OpenBSC October 2015

openbsc@lists.osmocom.org

17 participants
41 discussions

Re: osmo-nitb (HLR/sqlite part) - segmentation fault

by Holger Freyther

> On 18 Oct 2015, at 05:26, Marcin Starzyk <marcin.starzyk(a)gmail.com> wrote: > Hi! > Is it acceptable for you?- if so - how should I start? (I've read section for developers on openbsc wiki but still things are not clear to me as to how to start) 0.) The first libdbi corruption has been fixed by a patch[1]. You might just suffer from this one. 1.) In OpenBSC and when linking against libdbi 0.9 we get crashes on i386. I have a first analysis here[2] you could see which part fails. E.g. you could start compiling libdbi/libdi-drivers on your system with the address sanitizer (ASAN) and see if crashes are already triggered by the builtin testsuite, if not move on to OpenBSC 2.) Start looking into replacing libdbi calls with direct sqlite3 calls. To store "BLOB" libdi was wrapping it and we either copy that code or we migrate the data. E.g. have a look at how we migrate SMS on a schema change. 1st and 2nd are two alternatives, both of them have ups and downs and are acceptable ways to move forward. holger [1] https://github.com/sysmocom/meta-telephony/blob/master/recipes-misc/libdbi/… [2] http://sourceforge.net/p/libdbi/mailman/message/32607036/

9 years, 8 months

osmo-nitb (HLR/sqlite part) - segmentation fault

by Marcin Starzyk

Hi All, I’m facing an issue with osmo-nitb (HLR/sqlite part) - segmentation fault. All works ok for the first usage od DB (e.g. Location Updating Request) – but there is segmentation fault on second Location Updating request or any other attempt to execute any command using VTY for HLR. Syslog____________________________________________________________________________ Oct 12 20:32:29 debian kernel: [ 2397.242984] osmo-nitb[985]: segfault at 64692e74 ip b77c15c9 sp bf8688b0 error 4 in libdbdsqlite3.so[b77be000+8000] Part of bt__________________________________________________________________________ #0 0xb77c15c9 in ?? () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so #1 0xb77c17e4 in ?? () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so #2 0xb77c26f7 in dbd_query () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so No symbol table info available. Can anybody please advise? Thank you, Regards, Marcin Attached files -Tcpump (between nanoBTS(.34) and BSC (.20)) -Debug output, backtrace, syslog below Debug-output 1/2________________________________________________________________________ <0004> abis_rsl.c:1465 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=LOCATION_UPDATE ra=0x01 ta=0 <0004> abis_rsl.c:1199 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK <0000> abis_rsl.c:1653 (bts=0,trx=0,ts=0,ss=0) SAPI=0 ESTABLISH INDICATION <0000> gsm_04_08.c:3584 Dispatching 04.08 message, pdisc=5 <0002> gsm_04_08.c:1136 LOCATION UPDATING REQUEST: MI(IMSI)=260060059332155 type=NORMAL <0001> gsm_04_08.c:145 (bts 0 trx 0 ts 0 pd 05) Sending 0x18 to MS. <0000> abis_rsl.c:1653 (bts=0,trx=0,ts=0,ss=0) SAPI=0 DATA INDICATION <0003> bsc_api.c:500 CLASSMARK CHANGE CM2(len=3) CM3(len=7) <0000> abis_rsl.c:1653 (bts=0,trx=0,ts=0,ss=0) SAPI=0 DATA INDICATION <0000> gsm_04_08.c:3584 Dispatching 04.08 message, pdisc=5 <0002> gsm_04_08.c:523 IDENTITY RESPONSE: MI(IMEI)=359809011036930 <0002> gsm_04_08.c:568 Location Updating Request procedure timedout. <0002> gsm_04_08.c:452 Subscriber 260060059332155: LOCATION UPDATING REJECT LAC=1 BTS=0 <0001> gsm_04_08.c:145 (bts 0 trx 0 ts 0 pd 05) Sending 0x04 to MS. <0000> chan_alloc.c:324 (bts=0,trx=0,ts=0,ss=0) starting release sequence <0003> gsm_04_08_utils.c:239 Sending Channel Release: Chan: Number: 0 Type: 1 <0004> abis_rsl.c:616 (bts=0,trx=0,ts=0,ss=0) DEACTivate SACCH CMD DB-ouput___________________________________________________________________________ sqlite> select * from subscriber ; 1|2015-10-12 18:31:38|2015-10-12 18:31:39|260060059332155||22685|0||0| Debug-output 2/2_____________________________________________________________________ <0004> abis_rsl.c:1465 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=LOCATION_UPDATE ra=0x07 ta=0 <0004> abis_rsl.c:1199 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK 0000> abis_rsl.c:1653 (bts=0,trx=0,ts=0,ss=0) SAPI=0 ESTABLISH INDICATION <0000> gsm_04_08.c:3584 Dispatching 04.08 message, pdisc=5 <0002> gsm_04_08.c:1136 LOCATION UPDATING REQUEST: MI(IMSI)=260060059332155 type=NORMAL <0001> gsm_04_08.c:145 (bts 0 trx 0 ts 0 pd 05) Sending 0x18 to MS. Segmentation fault (core dumped) Syslog____________________________________________________________________________ Oct 12 20:32:29 debian kernel: [ 2397.242984] osmo-nitb[985]: segfault at 64692e74 ip b77c15c9 sp bf8688b0 error 4 in libdbdsqlite3.so[b77be000+8000] Backtrace__________________________________________________________________________ root@debian:~/openbsc/openbsc/src/osmo-nitb# gdb osmo-nitb core GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1 Copyright (C) 2014 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html > This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i586-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from osmo-nitb...done. [New LWP 985] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1". Core was generated by `./osmo-nitb --debug=DRLL:DCC:DMM:DRR:DRSL:DNM'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0xb77c15c9 in ?? () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so (gdb) bt full #0 0xb77c15c9 in ?? () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so No symbol table info available. #1 0xb77c17e4 in ?? () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so No symbol table info available. #2 0xb77c26f7 in dbd_query () from /usr/lib/i386-linux-gnu/dbd/libdbdsqlite3.so No symbol table info available. #3 0xb77a7122 in dbi_conn_queryf () from /usr/lib/i386-linux-gnu/libdbi.so.1 No symbol table info available. #4 0x0806f99f in get_equipment_by_subscr (subscr=0x9055b60) at db.c:550 result = 0x9053520 cm2 = 0xbf8688e4 "" cm3 = 0xbf8688e4 "" #5 0x08070523 in db_get_subscriber (field=151346016, id=0xbf868e00 "260060059332155") at db.c:897 result = 0x9053520 quoted = 0x904fa58 "x4q\267x5\005\t2015-10-12 18:31:39" subscr = 0x9055b60 #6 0x0807423a in get_subscriber (ident=0xbf868e00 "260060059332155", type=0, sgrp=0x9010840) at gsm_subscriber.c:67 subscr = <optimized out> #7 subscr_get_by_imsi (sgrp=0x9010840, imsi=0xbf868e00 "260060059332155") at gsm_subscriber.c:240 subscr = 0x80c20e0 <subscriber_create_cmd+32> #8 0x0807f8a5 in mm_rx_loc_upd_req (msg=<optimized out>, conn=0x9063740) at gsm_04_08.c:643 subscr = 0x0 bts = 0xb7737b01 <osmo_timer_schedule+81> ---Type <return> to continue, or q <return> to quit--- mi_type = <optimized out> gh = 0x9063793 mi_string = "260060059332155\000\267zs\267\230+\005\t@7 \006\t\206\353\a\b" #9 gsm0408_rcv_mm (msg=0x8085488, conn=0x9063740) at gsm_04_08.c:1137 gh = <optimized out> rc = 0 #10 gsm0408_dispatch (conn=0x9052b98, msg=0x9063740) at gsm_04_08.c:3594 gh = <optimized out> pdisc = <optimized out> rc = 0 #11 0x0807895a in msc_compl_l3 (conn=0x9052b98, msg=0x9063740, chosen_channel=0) at osmo_msc.c:49 No locals. #12 0x0804e468 in gsm0408_rcvmsg (msg=0x9063740, link_id=0 '\000') at bsc_api.c:684 rc = -1081702172 #13 0x0806619b in abis_rsl_rx_rll (msg=<optimized out>) at abis_rsl.c:1674 ts_name = 0xbf8688e4 "" sapi = 0 '\000' #14 abis_rsl_rcvmsg (msg=0x9063740) at abis_rsl.c:2085 rc = 151402378 #15 0xb771f107 in handle_ts1_read (bfd=<optimized out>) at input/ipaccess.c:271 link = 0xbf8688e4 hh = 0x5 msg = 0x9063740 ---Type <return> to continue, or q <return> to quit--- ts_nr = 3077720460 #16 ipaccess_fd_cb (bfd=0x9056b30, what=1) at input/ipaccess.c:386 rc = 151348668 #17 0xb77380d8 in osmo_select_main (polling=0) at select.c:160 flags = 1 ufd = 0x9056b30 tmp = 0xb7754524 <osmo_fds> readset = {__fds_bits = {0 <repeats 32 times>}} writeset = {__fds_bits = {0 <repeats 32 times>}} exceptset = {__fds_bits = {0 <repeats 32 times>}} work = 1 rc = <optimized out> no_time = {tv_sec = 0, tv_usec = 0} #18 0x0804c8bf in main (argc=2, argv=0xbf869214) at bsc_hack.c:356 rc = <optimized out>

9 years, 8 months

[PATCH 00/15] Add GTP hub, in early alpha stage

by Neels Hofmeyr

Here is the part of the branch openbsc:neels/gtphub that I believe may be merged to master at this point. (Holger: please go ahead with the merge, or tell me to do so...) The remaining bit is mostly a unit test netcat'ing to a gtphub instance. To do that properly, gtphub must be configurable. Hence I'm starting to add VTY config, which is not complete yet. Hence that part is still omitted here. Neels Hofmeyr (15): Add GTP hub stub, as simplistic UDP forwarder. gtphub: add to build gtphub: add skeletal gtphub.[hc] gtphub: populate API impl from test prog gtphub: add a todo comment gtphub: add TEI map API. gtphub: add gtphub_test.c (empty) gtphub: add TEI map test gtphub: add GTP header validation gtphub: undup code: memset on a struct. gtphub: tweak logging gtphub: index IEs, decode and log a few. gtphub: split gtp_relay() in r/w funcs gtphub: map sequence numbers SGSNs<->GGSNs gtphub: add signal handler to gtphub_main openbsc/.gitignore | 2 + openbsc/configure.ac | 1 + openbsc/include/openbsc/Makefile.am | 3 +- openbsc/include/openbsc/debug.h | 1 + openbsc/include/openbsc/gtphub.h | 151 ++++++++ openbsc/src/gprs/Makefile.am | 4 + openbsc/src/gprs/gtphub.c | 714 ++++++++++++++++++++++++++++++++++++ openbsc/src/gprs/gtphub_main.c | 256 +++++++++++++ openbsc/tests/Makefile.am | 2 +- openbsc/tests/gtphub/Makefile.am | 15 + openbsc/tests/gtphub/gtphub_test.c | 117 ++++++ openbsc/tests/gtphub/gtphub_test.ok | 1 + openbsc/tests/testsuite.at | 7 + 13 files changed, 1272 insertions(+), 2 deletions(-) create mode 100644 openbsc/include/openbsc/gtphub.h create mode 100644 openbsc/src/gprs/gtphub.c create mode 100644 openbsc/src/gprs/gtphub_main.c create mode 100644 openbsc/tests/gtphub/Makefile.am create mode 100644 openbsc/tests/gtphub/gtphub_test.c create mode 100644 openbsc/tests/gtphub/gtphub_test.ok -- 2.1.4

9 years, 8 months

Authorization using IMEI

by Ravi Shankar

Dear Sir It's mentioned on the site that the non-secure authorization is feasible with IMEI/IMSI. How can we authorize any MS using IMEI ?? I mean, the authorization field is in the Subscriber table of the database so how is it possible to set authorization with IMEI number. Regards.

9 years, 8 months

[PATCH openbsc] mgcp_osmux: available circuit IDs from 0 to 255, not from 0 to 128

by pablo＠gnumonks.org

From: Pablo Neira Ayuso <pablo(a)soleta.eu> Holger reports that the bitmap that accounts for available Osmux circuit IDs is limited to 128, when the maximum number of circuit IDs are determined by the uint8_t field in the header (ie. 256 circuits). --- @Holger: Will be revisiting libosmo-netif too, at quick glance I can see insufficient validation of several functions there that take this allocated ccid as input parameter. openbsc/src/libmgcp/mgcp_osmux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openbsc/src/libmgcp/mgcp_osmux.c b/openbsc/src/libmgcp/mgcp_osmux.c index 90b7368..d110f42 100644 --- a/openbsc/src/libmgcp/mgcp_osmux.c +++ b/openbsc/src/libmgcp/mgcp_osmux.c @@ -530,7 +530,7 @@ int osmux_send_dummy(struct mgcp_endpoint *endp) } /* bsc-nat allocates/releases the Osmux circuit ID */ -static uint8_t osmux_cid_bitmap[16]; +static uint8_t osmux_cid_bitmap[(OSMUX_CID_MAX + 1) / 8]; int osmux_get_cid(void) { -- 2.1.4

9 years, 8 months

recent patch set with wrong From address dwilllmann@

by Neels Hofmeyr

Daniel, your from address had triple l's in them. Just saying in case some config needs fixing. I noticed because I was replying on a patch and got a bounce from sysmocom.de. ~Neels

9 years, 8 months

Osmo-BTS-trx compilation Error

by Rehab Khan

Hello list, I have compiled OpenBSC stack following the link http://openbsc.osmocom.org/trac/wiki/network_from_scratch. Everything has been compiled and configured smoothly except osmo-bts.For installing osmo-bts,i git cloned master branch from https://github.com/osmocom/osmo-bts. Following the link, i did configure --enable-trx and when make osmo-bts, i am getting the following error: l1_if.c: In function ‘bts_model_l1sap_down’: l1_if.c:552:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:553:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:554:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:555:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:580:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:581:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:582:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ l1_if.c:583:23: error: ‘struct amr_multirate_conf’ has no member named ‘mode’ make: *** [l1_if.o] Error 1 I have tried it with the change branch: jolly/trx and also tried to make osmo-bts-trx in the src directory of osmo-bts but same error persisits. Any help in this regard will be a worth. Thanks Best Regards

9 years, 8 months

[openbsc 0/5] sgsn/gbproxy RAND_bytes() usage and test cases

by Daniel Willmann

From: Daniel Willmann <dwillmann(a)sysmocom.de> Hello, the following patches should complete the usage of RAND_bytes() for GPRS. Jacob improved the SGSN test case so it would extract the PTMSI from the LLC frames and use those in the response. This means the gprs_sgsn patch will not break the test anymore. Furthermore, I changed the gbproxy implementation and test case to use RAND_bytes() instead of rand_r(). The test case previously used rand_r() to (re-)set the seed value for TLLI/PTMSI allocation in order to get predictable results. With RAND_bytes() this is not possible. Instead the tests overrides that function, replacing it with a predictable sequence of random numbers. Regards Daniel Daniel Willmann (3): gprs: Use RAND_bytes for p-tmsi gbproxy/test: Add and call cleanup_test function gprs/gb_proxy: Use RAND_bytes for gbproxy TLLI/TMSI allocation Jacob Erlbeck (2): sgsn/test: Add and call cleanup_test function sgsn/test: Really parse received DL LLC messages openbsc/include/openbsc/gb_proxy.h | 4 - openbsc/src/gprs/Makefile.am | 7 +- openbsc/src/gprs/gb_proxy.c | 16 +- openbsc/src/gprs/gprs_sgsn.c | 6 +- openbsc/tests/gbproxy/Makefile.am | 4 +- openbsc/tests/gbproxy/gbproxy_test.c | 110 +++++--- openbsc/tests/gbproxy/gbproxy_test.ok | 514 +++++++++++++++++----------------- openbsc/tests/sgsn/Makefile.am | 2 + openbsc/tests/sgsn/sgsn_test.c | 133 +++++++-- 9 files changed, 464 insertions(+), 332 deletions(-) -- 2.1.4

9 years, 8 months

[openbsc 0/4] Use RAND_bytes() instead of rand()

by Daniel Willmann

From: Daniel Willmann <dwillmann(a)sysmocom.de> The following patches uses RAND_bytes() from openssl instead of rand() to generate TMSI/P-TMSI and auth tuples. I didn't change the use of rand_r() in gb-proxy because the gbproxy test seems to depend on predictable randomness. Daniel Willmann (4): libmsc: Use RAND_bytes when choosing a tmsi gprs: Use RAND_bytes for p-tmsi libmsc: Use RAND_bytes to choose auth tuple libmsc: Use RAND_bytes to generate a token openbsc/configure.ac | 2 +- openbsc/src/gprs/gprs_sgsn.c | 4 +++- openbsc/src/libmsc/Makefile.am | 2 +- openbsc/src/libmsc/auth.c | 9 +++++++-- openbsc/src/libmsc/db.c | 12 ++++++++++-- openbsc/src/osmo-nitb/Makefile.am | 2 +- openbsc/tests/channel/Makefile.am | 2 +- openbsc/tests/db/Makefile.am | 2 +- 8 files changed, 25 insertions(+), 10 deletions(-) -- 2.1.4

9 years, 8 months

[PATCH] gtp_duplicate(): comment, add todo.

by Neels Hofmeyr

--- gtp/gtp.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/gtp/gtp.c b/gtp/gtp.c index e6a610d..de6a7b4 100644 --- a/gtp/gtp.c +++ b/gtp/gtp.c @@ -614,6 +614,15 @@ int gtp_notification(struct gsn_t *gsn, int version, return 0; } +/* Look for a message in the response queue for the given peer and sequence + * number seq. If found, (re-)send the response message and return 0. Otherwise + * return nonzero. This allows catching duplicate messages. + * A response message stays in the response queue until it times out. + * So, for any number of identical requests within that timeout period, the + * same packet can be resent. + * TODO this only checks the peer and sequence number, and does not verify that + * the GTP request is identical to the previous one for this peer and sequence + * nr: a mere peer or seq glitch can cause leaks of previous responses. */ int gtp_duplicate(struct gsn_t *gsn, int version, struct sockaddr_in *peer, uint16_t seq) { @@ -873,7 +882,7 @@ int gtp_echo_ind(struct gsn_t *gsn, int version, struct sockaddr_in *peer, int fd, void *pack, unsigned len) { - /* Check if it was a duplicate request */ + /* Repeat previous response in case of duplicate request */ if (!gtp_duplicate(gsn, 0, peer, get_seq(pack))) return 0; @@ -1258,7 +1267,7 @@ int gtp_create_pdp_ind(struct gsn_t *gsn, int version, uint8_t linked_nsapi = 0; struct pdp_t *linked_pdp = NULL; - /* TODO describe what this is all about: */ + /* Repeat previous response in case of duplicate request */ if (!gtp_duplicate(gsn, version, peer, seq)) return 0; @@ -1955,10 +1964,9 @@ int gtp_update_pdp_ind(struct gsn_t *gsn, int version, uint64_t imsi; uint8_t nsapi; - /* Is this a duplicate ? */ - if (!gtp_duplicate(gsn, version, peer, seq)) { - return 0; /* We already sent of response once */ - } + /* Repeat previous response in case of duplicate request */ + if (!gtp_duplicate(gsn, version, peer, seq)) + return 0; /* Decode information elements */ if (gtpie_decaps(ie, version, pack + hlen, len - hlen)) { @@ -2432,10 +2440,9 @@ int gtp_delete_pdp_ind(struct gsn_t *gsn, int version, int n; int count = 0; - /* Is this a duplicate ? */ - if (!gtp_duplicate(gsn, version, peer, seq)) { - return 0; /* We already sent off response once */ - } + /* Repeat previous response in case of duplicate request */ + if (!gtp_duplicate(gsn, version, peer, seq)) + return 0; /* Find the linked context in question */ if (pdp_getgtp1(&linked_pdp, get_tei(pack))) { -- 2.1.4

9 years, 8 months

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC October 2015