- OpenBSC - lists.osmocom.org

Failing test suite (gbproxy)
by Ciaby 14 Nov '14

14 Nov '14

I'm trying to build debian packages of OpenBSC. The test suite is failing on the gbproxy test (core dump). Attached is the testsuite.log file. Cheers Ciaby

2 1

[PATCH] Fix debian packaging
by Ciaby 11 Nov '14

11 Nov '14

- Added debian/libosmosim0.install - Added libosmosim definition in debian/control --- debian/control | 6 ++++++ debian/libosmosim0.install | 1 + 2 files changed, 7 insertions(+) create mode 100644 debian/libosmosim0.install diff --git a/debian/control b/debian/control index cde3713..ccc7331 100644 --- a/debian/control +++ b/debian/control @@ -50,6 +50,12 @@ Architecture: any Depends: ${shlibs:Depends}, ${misc:Depends} Description: Osmo control library +Package: libosmosim0 +Section: libs +Architecture: any +Depends: ${shlibs:Depends}, ${misc:Depends} +Description: Osmo SIM library + Package: libosmocore-dev Section: libdevel Architecture: any diff --git a/debian/libosmosim0.install b/debian/libosmosim0.install new file mode 100644 index 0000000..8f29c4d --- /dev/null +++ b/debian/libosmosim0.install @@ -0,0 +1 @@ +usr/lib/libosmosim*.so.* -- 1.7.9.5

2 4

Possible crash/malfunction in the handover code
by Ciaby 11 Nov '14

11 Nov '14

We have been experiencing problems with osmo-nitb since we enabled handover. Sometimes osmo-nitb crashes, and our users have reported the fact that sometimes they end up listening to someone's else conversation. This started to happen since we enabled handover. This is the backtrace i got from a core dump of osmo-nitb: (gdb) bt #0 subscr_name (subscr=0x0) at gsm_subscriber_base.c:47 #1 0x00000000004079e3 in ho_gsm48_ho_compl (new_lchan=0x7fb1a80dd0b0) at handover_logic.c:259 #2 ho_logic_sig_cb (signal_data=<optimized out>, signal=<optimized out>, subsys=<optimized out>, handler_data=<optimized out>) at handover_logic.c:353 #3 ho_logic_sig_cb (subsys=<optimized out>, signal=<optimized out>, handler_data=<optimized out>, signal_data=<optimized out>) at handover_logic.c:335 #4 0x00007fb1a76dccec in osmo_signal_dispatch (subsys=4, signal=3, signal_data=0x7ffffe668090) at signal.c:105 #5 0x0000000000408d25 in handle_rr_ho_compl (msg=<optimized out>) at bsc_api.c:524 #6 dispatch_dtap (msg=0x2436980, link_id=<optimized out>, conn=0xc8e070) at bsc_api.c:583 #7 gsm0408_rcvmsg (msg=0x2436980, link_id=<optimized out>) at bsc_api.c:657 #8 0x000000000041fde1 in abis_rsl_rx_rll (msg=0x2436980) at abis_rsl.c:1682 #9 abis_rsl_rcvmsg (msg=0x2436980) at abis_rsl.c:2093 #10 0x00007fb1a74cce5a in handle_ts1_read (bfd=0x90d6b8) at input/ipaccess.c:469 #11 ipaccess_fd_cb (bfd=0x90d6b8, what=1) at input/ipaccess.c:603 #12 0x00007fb1a76dca11 in osmo_select_main (polling=0) at select.c:158 #13 0x0000000000406e34 in main (argc=<optimized out>, argv=0x7ffffe6684f8) at bsc_hack.c:354 Any clue about why this is happening? Cheers Ciaby

2 6

Possible crash/malfunction in the handover code
by Ciaby 10 Nov '14

10 Nov '14

We have been experiencing problems with osmo-nitb since we enabled handover. Sometimes osmo-nitb crashes, and our users have reported the fact that sometimes they end up listening to someone's else conversation. This started to happen since we enabled handover. This is the backtrace i got from a core dump of osmo-nitb: (gdb) bt #0 subscr_name (subscr=0x0) at gsm_subscriber_base.c:47 #1 0x00000000004079e3 in ho_gsm48_ho_compl (new_lchan=0x7fb1a80dd0b0) at handover_logic.c:259 #2 ho_logic_sig_cb (signal_data=<optimized out>, signal=<optimized out>, subsys=<optimized out>, handler_data=<optimized out>) at handover_logic.c:353 #3 ho_logic_sig_cb (subsys=<optimized out>, signal=<optimized out>, handler_data=<optimized out>, signal_data=<optimized out>) at handover_logic.c:335 #4 0x00007fb1a76dccec in osmo_signal_dispatch (subsys=4, signal=3, signal_data=0x7ffffe668090) at signal.c:105 #5 0x0000000000408d25 in handle_rr_ho_compl (msg=<optimized out>) at bsc_api.c:524 #6 dispatch_dtap (msg=0x2436980, link_id=<optimized out>, conn=0xc8e070) at bsc_api.c:583 #7 gsm0408_rcvmsg (msg=0x2436980, link_id=<optimized out>) at bsc_api.c:657 #8 0x000000000041fde1 in abis_rsl_rx_rll (msg=0x2436980) at abis_rsl.c:1682 #9 abis_rsl_rcvmsg (msg=0x2436980) at abis_rsl.c:2093 #10 0x00007fb1a74cce5a in handle_ts1_read (bfd=0x90d6b8) at input/ipaccess.c:469 #11 ipaccess_fd_cb (bfd=0x90d6b8, what=1) at input/ipaccess.c:603 #12 0x00007fb1a76dca11 in osmo_select_main (polling=0) at select.c:158 #13 0x0000000000406e34 in main (argc=<optimized out>, argv=0x7ffffe6684f8) at bsc_hack.c:354 Any clue about why this is happening? Cheers Ciaby

1 0

[PATCH] bsc: Fix use-after-free on OML NM messages from the BTS
by Jacob Erlbeck 10 Nov '14

10 Nov '14

Currently the sign_link pointer is dereferenced after a call to osmo_signal_dispatch, which can indirectly call e1inp_sign_link_destroy. If that happens, accessing *sign_link is illegal and can lead to a segmentation violation. Since only the bts pointer is needed from sign_link after the call to osmo_signal_dispatch, this patch changes abis_nm_rcvmsg_fom to save that pointer to a local variable earlier. Addresses: <0019> input/ipa.c:250 accept()ed new link from 192.168.1.101 to port 3002 SET ATTR NACK CAUSE=Message cannot be performed <0005> bsc_init.c:52 Got a NACK going to drop the OML links. <001b> bsc_init.c:319 Lost some E1 TEI link: 1 0xb351a830 ================================================================= ==13198== ERROR: AddressSanitizer: heap-use-after-free on address 0xb5d1bc70 at pc 0x80a6e3d bp 0xbfbb33d8 sp 0xbfbb33cc Sponsored-by: On-Waves ehf --- openbsc/src/libbsc/abis_nm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/openbsc/src/libbsc/abis_nm.c b/openbsc/src/libbsc/abis_nm.c index 3bf55ec..89ffea4 100644 --- a/openbsc/src/libbsc/abis_nm.c +++ b/openbsc/src/libbsc/abis_nm.c @@ -565,6 +565,8 @@ static int abis_nm_rcvmsg_fom(struct msgb *mb) struct abis_om_fom_hdr *foh = msgb_l3(mb); struct e1inp_sign_link *sign_link = mb->dst; uint8_t mt = foh->msg_type; + /* sign_link might get deleted via osmo_signal_dispatch -> save bts */ + struct gsm_bts *bts = sign_link->trx->bts; int ret = 0; /* check for unsolicited message */ @@ -593,7 +595,7 @@ static int abis_nm_rcvmsg_fom(struct msgb *mb) nack_data.mt = mt; nack_data.bts = sign_link->trx->bts; osmo_signal_dispatch(SS_NM, S_NM_NACK, &nack_data); - abis_nm_queue_send_next(sign_link->trx->bts); + abis_nm_queue_send_next(bts); return 0; } #if 0 @@ -636,7 +638,7 @@ static int abis_nm_rcvmsg_fom(struct msgb *mb) break; } - abis_nm_queue_send_next(sign_link->trx->bts); + abis_nm_queue_send_next(bts); return ret; } -- 1.9.1

1 0

[PATCH] bssgp: Fix VTY command 'show bssgp nsei N'
by Jacob Erlbeck 10 Nov '14

10 Nov '14

Currently this command segfaults (at least when ASAN is enabled), because when getting the NSEI the index to argv is wrong and out of bounds. This patch fixes the offset. Sponsored-by: On-Waves ehf --- src/gb/gprs_bssgp_vty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gb/gprs_bssgp_vty.c b/src/gb/gprs_bssgp_vty.c index 656c05e..88ae49f 100644 --- a/src/gb/gprs_bssgp_vty.c +++ b/src/gb/gprs_bssgp_vty.c @@ -135,7 +135,7 @@ DEFUN(show_bvc, show_bvc_cmd, "show bssgp nsei <0-65535> [stats]", "The NSEI\n" "Include Statistics\n") { struct bssgp_bvc_ctx *bvc; - uint16_t nsei = atoi(argv[1]); + uint16_t nsei = atoi(argv[0]); int show_stats = 0; if (argc >= 2) -- 1.9.1

1 0

[PATCH] Fix bunch of printf warnings
by Max 26 Oct '14

26 Oct '14

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- openbsc/src/libbsc/bsc_api.c | 4 ++-- openbsc/src/libmgcp/mgcp_protocol.c | 2 +- openbsc/tests/abis/abis_test.c | 16 ++++++++-------- openbsc/tests/gbproxy/gbproxy_test.c | 16 ++++++++-------- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/openbsc/src/libbsc/bsc_api.c b/openbsc/src/libbsc/bsc_api.c index 5ce0bc4..f4121de 100644 --- a/openbsc/src/libbsc/bsc_api.c +++ b/openbsc/src/libbsc/bsc_api.c @@ -416,7 +416,7 @@ static void handle_ass_compl(struct gsm_subscriber_connection *conn, gh = msgb_l3(msg); if (msgb_l3len(msg) - sizeof(*gh) != 1) { - LOGP(DMSC, LOGL_ERROR, "Assignment Compl invalid: %u\n", + LOGP(DMSC, LOGL_ERROR, "Assignment Compl invalid: %lu\n", msgb_l3len(msg) - sizeof(*gh)); return; } @@ -461,7 +461,7 @@ static void handle_ass_fail(struct gsm_subscriber_connection *conn, gh = msgb_l3(msg); if (msgb_l3len(msg) - sizeof(*gh) != 1) { - LOGP(DMSC, LOGL_ERROR, "assignemnt failure unhandled: %u\n", + LOGP(DMSC, LOGL_ERROR, "assignemnt failure unhandled: %lu\n", msgb_l3len(msg) - sizeof(*gh)); rr_failure = NULL; } else { diff --git a/openbsc/src/libmgcp/mgcp_protocol.c b/openbsc/src/libmgcp/mgcp_protocol.c index 79422fe..00315fb 100644 --- a/openbsc/src/libmgcp/mgcp_protocol.c +++ b/openbsc/src/libmgcp/mgcp_protocol.c @@ -308,7 +308,7 @@ static int write_response_sdp(struct mgcp_endpoint *endp, return len; buffer_too_small: - LOGP(DMGCP, LOGL_ERROR, "SDP buffer too small: %d (needed %d)\n", + LOGP(DMGCP, LOGL_ERROR, "SDP buffer too small: %zu (needed %d)\n", size, len); return -1; } diff --git a/openbsc/tests/abis/abis_test.c b/openbsc/tests/abis/abis_test.c index e7e78d2..f82740f 100644 --- a/openbsc/tests/abis/abis_test.c +++ b/openbsc/tests/abis/abis_test.c @@ -61,11 +61,11 @@ static void test_simple_sw_config(void) } if (descr[0].len != 13) { - printf("WRONG SIZE: %d\n", descr[0].len); + printf("WRONG SIZE: %zu\n", descr[0].len); abort(); } - printf("Start: %u len: %zu\n", descr[0].start - simple_config, descr[0].len); + printf("Start: %lu len: %zu\n", descr[0].start - simple_config, descr[0].len); printf("file_id: %s\n", osmo_hexdump(descr[0].file_id, descr[0].file_id_len)); printf("file_ver: %s\n", osmo_hexdump(descr[0].file_ver, descr[0].file_ver_len)); } @@ -99,20 +99,20 @@ static void test_dual_sw_config(void) } if (descr[0].len != 13) { - printf("WRONG SIZE0: %d\n", descr[0].len); + printf("WRONG SIZE0: %zu\n", descr[0].len); abort(); } if (descr[1].len != 13) { - printf("WRONG SIZE1: %d\n", descr[1].len); + printf("WRONG SIZE1: %zu\n", descr[1].len); abort(); } - printf("Start: %u len: %zu\n", descr[0].start - dual_config, descr[0].len); + printf("Start: %lu len: %zu\n", descr[0].start - dual_config, descr[0].len); printf("file_id: %s\n", osmo_hexdump(descr[0].file_id, descr[0].file_id_len)); printf("file_ver: %s\n", osmo_hexdump(descr[0].file_ver, descr[0].file_ver_len)); - printf("Start: %u len: %zu\n", descr[1].start - dual_config, descr[1].len); + printf("Start: %lu len: %zu\n", descr[1].start - dual_config, descr[1].len); printf("file_id: %s\n", osmo_hexdump(descr[1].file_id, descr[1].file_id_len)); printf("file_ver: %s\n", osmo_hexdump(descr[1].file_ver, descr[1].file_ver_len)); } @@ -129,11 +129,11 @@ static void test_sw_selection(void) abort(); } - printf("Start: %u len: %zu\n", descr[0].start - load_config, descr[0].len); + printf("Start: %lu len: %zu\n", descr[0].start - load_config, descr[0].len); printf("file_id: %s\n", osmo_hexdump(descr[0].file_id, descr[0].file_id_len)); printf("file_ver: %s\n", osmo_hexdump(descr[0].file_ver, descr[0].file_ver_len)); - printf("Start: %u len: %zu\n", descr[1].start - load_config, descr[1].len); + printf("Start: %lu len: %zu\n", descr[1].start - load_config, descr[1].len); printf("file_id: %s\n", osmo_hexdump(descr[1].file_id, descr[1].file_id_len)); printf("file_ver: %s\n", osmo_hexdump(descr[1].file_ver, descr[1].file_ver_len)); diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c index 5aa301b..161f7fd 100644 --- a/openbsc/tests/gbproxy/gbproxy_test.c +++ b/openbsc/tests/gbproxy/gbproxy_test.c @@ -898,7 +898,7 @@ int gprs_ns_rcvmsg(struct gprs_ns_inst *nsi, struct msgb *msg, int gprs_ns_callback(enum gprs_ns_evt event, struct gprs_nsvc *nsvc, struct msgb *msg, uint16_t bvci) { - printf("CALLBACK, event %d, msg length %d, bvci 0x%04x\n%s\n\n", + printf("CALLBACK, event %d, msg length %zu, bvci 0x%04x\n%s\n\n", event, msgb_bssgp_len(msg), bvci, osmo_hexdump(msgb_l2(msg), msgb_l2len(msg))); @@ -925,15 +925,15 @@ ssize_t sendto(int sockfd, const void *buf, size_t len, int flags, real_sendto = dlsym(RTLD_NEXT, "sendto"); if (dest_host == REMOTE_BSS_ADDR) - printf("MESSAGE to BSS at 0x%08x:%d, msg length %d\n%s\n\n", + printf("MESSAGE to BSS at 0x%08x:%d, msg length %zu\n%s\n\n", dest_host, dest_port, len, osmo_hexdump(buf, len)); else if (dest_host == REMOTE_SGSN_ADDR) - printf("MESSAGE to SGSN at 0x%08x:%d, msg length %d\n%s\n\n", + printf("MESSAGE to SGSN at 0x%08x:%d, msg length %zu\n%s\n\n", dest_host, dest_port, len, osmo_hexdump(buf, len)); else if (dest_host == REMOTE_SGSN2_ADDR) - printf("MESSAGE to SGSN 2 at 0x%08x:%d, msg length %d\n%s\n\n", + printf("MESSAGE to SGSN 2 at 0x%08x:%d, msg length %zu\n%s\n\n", dest_host, dest_port, len, osmo_hexdump(buf, len)); else @@ -957,15 +957,15 @@ int gprs_ns_sendmsg(struct gprs_ns_inst *nsi, struct msgb *msg) if (nsei == SGSN_NSEI) printf("NS UNITDATA MESSAGE to SGSN, BVCI 0x%04x, " - "msg length %d (%s)\n", + "msg length %zu (%s)\n", bvci, len, __func__); else if (nsei == SGSN2_NSEI) printf("NS UNITDATA MESSAGE to SGSN 2, BVCI 0x%04x, " - "msg length %d (%s)\n", + "msg length %zu (%s)\n", bvci, len, __func__); else printf("NS UNITDATA MESSAGE to BSS, BVCI 0x%04x, " - "msg length %d (%s)\n", + "msg length %zu (%s)\n", bvci, len, __func__); if (received_messages) { @@ -1195,7 +1195,7 @@ static int gprs_process_message(struct gprs_ns_inst *nsi, const char *text, stru struct msgb *msg; int ret; if (data_len > NS_ALLOC_SIZE - NS_ALLOC_HEADROOM) { - fprintf(stderr, "message too long: %d\n", data_len); + fprintf(stderr, "message too long: %zu\n", data_len); return -1; } -- 1.9.1

5 11

SGSN bug report
by Pierre Kim 25 Oct '14

25 Oct '14

Hello, While testing with multiple devices I found a problem where Samsung phones don't correctly respond to identity request messages. Attached is the pcap file of the GPRS-NS transmission. Regards, Pierre

2 3

[PATCH] Replace ad-hoc function with generic one from libosmocore
by Max 22 Oct '14

22 Oct '14

Signed-off-by: Max <max.suraev(a)fairwaves.co> --- openbsc/src/osmo-bsc/osmo_bsc_bssap.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c index dda3157..c2bbbd3 100644 --- a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c +++ b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c @@ -29,16 +29,6 @@ #include <osmocom/gsm/protocol/gsm_08_08.h> #include <osmocom/gsm/gsm0808.h> -#include <arpa/inet.h> - -static uint16_t read_data16(const uint8_t *data) -{ - uint16_t res; - - memcpy(&res, data, sizeof(res)); - return res; -} - /* * helpers for the assignment command */ @@ -154,7 +144,7 @@ static int bssmap_handle_paging(struct osmo_msc_data *msc, * Support paging to all network or one BTS at one LAC */ if (data_length == 3 && data[0] == CELL_IDENT_LAC) { - lac = ntohs(read_data16(&data[1])); + lac = osmo_load16be(&data[1]); } else if (data_length > 1 || (data[0] & 0x0f) != CELL_IDENT_BSS) { LOGP(DMSC, LOGL_ERROR, "Unsupported Cell Identifier List: %s\n", osmo_hexdump(data, data_length)); return -1; @@ -321,7 +311,7 @@ static int bssmap_handle_assignm_req(struct osmo_bsc_sccp_con *conn, goto reject; } - conn->cic = ntohs(read_data16(TLVP_VAL(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE))); + conn->cic = osmo_load16be(TLVP_VAL(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); timeslot = conn->cic & 0x1f; multiplex = (conn->cic & ~0x1f) >> 5; -- 1.9.1

2 1

cfu support
by ☎ 21 Oct '14

21 Oct '14

Hi all. Is stuff from ETSI TS 100 543 supported? I mean all the "call forwarding" features like CFU, CFB, CFNRy and CFNRc. If yes than how to configure that? If not that what's missing? -- best regards, Max, http://fairwaves.co

1 0