- OpenBSC - lists.osmocom.org

[scan-admin@coverity.com: New Defects reported by Coverity Scan for Osmocom]
by Neels Hofmeyr 22 Oct '16

22 Oct '16

Hi, Please find the latest report on new defect(s) introduced to Osmocom found with Coverity Scan. 2 new defect(s) introduced to Osmocom found with Coverity Scan. 1 defect(s), reported by Coverity Scan earlier, were marked fixed in the recent build analyzed by Coverity Scan. New defect(s) Reported-by: Coverity Scan Showing 2 of 2 defect(s) ** CID 150437: Insecure data handling (TAINTED_SCALAR) /source-Osmocom/libosmo-abis/src/input/misdn.c: 462 in handle_ts_raw_read() ________________________________________________________________________________________________________ *** CID 150437: Insecure data handling (TAINTED_SCALAR) /source-Osmocom/libosmo-abis/src/input/misdn.c: 462 in handle_ts_raw_read() 456 DEBUGP(DLMIB, "<= RAW CHAN len = %d, prim(0x%x) id(0x%x): %s\n", 457 ret, hh->prim, hh->id, 458 get_value_string(prim_names, hh->prim)); 459 460 switch (hh->prim) { 461 case PH_DATA_IND: >>> CID 150437: Insecure data handling (TAINTED_SCALAR) >>> Assigning: "msg->l2h" = "msg->data + 8UL". Both are now tainted. 462 msg->l2h = msg->data + MISDN_HEADER_LEN; 463 DEBUGP(DLMIB, "RAW CHAN RX: %s\n", 464 osmo_hexdump(msgb_l2(msg), ret - MISDN_HEADER_LEN)); 465 /* the number of bytes received indicates that data to send */ 466 handle_ts_raw_write(bfd, msgb_l2len(msg)); 467 return e1inp_rx_ts(e1i_ts, msg, 0, 0); ** CID 150436: API usage errors (PW.PRINTF_ARG_MISMATCH) /source-Osmocom/osmo-pcu/src/tbf_dl.cpp: 310 in () ________________________________________________________________________________________________________ *** CID 150436: API usage errors (PW.PRINTF_ARG_MISMATCH) /source-Osmocom/osmo-pcu/src/tbf_dl.cpp: 310 in () 304 msgb_free(msg); 305 bts->llc_dropped_frame(); 306 continue; 307 } 308 309 if (frames) { >>> CID 150436: API usage errors (PW.PRINTF_ARG_MISMATCH) >>> argument is incompatible with corresponding format string conversion 310 LOGP(DRLCMACDL, LOGL_NOTICE, "%s Discarding LLC PDU " 311 "because lifetime limit reached, " 312 "count=%u new_queue_size=%zu\n", 313 tbf_name(this), frames, llc_queue_size()); 314 if (frames > 0xff) 315 frames = 0xff;

3 4

Review of conv_gen changes
by Harald Welte 21 Oct '16

21 Oct '16

Hi Sylvian, I was hoping that you could review the conv_gen.py and related changes that Vadim has been working on. I don't feel familiar enough with the code (and not morally authorized to merge such significant canges) to your code. The code is at https://gerrit.osmocom.org/#/c/828/5 as well as related changes like https://gerrit.osmocom.org/#/c/829/4 Thanks! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

2 1

new warnings because of ctrl constify
by Neels Hofmeyr 20 Oct '16

20 Oct '16

Presumably after this libosmocore commit, I get scores of new warnings (see below) when compiling openbsc: commit ed9d6da5df98538adc70aa03cb569eb9505d04b6 Author: Max <msuraev(a)sysmocom.de> AuthorDate: Tue Oct 11 15:20:28 2016 +0200 Constify ctrl_cmd struct fields where appropriate Some of these can be fixed by constifying the functions as well, but talloc_free() of a const char * looks really wrong? Please follow up on this or revert the commit... constifying is good, but having twice the amount of warnings means twice the reading effort during development cycles. I would most prefer a revert now and come back as soon as no new warnings are introduced; ymmv... In file included from /usr/local/include/osmocom/core/talloc.h:4:0, from ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:22: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c: In function ‘bsc_nat_handle_ctrlif_msg’: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:131:16: warning: passing argument 1 of ‘_talloc_free’ discards ‘const’ qualifier from pointer target type talloc_free(cmd->variable); ^ /usr/include/talloc.h:227:5: note: expected ‘void *’ but argument is of type ‘const char *’ int _talloc_free(void *ptr, const char *location); ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:143:34: warning: passing argument 2 of ‘bsc_get_pending’ discards ‘const’ qualifier from pointer target type pending = bsc_get_pending(bsc, cmd->id); ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:86:29: note: expected ‘char *’ but argument is of type ‘const char *’ static struct bsc_cmd_list *bsc_get_pending(struct bsc_connection *bsc, char *id_str) ^ ../../../src/osmo-bsc_nat/bsc_ussd.c: In function ‘bsc_ussd_check’: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c: In function ‘forward_to_bsc’: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:228:31: warning: passing argument 1 of ‘extract_bsc_nr_variable’ discards ‘const’ qualifier from pointer target type if (!extract_bsc_nr_variable(cmd->variable, &nr, &bsc_variable)) { ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:198:12: note: expected ‘char *’ but argument is of type ‘const char *’ static int extract_bsc_nr_variable(char *variable, unsigned int *nr, char **bsc_variable) ^ In file included from /usr/local/include/osmocom/core/talloc.h:4:0, from ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:22: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:259:16: warning: passing argument 1 of ‘_talloc_free’ discards ‘const’ qualifier from pointer target type talloc_free(bsc_cmd->id); ^ /usr/include/talloc.h:227:5: note: expected ‘void *’ but argument is of type ‘const char *’ int _talloc_free(void *ptr, const char *location); ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:266:16: warning: passing argument 1 of ‘_talloc_free’ discards ‘const’ qualifier from pointer target type talloc_free(bsc_cmd->variable); ^ /usr/include/talloc.h:227:5: note: expected ‘void *’ but argument is of type ‘const char *’ int _talloc_free(void *ptr, const char *location); ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c: In function ‘extract_bsc_cfg_variable’: ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:323:31: warning: passing argument 1 of ‘extract_bsc_nr_variable’ discards ‘const’ qualifier from pointer target type if (!extract_bsc_nr_variable(cmd->variable, &nr, bsc_variable)) { ^ ../../../src/osmo-bsc_nat/bsc_nat_ctrl.c:198:12: note: expected ‘char *’ but argument is of type ‘const char *’ static int extract_bsc_nr_variable(char *variable, unsigned int *nr, char **bsc_variable) ^ -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 5

Probleme mit pySim
by Ivaylo Kostov 19 Oct '16

19 Oct '16

Hallo zusammen, wegen meines Versuch die pySim zu verwenden habe ich folgendes bekommen: > ./pySim-read.py -p 0 > Reading ... > Traceback (most recent call last): > File "./pySim-read.py", line 90, in <module> > (res, sw) = scc.read_binary(['3f00', '2fe2']) > File "/home/wirelesss/net/pysim/pySim/commands.py", line 51, in > read_binary > r = self.select_file(ef) > File "/home/wirelesss/net/pysim/pySim/commands.py", line 44, in > select_file > data, sw = self._tp.send_apdu_checksw(self.cla_byte + "a4000C02" + i) > File "/home/wirelesss/net/pysim/pySim/transport/__init__.py", line > 87, in send_apdu_checksw > raise RuntimeError("SW match failed ! Expected %s and got %s." % > (sw.lower(), rv[1])) > RuntimeError: SW match failed ! Expected 9000 and got 6b00. > $ ./pySim-read.py -p 1 > Traceback (most recent call last): > File "./pySim-read.py", line 78, in <module> > sl = PcscSimLink(opts.pcsc_dev) > File "/home/wirelesss/net/pysim/pySim/transport/pcsc.py", line 38, > in __init__ > self._reader = r[reader_number] > IndexError: list index out of range > Exception AttributeError: "'PcscSimLink' object has no attribute > '_con'" in <bound method PcscSimLink.__del__ of > <pySim.transport.pcsc.PcscSimLink object at 0x7f3dca255750>> ignored wenn man ./pySim-prog.py gebe, dann das Ergebnis auch nicht so richtig ist. > ./pySim-prog.py -p 0 -t sysmosim-gr1 -i 001640000000072 -c 001 -x 001 > -y 64 -s 1791198229180000071 > Insert card now (or CTRL-C to cancel) > Generated card parameters : > > Name : Magic > > SMSP : e1ffffffffffffffffffffffff0581005155f5ffffffffffff000000 > > ICCID : 1791198229180000071 > > MCC/MNC : 1/64 > > IMSI : 001640000000072 > > Ki : 895c5a0e9e5f635111d6c366ae8c957f > > OPC : a230dcc3c71c17019189a8be734f9c74 > > ACC : None > > Programming ... > Traceback (most recent call last): > File "./pySim-prog.py", line 626, in <module> > card.program(cp) > File "/home/wirelesss/net/pysim/pySim/cards.py", line 274, in program > r = self._scc.select_file(['3f00', '2fe2']) > File "/home/wirelesss/net/pysim/pySim/commands.py", line 44, in > select_file > data, sw = self._tp.send_apdu_checksw(self.cla_byte + "a4000C02" + i) > File "/home/wirelesss/net/pysim/pySim/transport/__init__.py", line > 87, in send_apdu_checksw > raise RuntimeError("SW match failed ! Expected %s and got %s." % > (sw.lower(), rv[1])) > RuntimeError: SW match failed ! Expected 9000 and got 6b00. Kommando: pcsc_scan funktioniert reibungslos. Grüße, Ivaylo -- - Ivaylo Kostov <ikostov(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

3 5

pysim Fakemagicsim problem + workaround Fwd: SIM Card Reader Problem!!
by Martin Dudok van Heel 19 Oct '16

19 Oct '16

Second try. (I already sent this mail yesterday, but it did not appear in the mailinglist. I do not know why. Maybe because I attached a file (a patch)) Hi all, This is my first post to the OpenBSC mailinglist. I had a problem with the latest pysim version giving errors while trying to program 2G (Fake)MagicSIM cards. This had worked fine in the past with an older release from 2011. I tried al lot of versions in between. I was finally able to narrow it down to the commit that broke compatibility with (fake)magicsim: http://cgit.osmocom.org/pysim/commit/pySim/commands.py?id=8c1b33c439fef423c… The comment with this comit is: "Do not return the FCI information while selecting a file The sysmoUSIM-SJS1 card does not support returning the FCI information. Plus, the FCI information are not used anyway." If I revert the change with attached patch, it works again. But it may break sysmoUSIM-SJS1 compatibility. I am not sure on how to test whether the programming of sysmoUSIM-SJS1 still works fine and if the SIMS themselves then will still work as expected with OpenBSC or OpenBTS or OpenAirinterface. If the code needs to stay in for sysmoUSIM-SJS1 then we probably need somehing like the pseudocode below: if carttype is fakemagicsim: "a4000002" elif cardtype is sysmoUSIM-SJS1: "a4000C02" else: #What should be the default for the other cards? Or is there another solution? With best regards, Martin Dudok van Heel This is the patch inline (attaching it as a file, blocked my email from going through) mdvh_pysim_make_fakesim_work_again_patch_2016081201.diff diff --git a/pySim/commands.py b/pySim/commands.py index 721b3d4..b7fb77f 100644 --- a/pySim/commands.py +++ b/pySim/commands.py @@ -41,7 +41,7 @@ class SimCardCommands(object): def select_file(self, dir_list): rv = [] for i in dir_list: - data, sw = self._tp.send_apdu_checksw(self.cla_byte + "a4000C02" + i) + data, sw = self._tp.send_apdu_checksw(self.cla_byte + "a4000002" + i) rv.append(data) return rv On 12-08-16 09:50, Holger Freyther wrote: >> On 12 Aug 2016, at 09:18, Rene Groothuis wrote: >> >> Hello, > Hi! > > >> I’m still having problems, sorry to report this. Below the log file >> of different combinations: >> > >> I’ve used different (same model) SIM cards. I’ve reinstated the USB >> reader. Tried in different USB ports. No Luck. >> >> What am I doing wrong, can you please help? >> >> > Sysmocom sold the last 16in1 magicsim in 2012? Did you buy these cards > from us? Maybe this specific one is just broken? Maybe try an older > version of pySIM? E.g. maybe some of the patches required for the > sysmoUSIM-SJS1 broke magicsim support? > > In the future you could consider getting the sysmoUSIM-SJS1 from us, > they are of way higher quality than the Chinese (GRcard, magicsim, > etc.) ones. For emergencies like these it might make sense for you to > get a support contract from sysmocom as well. > > good luck > > holger > >

2 1

osmo-trx and gpsdo
by Max 18 Oct '16

18 Oct '16

Hi. While trying to make osmo-trx work in multichannel configuration I've found following: - running "./Transceiver52M/osmo-trx -m -c 2 -l INFO" works but - running "./Transceiver52M/osmo-trx -m -c 2 -l INFO -g" gives following: linux; GNU C++ version 4.8.4; Boost_105400; UHD_003.010.000.000-release opening configuration table from path :memory: Config Settings Log Level............... INFO Device args............. TRX Base Port........... 5700 TRX Address............. 127.0.0.1 Channels................ 2 Tx Samples-per-Symbol... 4 Rx Samples-per-Symbol... 4 EDGE support............ Disabled Reference............... GPS C0 Filler Table......... Disabled Multi-Carrier........... Enabled Diversity............... Disabled Tuning offset........... 0 RSSI to dBm offset...... 0 Swap channels........... 0 INFO 3032180480 13:36:38.4 UHDDevice.cpp:786:open: Using discovered UHD device type=b200,name=MyB210,serial=30AC26A,product=B210 -- Detected Device: B210 -- Operating over USB 2. -- Initialize CODEC control... -- Initialize Radio control... -- Performing register loopback test... pass -- Performing register loopback test... pass -- Performing CODEC loopback test... pass -- Performing CODEC loopback test... pass -- Setting master clock rate selection to 'automatic'. -- Asking for clock rate 16.000000 MHz... -- Actually got clock rate 16.000000 MHz. -- Performing timer loopback test... pass -- Performing timer loopback test... pass INFO 3032180480 13:36:41.6 UHDDevice.cpp:743:parse_dev_type: Using USRP1 type transmit window for B-Series Device B210 terminate called after throwing an instance of 'uhd::key_error' what(): LookupError: KeyError: update_clock_source: unknown source: gpsdo Aborted (core dumped) The tests were performed with usrp B210 and rather recent uhd (see above). Is this some know error/hw incompatibility? -- Max Suraev <msuraev(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

2 5

osmo-trx gerrit
by Neels Hofmeyr 18 Oct '16

18 Oct '16

<bump> https://gerrit.osmocom.org/1067 Would be nice to have the build script in master, and at the same time verify that you have +2 voting powers on osmo-trx -- you're currently the only one there. Feel free to appoint other reviewers at your discretion (tell me). Thanks! ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 2

creepy dirs in osmo-bts/tests
by Max 17 Oct '16

17 Oct '16

Hi. I've ran "make check" in osmo-bts recently ang got weird dir names in tests/*/ like '$srcdir' - it seems like those should be evaluated variable but it's written literally to FS. Do you guys see it as well or it's some glitch local to my shell? -- Max Suraev <msuraev(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschaeftsfuehrer / Managing Director: Harald Welte

2 1

bind & connect
by Neels Hofmeyr 17 Oct '16

17 Oct '16

Hi osmo_sock experts, I'm currently looking at making the osmo-hnbgw interface addresses configurable, an I came across a detail. This is not really pressing, but while I'm at it I might as well cover all of the addresses. So far I see in osmo-iuh's hnbgw.c the local address osmo-hnbgw uses to accept Iuh connections from a 3G cell, and the remote addresses of IuCS and IuPS, each passed to osmo_sock_init(): 3G cell -------> 1.2.3.4 OSMO-HNBGW IuPS-local? -------> 10.9.8.7 OSMO-SGSN So we tell one socket to listen on local 1.2.3.4 for Iuh. We tell another to send IuPS to 10.9.8.7. But how would I tell the IuPS to use a given local interface 1.2.3.5 to contact the SGSN's address? Would I bind() to a given local IP address and connect() to the remote one? I must admit that the details are not 100% clear to me. AFAIK it can be important to set a local IP address and port to send from. So if there's something I don't understand yet I would appreciate a hint. Anyway, in osmo_sock_init, I see: if ((flags & (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT)) == (OSMO_SOCK_F_BIND | OSMO_SOCK_F_CONNECT)) { fprintf(stderr, "invalid: both bind and connect flags set:" " %s:%u\n", host, port); return -EINVAL; } Should we have another osmo_sock_init that can set up a socket like this code I found somewhere at sysmocom to define both ends of a connection? fd = socket(AF_INET, SOCK_DGRAM, 0); if (fd < 0) { printf("socket() failed: %s\n", strerror(errno)); return -1; } memset(&bindaddr, 0, sizeof(bindaddr)); bindaddr.sin_family = AF_INET; bindaddr.sin_port = htons(lport); rc = inet_pton(AF_INET, baddr, &(bindaddr.sin_addr)); if (rc != 1) { printf("inet_pton() failed with %i: %s\n", rc, strerror(errno)); return -1; } rc = bind(fd, (struct sockaddr *)&bindaddr, sizeof(bindaddr)); if (rc < 0) { printf("bind() failed: %s\n", strerror(errno)); return -1; } memset(&destaddr, 0, sizeof(destaddr)); destaddr.sin_family = AF_INET; destaddr.sin_port = htons(dport); rc = inet_pton(AF_INET, dest, &(destaddr.sin_addr)); if (rc != 1) { printf("inet_pton() failed with %i: %s\n", rc, strerror(errno)); return -1; } rc = connect(fd, (const struct sockaddr *)&destaddr, sizeof(destaddr)); if (rc < 0) { printf("connect() failed: %s\n", strerror(errno)); return -1; } rc = send(fd, buf, len, 0); if (rc != len) { printf("send() failed\n"); return -1; } Thanks, ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

2 4

moved to gerrit patch submission
by Neels Hofmeyr 14 Oct '16

14 Oct '16

The following git repositories have now moved to gerrit, please submit future patches for these at gerrit.osmocom.org, no longer via mailing lists: osmo-gsm-manuals asn1c libasn1c osmo-trx openpcd osmo-sim-auth libtelnet mncc-python osmocom-lcs Thanks, ~Neels -- - Neels Hofmeyr <nhofmeyr(a)sysmocom.de> http://www.sysmocom.de/ ======================================================================= * sysmocom - systems for mobile communications GmbH * Alt-Moabit 93 * 10559 Berlin, Germany * Sitz / Registered office: Berlin, HRB 134158 B * Geschäftsführer / Managing Directors: Harald Welte

1 0