OpenBSC June 2015

openbsc@lists.osmocom.org

13 participants
23 discussions

[PATCH] bssgp: Fix IMSI buffer size (Coverity)

by Jacob Erlbeck

Currently the size of the IMSI pointer is used instead of the size of the talloc'ed buffer. This commit changes the call to gsm48_mi_to_string to use the same value that has been used with talloc_zero_size(). The length is changed to 17 since that value is used for GSM_IMSI_LENGTH in openbsc. Fixes: Coverity CID 1040663 Sponsored-by: On-Waves ehf --- src/gb/gprs_bssgp_bss.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/gb/gprs_bssgp_bss.c b/src/gb/gprs_bssgp_bss.c index 962bf2e..3a9012e 100644 --- a/src/gb/gprs_bssgp_bss.c +++ b/src/gb/gprs_bssgp_bss.c @@ -34,6 +34,8 @@ #include "common_vty.h" +#define GSM_IMSI_LENGTH 17 + uint8_t *bssgp_msgb_tlli_put(struct msgb *msg, uint32_t tlli) { uint32_t _tlli = htonl(tlli); @@ -498,8 +500,8 @@ int bssgp_rx_paging(struct bssgp_paging_info *pinfo, if (!TLVP_PRESENT(&tp, BSSGP_IE_IMSI)) goto err_mand_ie; if (!pinfo->imsi) - pinfo->imsi = talloc_zero_size(pinfo, 16); - gsm48_mi_to_string(pinfo->imsi, sizeof(pinfo->imsi), + pinfo->imsi = talloc_zero_size(pinfo, GSM_IMSI_LENGTH); + gsm48_mi_to_string(pinfo->imsi, GSM_IMSI_LENGTH, TLVP_VAL(&tp, BSSGP_IE_IMSI), TLVP_LEN(&tp, BSSGP_IE_IMSI)); -- 1.9.1

10 years

[PATCH] bssgp/test: Add missing START/END printfs

by Jacob Erlbeck

Sponsored-by: On-Waves ehf --- tests/gb/gprs_bssgp_test.c | 7 ++++++- tests/gb/gprs_bssgp_test.ok | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/tests/gb/gprs_bssgp_test.c b/tests/gb/gprs_bssgp_test.c index 63abf8b..14ba4d1 100644 --- a/tests/gb/gprs_bssgp_test.c +++ b/tests/gb/gprs_bssgp_test.c @@ -173,10 +173,13 @@ static void test_bssgp_status(void) static void test_bssgp_bad_reset() { - struct msgb *msg = bssgp_msgb_alloc(); + struct msgb *msg; uint16_t bvci_be = htons(2); uint8_t cause = BSSGP_CAUSE_OML_INTERV; + printf("----- %s START\n", __func__); + msg = bssgp_msgb_alloc(); + msgb_v_put(msg, BSSGP_PDUT_BVC_RESET); msgb_tvlv_put(msg, BSSGP_IE_BVCI, sizeof(bvci_be), (uint8_t *)&bvci_be); msgb_tvlv_put(msg, BSSGP_IE_CAUSE, sizeof(cause), &cause); @@ -184,6 +187,8 @@ static void test_bssgp_bad_reset() msgb_bvci(msg) = 0xbad; msgb_bssgp_send_and_free(msg); + + printf("----- %s END\n", __func__); } static void test_bssgp_flow_control_bvc(void) diff --git a/tests/gb/gprs_bssgp_test.ok b/tests/gb/gprs_bssgp_test.ok index a011bee..83d633b 100644 --- a/tests/gb/gprs_bssgp_test.ok +++ b/tests/gb/gprs_bssgp_test.ok @@ -7,6 +7,8 @@ BSSGP primitive, SAP 16777219, prim = 4, op = 0, msg = 0e 1f 84 f0 12 34 56 1b 8 BSSGP primitive, SAP 16777221, prim = 11, op = 2, msg = 41 07 81 27 BSSGP primitive, SAP 16777221, prim = 11, op = 2, msg = 41 07 81 05 04 82 04 d2 ----- test_bssgp_status END +----- test_bssgp_bad_reset START +----- test_bssgp_bad_reset END ----- test_bssgp_flow_control_bvc START Got message: 26 1e 81 2a 05 82 10 22 03 82 c0 40 01 82 08 11 1c 82 60 20 Got message: 26 1e 81 2a 05 82 10 22 03 82 c0 40 01 82 08 11 1c 82 60 20 3c 81 78 06 82 11 44 -- 1.9.1

10 years

[PATCH] Fix GSM900 ARFCN range check

by Mike McTernan (wavemobile)

Allow ARFCN 0 to be used in GSM900 band. Signed-off-by: Michael McTernan <mike.mcternan(a)wavemobile.com> Index: osmobss/openbsc/openbsc/src/libbsc/bsc_init.c =================================================================== --- osmobss.orig/openbsc/openbsc/src/libbsc/bsc_init.c 2015-06-03 11:36:16.114471430 +0100 +++ osmobss/openbsc/openbsc/src/libbsc/bsc_init.c 2015-06-18 08:53:14.116369178 +0100 @@ -379,10 +379,10 @@ static int bootstrap_bts(struct gsm_bts } break; case GSM_BAND_900: - if (bts->c0->arfcn < 1 || + if (bts->c0->arfcn < 0 || (bts->c0->arfcn > 124 && bts->c0->arfcn < 955) || bts->c0->arfcn > 1023) { - LOGP(DNM, LOGL_ERROR, "GSM900 channel must be between 1-124, 955-1023.\n"); + LOGP(DNM, LOGL_ERROR, "GSM900 channel must be between 0-124, 955-1023.\n"); return -EINVAL; } break;

10 years

openbsc: build system tweaks

by Andreas Rottmann

Here are a bunch of buildsystem tweaks for openbsc. I'm not sure whether it is warranted to group them as a patch series, as they are (should be) independent of each other.

10 years

[PATCH 1/2] libbsc: Abstract out SIs update/generation for a BTS into a separate function.

by Alexander Chemeris

The code to do that doesn't belong to the control interface, so abstract it out to a separate function gsm_bts_set_system_infos(). -- Regards, Alexander Chemeris. CEO, Fairwaves, Inc. https://fairwaves.co

10 years

[PATCH] libmsc: Improve 'max_power_red' VTY command.

by Alexander Chemeris

Changes: * Apply change even if the supplied value is odd, just warn that it is rounded. Previously the value was not set at all, which may have lead to a situation when a user thinks the BTS operating at low power, while it is running full power. * Apply change even if the supplied value is higher than the 24dB maximum suggested by the standard, just warn about this. UmSITE and probably other SDR based BTS support much wider power regulation range. * Apply change to the BTS over OML immediately. -- Regards, Alexander Chemeris. CEO, Fairwaves, Inc. https://fairwaves.co

10 years

[PATCH 1/8] nat: Add size check for the payload

by Holger Hans Peter Freyther

From: Holger Hans Peter Freyther <holger(a)moiji-mobile.com> The msgb will always have these bytes but it is better practice to verify that the message really has space for the two bytes. --- openbsc/src/osmo-bsc_nat/bsc_nat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat.c b/openbsc/src/osmo-bsc_nat/bsc_nat.c index 4357485..537001e 100644 --- a/openbsc/src/osmo-bsc_nat/bsc_nat.c +++ b/openbsc/src/osmo-bsc_nat/bsc_nat.c @@ -1185,7 +1185,7 @@ exit: send_reset_ack(bsc); } else if (parsed->ipa_proto == IPAC_PROTO_IPACCESS) { /* do we know who is handling this? */ - if (msg->l2h[0] == IPAC_MSGT_ID_RESP) { + if (msg->l2h[0] == IPAC_MSGT_ID_RESP && msgb_l2len(msg) > 2) { struct tlv_parsed tvp; int ret; ret = ipa_ccm_idtag_parse(&tvp, -- 2.3.5

10 years

measurement report trap/JSON document

by Holger Freyther

Hi, sorry for the delay from OsmoDevCon to now. Attached is what I proposed in a customer project a long time ago. The idea was to register for traps, version them with vX in the variable name and then send traps as JSON document. holger

10 years

test

by Holger Freyther

10 years

IPAccess NanoBTS

by Sipos Csaba

Dear list, I recently integrated nanoBTS under OpenBSC. They work fine, but I encountered the following limitations. 1. Dynamic PDCH/TCH switching is allowed to be configured, but not working. The timeslots are stuck in TCH/F mode and never converted to PDCH. Is there any trick I need to do other than setting the channel type to TCH/F_PDCH? 2. No matter what I do, the BTS only schedules one uplink timeslot. If I understand it correctly, the PCU implementation in this case is inside the NanoBTS. Is there a way to change for example an NVRAM parameter to allow a more balanced UL/DL timeslot ratio? 3. Multi-TRX setup: it is quite a limitation that you cannot use any timeslots as PDCH in a multi-TRX setup on the secondary or third carriers at all. I don't think there is any solution to that, but it worth noting. I hope someone can point me in the right direction with dyn PDCH switching and the single UL TS issue. Thanks! Regards, Csaba

10 years

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC June 2015