_tx_sw_act_rep(struct gsm_abis_mo *mo); -int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause); +struct msgb *oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause); int oml_mo_fom_ack_nack(struct gsm_abis_mo *mo, uint8_t orig_msg_type, uint8_t cause); diff --git a/src/common/oml.c b/src/common/oml.c index 42e4e80..ba3323b 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -160,7 +160,7 @@ struct msgb *oml_msgb_alloc(void) return msgb_alloc_headroom(1024, 128, "OML"); } -int oml_send_msg(struct msgb *msg, int is_manuf) +void oml_append_fom_hdr(struct msgb *msg, int is_manuf) { struct abis_om_hdr *omh; @@ -175,7 +175,10 @@ int oml_send_msg(struct msgb *msg, int is_manuf) omh->length = msgb_l3len(msg); msg->l2h = (uint8_t *)omh; +} +int oml_send_msg(struct msgb *msg) +{ return abis_oml_sendmsg(msg); } @@ -192,7 +195,9 @@ int oml_mo_send_msg(struct gsm_abis_mo *mo, struct msgb *msg, uint8_t msg_type) /* FIXME: This assumption may not always be correct */ msg->trx = mo->bts->c0; - return oml_send_msg(msg, 0); + oml_append_fom_hdr(msg, 0); + + return oml_send_msg(msg); } /* FIXME: move to gsm_data_shared */ @@ -308,7 +313,7 @@ int oml_mo_opstart_nack(struct gsm_abis_mo *mo, uint8_t nack_cause) return oml_mo_fom_ack_nack(mo, NM_MT_OPSTART, nack_cause); } -int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) +struct msgb *oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) { struct abis_om_hdr *old_oh = msgb_l2(old_msg); struct abis_om_fom_hdr *old_foh = msgb_l3(old_msg); @@ -318,8 +323,10 @@ int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) uint8_t *manuf; msg = oml_msgb_alloc(); - if (!msg) - return -ENOMEM; + if (!msg) { + LOGP(DOML, LOGL_ERROR, "Creating oml ACK/NACK msg.\n"); + return NULL; + } /* make sure to respond with MANUF if request was MANUF */ if (old_oh->mdisc == ABIS_OM_MDISC_MANUF) @@ -357,12 +364,15 @@ int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) manuf[0] = sizeof(ipaccess_magic); memcpy(manuf+1, ipaccess_magic, sizeof(ipaccess_magic)); } else { + msgb_free(msg); LOGP(DOML, LOGL_ERROR, "Unknown manufacturer label.\n"); - return -1; + return NULL; } } - return oml_send_msg(msg, is_manuf); + oml_append_fom_hdr(msg, is_manuf); + + return msg; } /* @@ -420,7 +430,8 @@ static int oml_rx_set_bts_attr(struct gsm_bts *bts, struct msgb *msg) rc = oml_tlv_parse(&tp, foh->data, msgb_l3len(msg) - sizeof(*foh)); if (rc < 0) - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); /* Test for globally unsupported stuff here */ if (TLVP_PRESENT(&tp, NM_ATT_BCCH_ARFCN)) { @@ -433,12 +444,14 @@ static int oml_rx_set_bts_attr(struct gsm_bts *bts, struct msgb *msg) if (arfcn > 1024) { LOGP(DOML, LOGL_NOTICE, "Given ARFCN %d is not supported.\n", arfcn); - return oml_fom_ack_nack(msg, NM_NACK_FREQ_NOTAVAIL); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_FREQ_NOTAVAIL)); } } /* 9.4.52 Starting Time */ if (TLVP_PRESENT(&tp, NM_ATT_START_TIME)) { - return oml_fom_ack_nack(msg, NM_NACK_SPEC_IMPL_NOTSUPP); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_SPEC_IMPL_NOTSUPP)); } /* merge existing BTS attributes with new attributes */ @@ -449,7 +462,7 @@ static int oml_rx_set_bts_attr(struct gsm_bts *bts, struct msgb *msg) rc = bts_model_check_oml(bts, foh->msg_type, bts->mo.nm_attr, tp_merged, bts); if (rc < 0) { talloc_free(tp_merged); - return oml_fom_ack_nack(msg, -rc); + return oml_send_msg(oml_fom_ack_nack(msg, -rc)); } /* Success: replace old BTS attributes with new */ @@ -479,7 +492,8 @@ static int oml_rx_set_bts_attr(struct gsm_bts *bts, struct msgb *msg) LOGP(DOML, LOGL_NOTICE, "Given Conn. Failure Criterion " "not supported. Please use critetion 0x01 with " "RADIO_LINK_TIMEOUT value of 4..64\n"); - return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_PARAM_RANGE)); } btsb->radio_link_timeout = val[1]; } @@ -527,7 +541,8 @@ static int oml_rx_set_bts_attr(struct gsm_bts *bts, struct msgb *msg) if (t3105 == 0) { LOGP(DOML, LOGL_NOTICE, "T3105 must have a value != 0.\n"); - return oml_fom_ack_nack(msg, NM_NACK_PARAM_RANGE); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_PARAM_RANGE)); } btsb->t3105_ms = t3105 * 10; } @@ -560,7 +575,8 @@ static int oml_rx_set_radio_attr(struct gsm_bts_trx *trx, struct msgb *msg) rc = oml_tlv_parse(&tp, foh->data, msgb_l3len(msg) - sizeof(*foh)); if (rc < 0) - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); /* merge existing BTS attributes with new attributes */ tp_merged = tlvp_copy(trx->mo.nm_attr, trx->bts); @@ -570,7 +586,7 @@ static int oml_rx_set_radio_attr(struct gsm_bts_trx *trx, struct msgb *msg) rc = bts_model_check_oml(trx->bts, foh->msg_type, trx->mo.nm_attr, tp_merged, trx); if (rc < 0) { talloc_free(tp_merged); - return oml_fom_ack_nack(msg, -rc); + return oml_send_msg(oml_fom_ack_nack(msg, -rc)); } /* Success: replace old BTS attributes with new */ @@ -666,19 +682,22 @@ static int oml_rx_set_chan_attr(struct gsm_bts_trx_ts *ts, struct msgb *msg) rc = oml_tlv_parse(&tp, foh->data, msgb_l3len(msg) - sizeof(*foh)); if (rc < 0) - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); /* 9.4.21 HSN... */ /* 9.4.27 MAIO */ if (TLVP_PRESENT(&tp, NM_ATT_HSN) || TLVP_PRESENT(&tp, NM_ATT_MAIO)) { LOGP(DOML, LOGL_NOTICE, "SET CHAN ATTR: Frequency hopping not supported.\n"); - return oml_fom_ack_nack(msg, NM_NACK_SPEC_IMPL_NOTSUPP); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_SPEC_IMPL_NOTSUPP)); } /* 9.4.52 Starting Time */ if (TLVP_PRESENT(&tp, NM_ATT_START_TIME)) { LOGP(DOML, LOGL_NOTICE, "SET CHAN ATTR: Starting time not supported.\n"); - return oml_fom_ack_nack(msg, NM_NACK_SPEC_IMPL_NOTSUPP); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_SPEC_IMPL_NOTSUPP)); } /* merge existing BTS attributes with new attributes */ @@ -690,7 +709,7 @@ static int oml_rx_set_chan_attr(struct gsm_bts_trx_ts *ts, struct msgb *msg) if (rc < 0) { talloc_free(tp_merged); /* Send NACK */ - return oml_fom_ack_nack(msg, -rc); + return oml_send_msg(oml_fom_ack_nack(msg, -rc)); } /* Success: replace old BTS attributes with new */ @@ -734,7 +753,8 @@ static int oml_rx_opstart(struct gsm_bts *bts, struct msgb *msg) mo = gsm_objclass2mo(bts, foh->obj_class, &foh->obj_inst); obj = gsm_objclass2obj(bts, foh->obj_class, &foh->obj_inst); if (!mo || !obj) - return oml_fom_ack_nack(msg, NM_NACK_OBJINST_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_OBJINST_UNKN)); /* Step 2: Do some global dependency/consistency checking */ if (mo->nm_state.operational == NM_OPSTATE_ENABLED) { @@ -761,12 +781,14 @@ static int oml_rx_chg_adm_state(struct gsm_bts *bts, struct msgb *msg) rc = oml_tlv_parse(&tp, foh->data, msgb_l3len(msg) - sizeof(*foh)); if (rc < 0) { LOGP(DOML, LOGL_ERROR, "Rx CHG ADM STATE: error during TLV parse\n"); - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); } if (!TLVP_PRESENT(&tp, NM_ATT_ADM_STATE)) { LOGP(DOML, LOGL_ERROR, "Rx CHG ADM STATE: no ADM state attribute\n"); - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); } adm_state = *TLVP_VAL(&tp, NM_ATT_ADM_STATE); @@ -775,7 +797,8 @@ static int oml_rx_chg_adm_state(struct gsm_bts *bts, struct msgb *msg) mo = gsm_objclass2mo(bts, foh->obj_class, &foh->obj_inst); obj = gsm_objclass2obj(bts, foh->obj_class, &foh->obj_inst); if (!mo || !obj) - return oml_fom_ack_nack(msg, NM_NACK_OBJINST_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_OBJINST_UNKN)); /* Step 2: Do some global dependency/consistency checking */ if (mo->nm_state.administrative == adm_state) @@ -800,7 +823,7 @@ static int down_fom(struct gsm_bts *bts, struct msgb *msg) if (foh->obj_inst.bts_nr != 0 && foh->obj_inst.bts_nr != 0xff) { LOGP(DOML, LOGL_INFO, "Formatted O&M with BTS %d out of range.\n", foh->obj_inst.bts_nr); - return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN)); } switch (foh->msg_type) { @@ -810,15 +833,18 @@ static int down_fom(struct gsm_bts *bts, struct msgb *msg) case NM_MT_SET_RADIO_ATTR: trx = gsm_bts_trx_num(bts, foh->obj_inst.trx_nr); if (!trx) - return oml_fom_ack_nack(msg, NM_NACK_TRXNR_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_TRXNR_UNKN)); ret = oml_rx_set_radio_attr(trx, msg); break; case NM_MT_SET_CHAN_ATTR: trx = gsm_bts_trx_num(bts, foh->obj_inst.trx_nr); if (!trx) - return oml_fom_ack_nack(msg, NM_NACK_TRXNR_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_TRXNR_UNKN)); if (foh->obj_inst.ts_nr >= ARRAY_SIZE(trx->ts)) - return oml_fom_ack_nack(msg, NM_NACK_OBJINST_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_OBJINST_UNKN)); ret = oml_rx_set_chan_attr(&trx->ts[foh->obj_inst.ts_nr], msg); break; case NM_MT_OPSTART: @@ -833,7 +859,8 @@ static int down_fom(struct gsm_bts *bts, struct msgb *msg) default: LOGP(DOML, LOGL_INFO, "unknown Formatted O&M msg_type 0x%02x\n", foh->msg_type); - ret = oml_fom_ack_nack(msg, NM_NACK_MSGTYPE_INVAL); + ret = oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_MSGTYPE_INVAL)); } return ret; @@ -1000,17 +1027,19 @@ static int oml_ipa_set_attr(struct gsm_bts *bts, struct msgb *msg) rc = oml_tlv_parse(&tp, foh->data, msgb_l3len(msg) - sizeof(*foh)); if (rc < 0) - return oml_fom_ack_nack(msg, NM_NACK_INCORR_STRUCT); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_INCORR_STRUCT)); /* Resolve MO by obj_class/obj_inst */ mo = gsm_objclass2mo(bts, foh->obj_class, &foh->obj_inst); obj = gsm_objclass2obj(bts, foh->obj_class, &foh->obj_inst); if (!mo || !obj) - return oml_fom_ack_nack(msg, NM_NACK_OBJINST_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_OBJINST_UNKN)); rc = oml_ipa_mo_set_attr(bts, mo, obj, &tp); - return oml_fom_ack_nack(msg, rc); + return oml_send_msg(oml_fom_ack_nack(msg, rc)); } static int rx_oml_ipa_rsl_connect(struct gsm_bts_trx *trx, struct msgb *msg, @@ -1041,10 +1070,11 @@ static int rx_oml_ipa_rsl_connect(struct gsm_bts_trx *trx, struct msgb *msg, rc = e1inp_ipa_bts_rsl_connect(oml_link->ts->line, inet_ntoa(in), port); if (rc < 0) { LOGP(DOML, LOGL_ERROR, "Error in abis_open(RSL): %d\n", rc); - return oml_fom_ack_nack(msg, NM_NACK_CANT_PERFORM); + return oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_CANT_PERFORM)); } - return oml_fom_ack_nack(msg, 0); + return oml_send_msg(oml_fom_ack_nack(msg, 0)); } static int down_mom(struct gsm_bts *bts, struct msgb *msg) @@ -1071,13 +1101,13 @@ static int down_mom(struct gsm_bts *bts, struct msgb *msg) if (foh->obj_inst.bts_nr != 0 && foh->obj_inst.bts_nr != 0xff) { LOGP(DOML, LOGL_INFO, "Manufacturer O&M with BTS %d out of range.\n", foh->obj_inst.bts_nr); - return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN)); } ret = oml_tlv_parse(&tp, foh->data, oh->length - sizeof(*foh)); if (ret < 0) { LOGP(DOML, LOGL_ERROR, "TLV parse error %d\n", ret); - return oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN); + return oml_send_msg(oml_fom_ack_nack(msg, NM_NACK_BTSNR_UNKN)); } abis_nm_debugp_foh(DOML, foh); @@ -1094,7 +1124,8 @@ static int down_mom(struct gsm_bts *bts, struct msgb *msg) default: LOGP(DOML, LOGL_INFO, "Manufacturer Formatted O&M msg_type 0x%02x\n", foh->msg_type); - ret = oml_fom_ack_nack(msg, NM_NACK_MSGTYPE_INVAL); + ret = oml_send_msg(oml_fom_ack_nack(msg, + NM_NACK_MSGTYPE_INVAL)); } return ret; diff --git a/src/osmo-bts-sysmo/oml.c b/src/osmo-bts-sysmo/oml.c index 4ebf664..a268294 100644 --- a/src/osmo-bts-sysmo/oml.c +++ b/src/osmo-bts-sysmo/oml.c @@ -1548,7 +1548,7 @@ int bts_model_apply_oml(struct gsm_bts *bts, struct msgb *msg, } /* FIXME: we actaully need to send a ACK or NACK for the OML message */ - return oml_fom_ack_nack(msg, 0); + return oml_send_msg(oml_fom_ack_nack(msg, 0)); } /* callback from OML */ -- 1.7.10.4

11 years, 1 month

[osmo-bts PATCH 1/2] oml: Add support com.ipacces and org.osmocom manufacturer type

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> This patch allows to add the osmocom manufacturer id label in the manufacturer message. Before of this patch, everytime we have added ipaccess because we had only one kind of manufacturer message. And I have moved the code that we have used for adding this manufacturer ID label to the function oml_fom_ack_nack because we only add the manufacturer Id label in this function now. Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- src/common/oml.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/src/common/oml.c b/src/common/oml.c index b7c12f7..42e4e80 100644 --- a/src/common/oml.c +++ b/src/common/oml.c @@ -93,6 +93,7 @@ static struct tlv_definition abis_nm_att_tlvdef_ipa = { /* ip.access nanoBTS specific commands */ static const char ipaccess_magic[] = "com.ipaccess"; +static const char osmocom_magic[] = "org.osmocom"; static int oml_ipa_set_attr(struct gsm_bts *bts, struct msgb *msg); /* @@ -163,13 +164,6 @@ int oml_send_msg(struct msgb *msg, int is_manuf) { struct abis_om_hdr *omh; - if (is_manuf) { - /* length byte, string + 0 termination */ - uint8_t *manuf = msgb_push(msg, 1 + sizeof(ipaccess_magic)); - manuf[0] = strlen(ipaccess_magic)+1; - memcpy(manuf+1, ipaccess_magic, strlen(ipaccess_magic)); - } - /* Push the main OML header and send it off */ omh = (struct abis_om_hdr *) msgb_push(msg, sizeof(*omh)); if (is_manuf) @@ -321,6 +315,7 @@ int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) struct msgb *msg; struct abis_om_fom_hdr *foh; int is_manuf = 0; + uint8_t *manuf; msg = oml_msgb_alloc(); if (!msg) @@ -349,6 +344,24 @@ int oml_fom_ack_nack(struct msgb *old_msg, uint8_t cause) foh->msg_type++; /* ack */ } + if (is_manuf) { + if (strncmp(osmocom_magic, (const char *)old_oh->data + 1, + sizeof(osmocom_magic)) == 0) { + manuf = msgb_push(msg, 1 + sizeof(osmocom_magic)); + manuf[0] = sizeof(osmocom_magic); + memcpy(manuf+1, osmocom_magic, sizeof(osmocom_magic)); + } else if (strncmp(ipaccess_magic, + (const char *)old_oh->data + 1, + sizeof(ipaccess_magic)) == 0) { + manuf = msgb_push(msg, 1 + sizeof(ipaccess_magic)); + manuf[0] = sizeof(ipaccess_magic); + memcpy(manuf+1, ipaccess_magic, sizeof(ipaccess_magic)); + } else { + LOGP(DOML, LOGL_ERROR, "Unknown manufacturer label.\n"); + return -1; + } + } + return oml_send_msg(msg, is_manuf); } -- 1.7.10.4

11 years, 1 month

[osmo-bts PATCH 3/5] utils: Changed the function check_oml_message for returning message vendor type

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> Added some changes for returning the vendor type of message that we have checked. We are going to return OML, Manufacturer O&M Ipaccess message or Manufacturer O&M osmocom message. BTW, I have fixed a wrong use of sizeof in the code that I have modified. Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- src/osmo-bts-sysmo/utils.c | 14 ++++++++------ src/osmo-bts-sysmo/utils.h | 6 ++++++ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/osmo-bts-sysmo/utils.c b/src/osmo-bts-sysmo/utils.c index 1fa5796..e676a3c 100644 --- a/src/osmo-bts-sysmo/utils.c +++ b/src/osmo-bts-sysmo/utils.c @@ -245,15 +245,17 @@ int check_oml_msg(struct msgb *msg) if (omh->mdisc == ABIS_OM_MDISC_MANUF) { strncpy(label_id, (const char *) msg->l3h + 1, - sizeof(ipaccess_magic) + 1); + sizeof(ipaccess_magic)); if (strncmp(ipaccess_magic, label_id, - sizeof(ipaccess_magic) + 1) == 0) + sizeof(ipaccess_magic)) == 0) { msg->l3h = msg->l3h + sizeof(ipaccess_magic) + 1; - else if (strncmp(osmocom_magic, label_id, - sizeof(osmocom_magic) + 1) == 0) + return MANUFACTURER_MSG_IPA_TYPE; + } else if (strncmp(osmocom_magic, label_id, + sizeof(osmocom_magic)) == 0) { msg->l3h = msg->l3h + sizeof(osmocom_magic) + 1; - else { + return MANUFACTURER_MSG_OSMO_TYPE; + } else { msg->l3h = NULL; LOGP(DL1C, LOGL_ERROR, "Manuf Label Unknown %s\n", label_id); @@ -261,7 +263,7 @@ int check_oml_msg(struct msgb *msg) } } - return 0; + return OML_MSG_TYPE; } int check_ipa_header(struct msgb *msg) diff --git a/src/osmo-bts-sysmo/utils.h b/src/osmo-bts-sysmo/utils.h index 4f2293a..dbbe443 100644 --- a/src/osmo-bts-sysmo/utils.h +++ b/src/osmo-bts-sysmo/utils.h @@ -21,6 +21,12 @@ enum manuf_type_id { OSMOCOM_MANUF_ID, }; +enum check_message_type { + OML_MSG_TYPE, + MANUFACTURER_MSG_IPA_TYPE, + MANUFACTURER_MSG_OSMO_TYPE, +}; + static const char osmocom_magic[] = "org.osmocom"; static const char ipaccess_magic[] = "com.ipaccess"; -- 1.7.10.4

11 years, 1 month

[osmo-bts PATCH 2/5] moved out the ipa header sanity check in check_oml_msg

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> I have split the function check_oml_msg, in two functions. One for checking if the ipa header is well-formed and in check_oml_msg, I have removed this code for using in the future the function check_oml_msg for passing a sanity check to oml message without ipa header. Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- src/osmo-bts-sysmo/main.c | 11 +++++++++- src/osmo-bts-sysmo/utils.c | 50 ++++++++++++++++++++++++-------------------- src/osmo-bts-sysmo/utils.h | 1 + 3 files changed, 38 insertions(+), 24 deletions(-) diff --git a/src/osmo-bts-sysmo/main.c b/src/osmo-bts-sysmo/main.c index bd6a181..797f174 100644 --- a/src/osmo-bts-sysmo/main.c +++ b/src/osmo-bts-sysmo/main.c @@ -317,7 +317,16 @@ static int read_sock(struct osmo_fd *fd, unsigned int what) msgb_put(msg, rc); - if (check_oml_msg(msg) < 0) { + rc = check_ipa_header(msg); + if (rc < 0) { + LOGP(DL1C, LOGL_ERROR, "Malformed receive message: Ipa hdr\n"); + goto err; + } + + msgb_pull(msg, sizeof(struct ipaccess_head)); + + rc = check_oml_msg(msg); + if (rc < 0) { LOGP(DL1C, LOGL_ERROR, "Malformed receive message\n"); goto err; } diff --git a/src/osmo-bts-sysmo/utils.c b/src/osmo-bts-sysmo/utils.c index 2da1228..1fa5796 100644 --- a/src/osmo-bts-sysmo/utils.c +++ b/src/osmo-bts-sysmo/utils.c @@ -181,33 +181,10 @@ void prepend_oml_ipa_header(struct msgb *msg) int check_oml_msg(struct msgb *msg) { - struct ipaccess_head *hh; struct abis_om_hdr *omh; int abis_oml_hdr_len; char label_id[255]; - if (msg->len < sizeof(struct ipaccess_head)) { - LOGP(DL1C, LOGL_ERROR, "Ipa header insufficient space %d %d\n", - msg->len, sizeof(struct ipaccess_head)); - return -1; - } - - hh = (struct ipaccess_head *)msg->data; - - if (hh->proto != IPAC_PROTO_OML) { - LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header protocol %x %x\n", - hh->proto, IPAC_PROTO_OML); - return -1; - } - - if (ntohs(hh->len) != msg->len - sizeof(struct ipaccess_head)) { - LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header msg size %d %d\n", - ntohs(hh->len), msg->len - sizeof(struct ipaccess_head)); - return -1; - } - - msgb_pull(msg, sizeof(struct ipaccess_head)); - abis_oml_hdr_len = sizeof(struct abis_om_hdr); if (msg->len < abis_oml_hdr_len) { @@ -287,6 +264,33 @@ int check_oml_msg(struct msgb *msg) return 0; } +int check_ipa_header(struct msgb *msg) +{ + struct ipaccess_head *hh; + + if (msg->len < sizeof(struct ipaccess_head)) { + LOGP(DL1C, LOGL_ERROR, "Ipa header insufficient space %d %d\n", + msg->len, sizeof(struct ipaccess_head)); + return -1; + } + + hh = (struct ipaccess_head *)msg->data; + + if (hh->proto != IPAC_PROTO_OML) { + LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header protocol %x %x\n", + hh->proto, IPAC_PROTO_OML); + return -1; + } + + if (ntohs(hh->len) != msg->len - sizeof(struct ipaccess_head)) { + LOGP(DL1C, LOGL_ERROR, "Incorrect ipa header msg size %d %d\n", + ntohs(hh->len), msg->len - sizeof(struct ipaccess_head)); + return -1; + } + + return 0; +} + int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id) { uint8_t *manuf; diff --git a/src/osmo-bts-sysmo/utils.h b/src/osmo-bts-sysmo/utils.h index 85a5e88..4f2293a 100644 --- a/src/osmo-bts-sysmo/utils.h +++ b/src/osmo-bts-sysmo/utils.h @@ -29,4 +29,5 @@ int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id); void prepend_oml_ipa_header(struct msgb *msg); int check_oml_msg(struct msgb *msg); +int check_ipa_header(struct msgb *msg); #endif -- 1.7.10.4

11 years, 1 month

[libosmocore PATCH 1/5] abis_nm: Added the new tlv_definition abis_nm_osmo_att_tlvdef in the abis header

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- include/osmocom/gsm/abis_nm.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/osmocom/gsm/abis_nm.h b/include/osmocom/gsm/abis_nm.h index 4682ead..86b97eb 100644 --- a/include/osmocom/gsm/abis_nm.h +++ b/include/osmocom/gsm/abis_nm.h @@ -30,6 +30,7 @@ extern const struct tlv_definition abis_nm_att_tlvdef; const char *abis_nm_opstate_name(uint8_t os); const char *abis_nm_avail_name(uint8_t avail); const char *abis_nm_test_name(uint8_t test); +extern const struct tlv_definition abis_nm_osmo_att_tlvdef; /*! \brief write a human-readable OML header to the debug log * \param[in] ss Logging sub-system -- 1.7.10.4

11 years, 1 month

[osmo-bts PATCH 4/5] utils: Used the enum manuf_type_id in the parameter of add_manufacturer_id_label

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- src/osmo-bts-sysmo/utils.c | 4 ++-- src/osmo-bts-sysmo/utils.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/osmo-bts-sysmo/utils.c b/src/osmo-bts-sysmo/utils.c index e676a3c..8652588 100644 --- a/src/osmo-bts-sysmo/utils.c +++ b/src/osmo-bts-sysmo/utils.c @@ -293,11 +293,11 @@ int check_ipa_header(struct msgb *msg) return 0; } -int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id) +int add_manufacturer_id_label(struct msgb *msg, enum manuf_type_id type_id) { uint8_t *manuf; - switch (manuf_type_id) { + switch (type_id) { case IPACCESS_MANUF_ID: manuf = msgb_push(msg, 1 + sizeof(ipaccess_magic)); manuf[0] = sizeof(ipaccess_magic); diff --git a/src/osmo-bts-sysmo/utils.h b/src/osmo-bts-sysmo/utils.h index dbbe443..a629ac1 100644 --- a/src/osmo-bts-sysmo/utils.h +++ b/src/osmo-bts-sysmo/utils.h @@ -30,7 +30,7 @@ enum check_message_type { static const char osmocom_magic[] = "org.osmocom"; static const char ipaccess_magic[] = "com.ipaccess"; -int add_manufacturer_id_label(struct msgb *msg, int manuf_type_id); +int add_manufacturer_id_label(struct msgb *msg, enum manuf_type_id type_id); void prepend_oml_ipa_header(struct msgb *msg); -- 1.7.10.4

11 years, 1 month

[osmo-bts PATCH 2/3] sysmobts/sysmobts-mgr: Changed Reduce Power attribute and the tlv definition

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> This patch is for changing the code for having consistency with the patch of libosmocore: Fix introducing osmocom speficic OML attributes 5b5650f3de0213a459b4184bab3ab2d0d833c4a4 For using the new tlv definition structure abis_nm_osmo_att_tlvdef and change the attribute NM_ATT_O_REDUCEPOWER to NM_ATT_OSMO_REDUCEPOWER. Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- src/osmo-bts-sysmo/main.c | 6 +++--- src/osmo-bts-sysmo/misc/sysmobts_misc.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/osmo-bts-sysmo/main.c b/src/osmo-bts-sysmo/main.c index 2c13a9c..60312b8 100644 --- a/src/osmo-bts-sysmo/main.c +++ b/src/osmo-bts-sysmo/main.c @@ -296,7 +296,7 @@ static int write_pid_file(char *procname) } #define oml_tlv_parse(dec, buf, len) \ - tlv_parse(dec, &abis_nm_att_tlvdef, buf, len, 0, 0) + tlv_parse(dec, &abis_nm_osmo_att_tlvdef, buf, len, 0, 0) static int send_oml_fom_ack_nack(int fd_unix, struct msgb *old_msg, uint8_t cause, int is_manuf) @@ -377,9 +377,9 @@ static int take_reduce_power(struct msgb *msg) return -1; } - if (TLVP_PRESENT(&tlv_out, NM_ATT_O_REDUCEPOWER)) + if (TLVP_PRESENT(&tlv_out, NM_ATT_OSMO_REDUCEPOWER)) recv_reduce_power = *TLVP_VAL(&tlv_out, - NM_ATT_O_REDUCEPOWER); + NM_ATT_OSMO_REDUCEPOWER); else return -1; diff --git a/src/osmo-bts-sysmo/misc/sysmobts_misc.c b/src/osmo-bts-sysmo/misc/sysmobts_misc.c index 6277a6b..5a52005 100644 --- a/src/osmo-bts-sysmo/misc/sysmobts_misc.c +++ b/src/osmo-bts-sysmo/misc/sysmobts_misc.c @@ -142,7 +142,7 @@ int send_manufacturer_reduce_msg(int fd_unix, int reduce_power, int trx_nr) add_oml_hdr_msg(msg, NM_MT_SET_RADIO_ATTR, 2, 0, trx_nr, 255, 1); - msgb_tv_put(msg, NM_ATT_O_REDUCEPOWER, reduce_power); + msgb_tv_put(msg, NM_ATT_OSMO_REDUCEPOWER, reduce_power); prepend_oml_ipa_header(msg); -- 1.7.10.4

11 years, 1 month

[libosmocore PATCH 1/3] abis_nm: Added the new tlv_definition abis_nm_osmo_att_tlvdef in the abis header

by Alvaro Neira Ayuso

11 years, 1 month

[libosmocore PATCH 1/4] protocol/gsm_12_21.h: Add the Manufacturer Attribute ID O_REDUCEPOWER.

by Alvaro Neira Ayuso

From: Álvaro Neira Ayuso <anayuso(a)sysmocom.de> Signed-off-by: Alvaro Neira Ayuso <anayuso(a)sysmocom.de> --- include/osmocom/gsm/protocol/gsm_12_21.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/include/osmocom/gsm/protocol/gsm_12_21.h b/include/osmocom/gsm/protocol/gsm_12_21.h index 694df93..b1725d5 100644 --- a/include/osmocom/gsm/protocol/gsm_12_21.h +++ b/include/osmocom/gsm/protocol/gsm_12_21.h @@ -486,6 +486,8 @@ enum abis_nm_attr { NM_ATT_BS11_ANT_TYPE = 0xf4, NM_ATT_BS11_PLL_MODE = 0xfc, NM_ATT_BS11_PASSWORD = 0xfd, + + NM_ATT_O_REDUCEPOWER = 0x01, }; #define NM_ATT_BS11_FILE_DATA NM_ATT_EVENT_TYPE -- 1.7.10.4

11 years, 1 month

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC May 2014