OpenBSC June 2022

openbsc@lists.osmocom.org

13 participants
14 discussions

Pysim error: SW match failed
by Martin Nagy 16 Aug '25

16 Aug '25

Hi all, After buying a super Sim Kit (16 in 1) from China, I tried the reader (green PCB inside a blue transparent plastic case with a blue LED) and SIM (identified as a fakesupersim) with pysim tool. However i am getting the following error: /pySim-prog.py -n 26C3 -c 49 -x 262 -y 42 -z 1234 -j 1 -t auto Insert card now (or CTRL-C to cancel) Autodetected card type fakemagicsim Generated card parameters : > Name : 26C3 > SMSP : e1ffffffffffffffffffffffff058100945555ffffffffffff000000 > ICCID : 8949262427518313026 > MCC/MNC : 262/42 > IMSI : 262422461512085 > Ki : 7b74741a1ee14337ec23f9ab92a13648 > OPC : ccd867d60797d8d45354a51b3ef568ff Programming ... Traceback (most recent call last): File "./pySim-prog.py", line 530, in <module> card.program(cp) File "/home/nadicek/pysim/pysim/pySim/cards.py", line 231, in program self._scc.update_binary('6f30', hplmn + 'ff' * (tl-3)) File "/home/nadicek/pysim/pysim/pySim/commands.py", line 53, in update_binary return self._tp.send_apdu_checksw(pdu) File "/home/nadicek/pysim/pysim/pySim/transport/__init__.py", line 87, in send_apdu_checksw raise RuntimeError("SW match failed ! Expected %s and got %s." % (sw.lower(), rv[1])) RuntimeError: SW match failed ! Expected 9000 and got 9804. I checked mailing lists and haven’t found anybody who had similar problem with pysim. Also I have tried forcing different models of SIM, but nothing is working. Obviously I can remove this check from the script file (__init__.py in /pySim/transport), however somebody had a reason to put such condition there. I would like to ask if it is safe to remove that line of code and the purpose of that line of code. Thanks a lot and best regards Martin

3 3

Re: Help with sccp library
by mosbah abdelkader 07 Jul '25

07 Jul '25

> I don't understand. This callback will be called with data you need to write > to the network. In case of MTP Level3 you will need to wrap that around the > msgb you got. I means: is the interaction with mtp3 layer implemented (is sending sccp data by mtp3 implemented by the library?)? Also, what about the reception of data from mtp3 layer. is that implemented in the sccp lib. I am asking these questions because I see the code of mtp3 in the lib but no significant call is present in the sccp part of the lib. Thank you for your help.

4 3

cmd2 update causing pySim-shell to fail
by bryan coxwell 24 Jun '25

24 Jun '25

Hi all, Just wanted to share an issue and a quick workaround I found for it in case anyone else has the same problem. I believe a cmd2 update is causing pySim-shell to fail. After installing it on a fresh install of Ubuntu Server 20.04 and getting the following error when I run "python3 pySim-shell -p0": >Using PC/SC reader interface >Autodetected card type: sysmoUSIM-SJS1 >AIDs on card: > USIM: a0000000871002ffffffff8907090000 >Traceback (most recent call last): > File "pySim-shell.py", line 512, in <module> > app = PysimApp(card, rs, opts.script) > File "pySim-shell.py", line 59, in __init__ > super().__init__(persistent_history_file='~/.pysim_shell_history', allow_cli_args=False, use_ipython=True, auto_load_commands=False, command_sets=basic_commands, >startup_script=script) >TypeError: __init__() got an unexpected keyword argument 'use_ipython' If you run into this you can fix it by uninstalling cmd2 and reinstalling cmd2 with "pip3 install cmd2==1.5". Best, Bryan

5 5

dynamic traffic channels
by Neels Hofmeyr 20 May '25

20 May '25

On Tue, Jun 28, 2016 at 10:05:28AM +0200, Harald Welte wrote: > [translated from german] > is it certain that we switch a channel to PDCH only when > gprs mode != none? A TS can be GSM_PCHAN_TCH_F_PDCH; those are the only ones for which we send a PDCH ACT message. We send a PDCH ACT message - during init (CHANNEL OML's state changed to enabled -> send PDCH ACT), - and upon channel release ack when pchan == GSM_PCHAN_TCH_F_PDCH. So the question is, when we receive a channel release ack, could that be the PDCH release and we switch PDCH right back on by accident? No, because we only receive a chan rel ack when the *TCH/F* is being released. That is because the PDCH release is initiated "internally" from the PDCH DEACT, and thus this condition in common/rsl.c rsl_tx_rf_rel_ack() catches on, which existed before dyn PDCH: if (lchan->rel_act_kind != LCHAN_REL_ACT_RSL) { LOGP(DRSL, LOGL_NOTICE, "%s not sending REL ACK\n", gsm_lchan_name(lchan)); return 0; } In rsl_rx_rf_chan_rel() the rel_act_kind is set to LCHAN_REL_ACT_RSL, but not in the rsl_rx_dyn_pdch(). This is analogous to the ip.access way -- the ip.access nanobts replies to a PDCH DEACT with a PDCH DEACT ACK and doesn't send a separate channel release ack. Maybe we could set rel_act_kind to some new LCHAN_REL_ACT_IPAC_DYN_PDCH for clarity? (But we shouldn't actually send a release ack, to stay compatible.) Even though it works as-is, we should indeed add another flag check: - We do check the flags that no ACT/DEACT is already pending; - And we do send a PDCH DEACT only if ts->flags & TS_F_PDCH_ACTIVE; - But we would send a PDCH ACT despite ts->flags & TS_F_PDCH_ACTIVE. This should never happen, but it would make sense to ensure that. ~Neels

3 5

libosmocore/BSC/MSC: MO voice calls rejected from Siemens S11E (patch included)
by Lennart Müller 31 Jan '24

31 Jan '24

Hi, I had a problem placing MO GSM calls from a Siemens S11E: The calls were dropped immediately; Osmo-MSC reports "Cannot compose Channel Type from bearer capabilities" After investigating the SETUP request from the S11E, the phone does not use octet 3a (no extension bit set in IE 3). Wireshark decodes the radio channel requirement as "Full rate support only MS/fullrate speech version 1 supported", so I added a condition to the gsm48_ie.c function of libosmocore to include at least GSM FR in the list of available speech_ver in case octet 3 has no extension. Attached to this message are the Abis-IP PCAP traces of MO calls, and the patch for gsm48_ie.c. Regards, Lennart

6 6

Problem while running NIB on Open Cellular Base sation
by Brackley Casinga 31 Jan '24

31 Jan '24

Hi, My name is Brackley Cassinga Form DRC, we run a community network called pamoja net where we offer gsm services using osmocom open source software and OC Base station. Recently I have tried to install another base station as the same installed but I could not find any resource guiding through all the steps to take to run NIB on a base station. I'm currently running Ubuntu and I will appreciate if you could guide me on the installation of BSC,hlr,MSC , in order to run a basic gsm network. Thank you. Regards -- *Ir Brackley heshima Casinga **Pacifique* *CEO and Founder of kwanzatechnologie* KwanzaTechnologies ,GlobalElectronics +243977265291 | +243977265291 | Pcassinga(a)gmail.com/ brackley(a)ensemblepourladifference.org www.kwantechnologies.jimdosite.com <http://www.kwantechnologies.com/> | Skype: Brackley cassinga <https://webapp.wisestamp.com/#> Av Semliki N 43

2 1

MSC, SIP connector, and Asterisk
by James Connor 11 Jul '22

11 Jul '22

Hey all, I've got a bit of an interesting use case. I've been working to setup the OpenBSC components in order to simulate stress testing a GSM network. I've been able to get communications across the GSM working properly, with MSs able to place calls. However, part of what I'm trying to do involves routing to a simulated PSTN. I turned to sip-connector and asterisk, but my network immediately stopped working once I told the MSC to use an external MNCC. The setup involves two separate computers. The first is the BSS, which has a BSC, MGW, virtual BTS, and two MSs running on mobile and virtphy. The second is the NSS, with the MSC/VLR, HLR, MGW, and STP. The GSM is split between the two devices because of the eventual goal to increase the number of BSSs to better simulate a real-world GSM. This was all working fine, until I modified osmo-msc.cfg to include "mncc external /tmp/msc_mncc". In parallel, I setup osmo-sip-connector and ran it on the NSS through the same "/tmp/msc_mncc" socket, pointing it at Asterisk (also on the NSS). This was all done according to the instructions listed here: https://osmocom.org/projects/osmo-sip-conector/wiki/Howto. Now whenever I place my calls (which I do through mobile's "call" VTY command on the BSS), the call doesn't connect and simply gets released after 30 seconds. After doing some debugging, I've determined that Asterisk is not receiving anything from the sip-connector. Meanwhile, the sip-connector is being told to delete any connection basically as soon as it's created: <0001> mncc.c:1005 MNCC rcvd message type: MNCC_SETUP_IND <0001> mncc.c:566 Created call(5004) with MNCC leg(2147483652) IMSI(001010000000001) <0001> mncc.c:68 Starting Timer for MNCC_RTP_CREATE <0001> mncc.c:164 MNCC sent message type: MNCC_RTP_CREATE <0001> mncc.c:1005 MNCC rcvd message type: MNCC_REL_IND <0001> mncc.c:636 Rcvd MNCC_REL_IND, Cause: RESOURCE_UNAVAIL <0001> mncc.c:648 leg(2147483652) was released. <0002> call.c:90 call(5004) released. The MSC has the following as part of its output when a call is placed: ... <0020> osmo_ss7.c:1933 0: asp-OsmoMSC-asp: xua_cli_read_cb(): sctp_recvmsg() returned 48 (flags=0x80) <0023> m3ua.c:714 0: asp-OsmoMSC-asp: Received M3UA Message (XFER:DATA) <0023> m3ua.c:543 0: asp-OsmoMSC-asp: m3ua_rx_xfer <0023> m3ua.c:566 0: asp-OsmoMSC-asp: m3ua_rx_xfer(): M3UA data header: opc=2233=1.23.1 dpc=185=0.23.1 <0020> osmo_ss7_hmrt.c:276 m3ua_hmdc_rx_from_l2(): found dpc=185=0.23.1 as local <0020> sccp_scrc.c:472 scrc_rx_mtp_xfer_ind_xua: HDR=(CO:CODT,V=0,LEN=0), PART(T=Destination Reference,L=4,D=00000007), PART(T=Segmentation,L=4,D=00000000), PART(T=Data,L=6,D=000422040120) <0021> sccp_scoc.c:1664 Received CO:CODT for local reference 7 <0021> sccp_scoc.c:1698 SCCP-SCOC(7)[0x555adb5ddf40]{ACTIVE}: Received Event RCOC-DT1.ind <0021> sccp_user.c:175 Delivering N-DATA.indication to SCCP User 'OsmoMSC-A' <0011> sccp_ran.c:108 (GERAN-A-7) sccp_ran_sap_up(N-DATA.indication) <0003> ran_peer.c:591 ran_peer(GERAN-A:RI-SSN_PC:PC-1-23-1:SSN-BSSAP)[0x555adb5b1010]{READY}: Received Event RAN_PEER_EV_MSG_UP_CO <0007> ran_peer.c:407 msc_i(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5d97e0]{READY}: Received Event MSC_EV_FROM_RAN_UP_L2 <0011> ran_msg_a.c:790 msc_i(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5d97e0]{READY}: RAN decode: BSSMAP: CLEAR REQUEST <0007> msc_i.c:85 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: Received Event MSC_A_EV_FROM_I_PROCESS_ACCESS_SIGNALLING_REQUEST <000b> msc_a.c:196 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: + msc_a_ran_dec: now used by 2 (cc,msc_a_ran_dec) <0011> ran_msg_a.c:790 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: RAN decode: BSSMAP: CLEAR REQUEST <0011> msc_a.c:1612 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: RAN decode: BSSMAP Clear Request <0007> msc_a.c:1433 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: Received Event MSC_A_EV_MO_CLOSE <0007> msc_a.c:733 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_COMMUNICATING}: State change to MSC_A_ST_RELEASING (X2, 30s) <0011> msc_a.c:769 msc_a(IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ)[0x555adb5daa50]{MSC_A_ST_RELEASING}: Releasing: msc_a use is 2 (cc,msc_a_ran_dec) <000b> msc_a.c:773 VLR subscr IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97 + msc_a_fsm_releasing_onenter: now used by 4 (attached,active-conn,CC,msc_a_fsm_releasing_onenter) <000b> vlr.c:309 VLR subscr IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97 + vlr_subscr_cancel_attach_fsm: now used by 5 (attached,active-conn,CC,msc_a_fsm_releasing_onenter,vlr_subscr_cancel_attach_fsm) <000b> vlr.c:314 VLR subscr IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97 - vlr_subscr_cancel_attach_fsm: now used by 4 (attached,active-conn,CC,msc_a_fsm_releasing_onenter) <0001> transaction.c:230 trans(CC:INITIATED IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ callref-0x80000003 tid-8) Freeing transaction <0005> gsm_04_08_cc.c:237 trans(CC:INITIATED IMSI-001010000000001:MSISDN-1234567891:TMSI-0x9B96EF97:GERAN-A-7:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_REL_IND ... Any thoughts as to why this one change to my GSM is suddenly stopping it from functioning properly? Thanks, any help is greatly appreciated! - James P.S. I didn't want to include my config files for fear of making this message absurdly long, but let me know if you want to see any and I'll gladly post them.

4 6

Using a mixture of authentication-required and unauthenticated IMSIs
by Mychaela Falconia 01 Jul '22

01 Jul '22

Hello Osmocom community, A question: is it possible to configure OsmoMSC+OsmoHLR such that authentication is required for those IMSIs for which key material records are present in HLR subscriber db, yet allow unauthenticated access for certain other IMSIs (specific ones, *not* accept-all) that are entered into HLR subscriber db without keys? My use case: I generally operate my network with SIMs of my own issue, and I wish to continue enforcing authentication (and using ciphering) for all Themyscira SIMs. However, I would like to play with some old phone models which cannot be found unlocked - only operator-locked units can be found on ebay - and some of those historical operator- locked phones come with SIM cards in them, issued by historical operators who have bit the dust ages ago. It would be really nice if I could add the IMSIs of those defunct-operator SIMs to my HLR subscriber db and allow them to connect - which would have to be unauthenticated, as I don't know their Ki or even their A38 algorithm version - but do so _without_ dropping the authentication requirement for my own Themyscira IMSIs. Is what I seek possible with current OsmoMSC and OsmoHLR? And if it isn't possible with current code, any ideas as to what would be the right way to implement such a feature? TIA, Mychaela

1 0

RFC: Reviving OsmoDevCall
by Harald Welte 28 Jun '22

28 Jun '22

[please follow-up-to openbsc(a)lists.osmocom.org so we don't cross-post all related mails] Dear Osmocom community, OsmoDevCall used to be rather successful for quite some time in recent years, but recently has been suffering quite a bit due to insufficient people volunteering to present. Big thanks to all who did! Interestingly, there's no shortage of ideas of topics at https://osmocom.org/projects/osmo-dev-con/wiki/OsmoDevCall - but then many of the potential speakers did not have the interest or time to follow-up. Most recently, the last few instances have not been taking place due to a lack of volunteers during my holidays. Last, but not least, while during COVID lockdown winter "friday night 8pm" was a good idea, this of course is more difficult during the summer, when people are more likely want to go out the weekend. So, to summarize, let me ask some questions: * would you be interested in OsmoDevCall continuing? * which day/time/timezone would you prefer ? * would you be able and willing to volunteer to give at talk within the next 3 or so months? Any other suggestions for or around OsmoDevCall are of course also welcome. Thanks in advance, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 3

dazed and confused.
by Keith 27 Jun '22

27 Jun '22

Often I struggle to understand memory allocations and the "weird" things of C, so please point out to me what I'm missing here (I must be wrong, because you guys would not miss this, right? cleared_ci = (struct osmo_mgcpc_ep_ci){ .ep = ep, .mgcp_client_fi = ci->mgcp_client_fi, .got_port_info = ci->got_port_info, .rtp_info = ci->rtp_info, .occupied = true, /* .pending = true follows below */ .verb = verb, .notify = { .fi = notify, .success = event_success, .failure = event_failure, .data = notify_data, } }; osmo_strlcpy(cleared_ci.label, ci->label, sizeof(cleared_ci.label)); osmo_strlcpy(cleared_ci.mgcp_ci_str, ci->mgcp_ci_str, sizeof(cleared_ci.mgcp_ci_str)); *ci = cleared_ci; LOG_CI_VERB(ci, LOGL_DEBUG, "notify=%s\n", osmo_fsm_inst_name(ci->notify.fi)); #define LOG_CI_VERB(ci, level, fmt, args...) do { \ if (ci->verb_info.addr[0]) \ LOG_CI(ci, level, "%s %s:%u: " fmt, \ osmo_mgcp_verb_name(ci->verb), ci->verb_info.addr, ci->verb_info.port, \ ## args); \ else \ LOG_CI(ci, level, "%s: " fmt, \ osmo_mgcp_verb_name(ci->verb), \ ## args); \ } while(0) How is ci->verb_info not being using uninitialized here? Would that explain random crashes with this code? https://osmocom.org/issues/5572

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC June 2022