OpenBSC

openbsc@lists.osmocom.org

19 participants
4282 discussions

[PATCH 1/6] gprs/test: Add additional gbproxy tests
by Jacob Erlbeck 07 Jul '14

07 Jul '14

This adds a test case with several messages to test BSSGP patching. New messages: - BSSGP/DTAP Attach Request - BSSGP/DTAP Attach Accept - BSSGP/DTAP Routing Area Update Request - BSSGP/DTAP Routing Area Update Accept - BSSGP/DTAP Activate PDP Context Request - BSSGP SUSPEND - BSSGP SUSPEND ACK Sponsored-by: On-Waves ehf --- openbsc/tests/gbproxy/gbproxy_test.c | 199 ++++++++++++++++++++++++- openbsc/tests/gbproxy/gbproxy_test.ok | 268 ++++++++++++++++++++++++++++++++++ 2 files changed, 466 insertions(+), 1 deletion(-) diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c index ea07a77..c372af1 100644 --- a/openbsc/tests/gbproxy/gbproxy_test.c +++ b/openbsc/tests/gbproxy/gbproxy_test.c @@ -28,13 +28,88 @@ #include <osmocom/gprs/gprs_bssgp.h> #include <openbsc/gb_proxy.h> +#include <openbsc/debug.h> #define REMOTE_BSS_ADDR 0x01020304 #define REMOTE_SGSN_ADDR 0x05060708 #define SGSN_NSEI 0x0100 -struct gbproxy_config gbcfg; +struct gbproxy_config gbcfg = {0}; + +/* Base Station Subsystem GPRS Protocol: GSM A-I/F DTAP - Attach Request */ +static const unsigned char bssgp_attach_req[75] = { + 0x01, 0xbb, 0xc5, 0x46, 0x79, 0x00, 0x00, 0x04, + 0x08, 0x88, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, + 0x75, 0x30, 0x00, 0x80, 0x0e, 0x00, 0x34, 0x01, + 0xc0, 0x01, 0x08, 0x01, 0x02, 0xf5, 0xe0, 0x21, + 0x08, 0x02, 0x05, 0xf4, 0xfb, 0xc5, 0x46, 0x79, + 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, 0x19, 0x18, + 0xb3, 0x43, 0x2b, 0x25, 0x96, 0x62, 0x00, 0x60, + 0x80, 0x9a, 0xc2, 0xc6, 0x62, 0x00, 0x60, 0x80, + 0xba, 0xc8, 0xc6, 0x62, 0x00, 0x60, 0x80, 0x00, + 0x16, 0x6d, 0x01 +}; + +/* Base Station Subsystem GPRS Protocol: GSM A-I/F DTAP - Attach Accept */ +static const unsigned char bssgp_attach_acc[88] = { + 0x00, 0xbb, 0xc5, 0x46, 0x79, 0x00, 0x50, 0x20, + 0x16, 0x82, 0x02, 0x58, 0x13, 0x99, 0x18, 0xb3, + 0x43, 0x2b, 0x25, 0x96, 0x62, 0x00, 0x60, 0x80, + 0x9a, 0xc2, 0xc6, 0x62, 0x00, 0x60, 0x80, 0xba, + 0xc8, 0xc6, 0x62, 0x00, 0x60, 0x80, 0x00, 0x0a, + 0x82, 0x08, 0x02, 0x0d, 0x88, 0x11, 0x12, 0x13, + 0x14, 0x15, 0x16, 0x17, 0x18, 0x00, 0x81, 0x00, + 0x0e, 0x9e, 0x41, 0xc0, 0x05, 0x08, 0x02, 0x01, + 0x49, 0x04, 0x21, 0x63, 0x54, 0x40, 0x50, 0x60, + 0x19, 0xcd, 0xd7, 0x08, 0x17, 0x16, 0x18, 0x05, + 0xf4, 0xfb, 0xc5, 0x47, 0x22, 0x42, 0x67, 0x9a +}; + +/* Base Station Subsystem GPRS Protocol: GSM A-I/F DTAP - Routing Area Update Request */ +static const unsigned char bssgp_ra_upd_req[85] = { + 0x01, 0xaf, 0xe2, 0x80, 0x6e, 0x00, 0x00, 0x04, + 0x08, 0x88, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, + 0x70, 0x80, 0x00, 0x80, 0x0e, 0x00, 0x3e, 0x01, + 0xc0, 0x15, 0x08, 0x08, 0x10, 0x11, 0x22, 0x33, + 0x40, 0x50, 0x60, 0x1d, 0x19, 0x13, 0x42, 0x33, + 0x57, 0x2b, 0xf7, 0xc8, 0x48, 0x02, 0x13, 0x48, + 0x50, 0xc8, 0x48, 0x02, 0x14, 0x48, 0x50, 0xc8, + 0x48, 0x02, 0x17, 0x49, 0x10, 0xc8, 0x48, 0x02, + 0x00, 0x19, 0x8b, 0xb2, 0x92, 0x17, 0x16, 0x27, + 0x07, 0x04, 0x31, 0x02, 0xe5, 0xe0, 0x32, 0x02, + 0x20, 0x00, 0x96, 0x3e, 0x97 +}; + +/* Base Station Subsystem GPRS Protocol: GSM A-I/F DTAP - Routing Area Update Accept */ +static const unsigned char bssgp_ra_upd_acc[91] = { + 0x00, 0xaf, 0xe2, 0x80, 0x6e, 0x00, 0x50, 0x20, + 0x16, 0x82, 0x02, 0x58, 0x13, 0x9d, 0x19, 0x13, + 0x42, 0x33, 0x57, 0x2b, 0xf7, 0xc8, 0x48, 0x02, + 0x13, 0x48, 0x50, 0xc8, 0x48, 0x02, 0x14, 0x48, + 0x50, 0xc8, 0x48, 0x02, 0x17, 0x49, 0x10, 0xc8, + 0x48, 0x02, 0x00, 0x0a, 0x82, 0x07, 0x04, 0x0d, + 0x88, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x00, 0x81, 0x00, 0x0e, 0x9d, 0x41, 0xc0, + 0x19, 0x08, 0x09, 0x00, 0x49, 0x21, 0x63, 0x54, + 0x40, 0x50, 0x60, 0x19, 0x54, 0xab, 0xb3, 0x18, + 0x05, 0xf4, 0xef, 0xe2, 0x81, 0x17, 0x17, 0x16, + 0xc3, 0xbf, 0xcc +}; + +/* Base Station Subsystem GPRS Protocol: GSM A-I/F DTAP - Activate PDP Context Request */ +static const unsigned char bssgp_act_pdp_ctx_req[76] = { + 0x01, 0xef, 0xe2, 0xb7, 0x00, 0x00, 0x00, 0x04, + 0x08, 0x88, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, + 0x75, 0x30, 0x00, 0x80, 0x0e, 0x00, 0x35, 0x01, + 0xc0, 0x0d, 0x0a, 0x41, 0x05, 0x03, 0x0c, 0x00, + 0x00, 0x1f, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x02, 0x01, 0x21, 0x28, 0x03, + 0x02, 0x61, 0x62, 0x27, 0x14, 0x80, 0x80, 0x21, + 0x10, 0x01, 0x00, 0x00, 0x10, 0x81, 0x06, 0x00, + 0x00, 0x00, 0x00, 0x83, 0x06, 0x00, 0x00, 0x00, + 0x00, 0x5a, 0xff, 0x02 +}; static int gprs_process_message(struct gprs_ns_inst *nsi, const char *text, struct sockaddr_in *peer, const unsigned char* data, @@ -168,6 +243,39 @@ static void send_bssgp_reset_ack(struct gprs_ns_inst *nsi, send_ns_unitdata(nsi, "BVC_RESET_ACK", src_addr, 0, msg, sizeof(msg)); } +static void send_bssgp_suspend(struct gprs_ns_inst *nsi, + struct sockaddr_in *src_addr, + struct gprs_ra_id *raid) +{ + /* Base Station Subsystem GPRS Protocol, BSSGP SUSPEND */ + unsigned char msg[15] = { + 0x0b, 0x1f, 0x84, 0xcc, 0xd1, 0x75, 0x8b, 0x1b, + 0x86, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60 + }; + + if (raid) + gsm48_construct_ra(msg + 9, raid); + + send_ns_unitdata(nsi, "BVC_SUSPEND", src_addr, 0, msg, sizeof(msg)); +} + +static void send_bssgp_suspend_ack(struct gprs_ns_inst *nsi, + struct sockaddr_in *src_addr, + struct gprs_ra_id *raid) +{ + /* Base Station Subsystem GPRS Protocol, BSSGP SUSPEND ACK */ + unsigned char msg[18] = { + 0x0c, 0x1f, 0x84, 0xcc, 0xd1, 0x75, 0x8b, 0x1b, + 0x86, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, 0x1d, + 0x81, 0x01 + }; + + if (raid) + gsm48_construct_ra(msg + 9, raid); + + send_ns_unitdata(nsi, "BVC_SUSPEND_ACK", src_addr, 0, msg, sizeof(msg)); +} + static void setup_ns(struct gprs_ns_inst *nsi, struct sockaddr_in *src_addr, uint16_t nsvci, uint16_t nsei) { @@ -686,6 +794,94 @@ static void test_gbproxy_ident_changes() gbprox_reset(); } +static void test_gbproxy_ra_patching() +{ + struct gprs_ns_inst *nsi = gprs_ns_instantiate(gprs_ns_callback, NULL); + struct sockaddr_in bss_peer[1] = {{0},}; + struct sockaddr_in sgsn_peer= {0}; + struct gprs_ra_id rai_bss = + {.mcc = 112, .mnc = 332, .lac = 16464, .rac = 96}; + struct gprs_ra_id rai_sgsn = + {.mcc = 123, .mnc = 456, .lac = 16464, .rac = 96}; + struct gprs_ra_id rai_unknown = + {.mcc = 1, .mnc = 99, .lac = 99, .rac = 96}; + + bssgp_nsi = nsi; + gbcfg.nsi = bssgp_nsi; + gbcfg.nsip_sgsn_nsei = SGSN_NSEI; + + sgsn_peer.sin_family = AF_INET; + sgsn_peer.sin_port = htons(32000); + sgsn_peer.sin_addr.s_addr = htonl(REMOTE_SGSN_ADDR); + + bss_peer[0].sin_family = AF_INET; + bss_peer[0].sin_port = htons(1111); + bss_peer[0].sin_addr.s_addr = htonl(REMOTE_BSS_ADDR); + + printf("--- Initialise SGSN ---\n\n"); + + gprs_ns_nsip_connect(nsi, &sgsn_peer, SGSN_NSEI, SGSN_NSEI+1); + send_ns_reset_ack(nsi, &sgsn_peer, SGSN_NSEI+1, SGSN_NSEI); + send_ns_alive_ack(nsi, &sgsn_peer); + send_ns_unblock_ack(nsi, &sgsn_peer); + send_ns_alive(nsi, &sgsn_peer); + gprs_dump_nsi(nsi); + + printf("--- Initialise BSS 1 ---\n\n"); + + setup_ns(nsi, &bss_peer[0], 0x1001, 0x1000); + setup_bssgp(nsi, &bss_peer[0], 0x1002); + gprs_dump_nsi(nsi); + gbprox_dump_peers(stdout, 0, 1); + + send_bssgp_reset_ack(nsi, &sgsn_peer, 0x1002); + + send_bssgp_suspend(nsi, &bss_peer[0], &rai_bss); + send_bssgp_suspend_ack(nsi, &sgsn_peer, &rai_sgsn); + + gbprox_dump_global(stdout, 0, 1); + gbprox_dump_peers(stdout, 0, 1); + + printf("--- Send message from BSS 1 to SGSN, BVCI 0x1002 ---\n\n"); + + send_ns_unitdata(nsi, NULL, &bss_peer[0], 0x1002, + bssgp_attach_req, sizeof(bssgp_attach_req)); + + send_ns_unitdata(nsi, NULL, &sgsn_peer, 0x1002, + bssgp_attach_acc, sizeof(bssgp_attach_acc)); + + send_ns_unitdata(nsi, NULL, &bss_peer[0], 0x1002, + bssgp_ra_upd_req, sizeof(bssgp_ra_upd_req)); + + send_ns_unitdata(nsi, NULL, &sgsn_peer, 0x1002, + bssgp_ra_upd_acc, sizeof(bssgp_ra_upd_acc)); + + /* Replace APN */ + send_ns_unitdata(nsi, NULL, &bss_peer[0], 0x1002, + bssgp_act_pdp_ctx_req, sizeof(bssgp_act_pdp_ctx_req)); + + /* TODO: Re-configure to test APN IE removal */ + + /* Remove APN */ + send_ns_unitdata(nsi, NULL, &bss_peer[0], 0x1002, + bssgp_act_pdp_ctx_req, sizeof(bssgp_act_pdp_ctx_req)); + + gbprox_dump_global(stdout, 0, 1); + gbprox_dump_peers(stdout, 0, 1); + + printf("--- Bad cases ---\n\n"); + + send_bssgp_reset_ack(nsi, &sgsn_peer, 0x1eee); + send_bssgp_suspend_ack(nsi, &sgsn_peer, &rai_unknown); + + gbprox_dump_global(stdout, 0, 1); + gbprox_dump_peers(stdout, 0, 1); + + gprs_ns_destroy(nsi); + nsi = NULL; + gbprox_reset(); +} + static struct log_info info = {}; @@ -706,6 +902,7 @@ int main(int argc, char **argv) printf("===== GbProxy test START\n"); test_gbproxy(); test_gbproxy_ident_changes(); + test_gbproxy_ra_patching(); printf("===== GbProxy test END\n\n"); exit(EXIT_SUCCESS); diff --git a/openbsc/tests/gbproxy/gbproxy_test.ok b/openbsc/tests/gbproxy/gbproxy_test.ok index 3b25922..58add97 100644 --- a/openbsc/tests/gbproxy/gbproxy_test.ok +++ b/openbsc/tests/gbproxy/gbproxy_test.ok @@ -1518,5 +1518,273 @@ Peers: NS Transmission error : 2 NSEI 8192, BVCI 4098, not blocked, RAI 112-332-16464-96 NSEI mismatch : 1 +--- Initialise SGSN --- + +MESSAGE to SGSN at 0x05060708:32000, msg length 12 +02 00 81 01 01 82 01 01 04 82 01 00 + +PROCESSING RESET_ACK from 0x05060708:32000 +03 01 82 01 01 04 82 01 00 + +MESSAGE to SGSN at 0x05060708:32000, msg length 1 +0a + +result (RESET_ACK) = 1 + +PROCESSING ALIVE_ACK from 0x05060708:32000 +0b + +MESSAGE to SGSN at 0x05060708:32000, msg length 1 +06 + +result (ALIVE_ACK) = 1 + +PROCESSING UNBLOCK_ACK from 0x05060708:32000 +07 + +==> got signal NS_UNBLOCK, NS-VC 0x0101/5.6.7.8:32000 + +result (UNBLOCK_ACK) = 0 + +PROCESSING ALIVE from 0x05060708:32000 +0a + +MESSAGE to SGSN at 0x05060708:32000, msg length 1 +0b + +result (ALIVE) = 1 + +Current NS-VCIs: + VCI 0x0101, NSEI 0x0100, peer 0x05060708:32000 + NS-VC Block count : 1 + +--- Initialise BSS 1 --- + +Setup NS-VC: remote 0x01020304:1111, NSVCI 0x1001(4097), NSEI 0x1000(4096) + +PROCESSING RESET from 0x01020304:1111 +02 00 81 01 01 82 10 01 04 82 10 00 + +==> got signal NS_RESET, NS-VC 0x1001/1.2.3.4:1111 + +MESSAGE to BSS at 0x01020304:1111, msg length 9 +03 01 82 10 01 04 82 10 00 + +MESSAGE to BSS at 0x01020304:1111, msg length 1 +0a + +result (RESET) = 9 + +PROCESSING ALIVE from 0x01020304:1111 +0a + +MESSAGE to BSS at 0x01020304:1111, msg length 1 +0b + +result (ALIVE) = 1 + +PROCESSING UNBLOCK from 0x01020304:1111 +06 + +==> got signal NS_UNBLOCK, NS-VC 0x1001/1.2.3.4:1111 + +MESSAGE to BSS at 0x01020304:1111, msg length 1 +07 + +result (UNBLOCK) = 1 + +PROCESSING ALIVE_ACK from 0x01020304:1111 +0b + +result (ALIVE_ACK) = 0 + +Setup BSSGP: remote 0x01020304:1111, BVCI 0x1002(4098) + +PROCESSING BVC_RESET from 0x01020304:1111 +00 00 00 00 22 04 82 10 02 07 81 08 08 88 11 22 33 40 50 60 10 00 00 00 00 00 + +CALLBACK, event 0, msg length 22, bvci 0x0000 +22 04 82 10 02 07 81 08 08 88 11 22 33 40 50 60 10 00 00 00 00 00 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 22 +22 04 82 10 02 07 81 08 08 88 11 22 33 40 50 60 10 00 00 00 00 00 + +MESSAGE to SGSN at 0x05060708:32000, msg length 26 +00 00 00 00 22 04 82 10 02 07 81 08 08 88 11 22 33 40 50 60 10 00 00 00 00 00 + +result (BVC_RESET) = 26 + +Current NS-VCIs: + VCI 0x1001, NSEI 0x1000, peer 0x01020304:1111 + VCI 0x0101, NSEI 0x0100, peer 0x05060708:32000 + NS-VC Block count : 1 + +Peers: + NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96 +PROCESSING BVC_RESET_ACK from 0x05060708:32000 +00 00 00 00 23 04 82 10 02 + +CALLBACK, event 0, msg length 5, bvci 0x0000 +23 04 82 10 02 + +NS UNITDATA MESSAGE to BSS, BVCI 0x0000, msg length 5 +23 04 82 10 02 + +MESSAGE to BSS at 0x01020304:1111, msg length 9 +00 00 00 00 23 04 82 10 02 + +result (BVC_RESET_ACK) = 9 + +PROCESSING BVC_SUSPEND from 0x01020304:1111 +00 00 00 00 0b 1f 84 cc d1 75 8b 1b 86 11 22 33 40 50 60 + +CALLBACK, event 0, msg length 15, bvci 0x0000 +0b 1f 84 cc d1 75 8b 1b 86 11 22 33 40 50 60 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 15 +0b 1f 84 cc d1 75 8b 1b 86 11 22 33 40 50 60 + +MESSAGE to SGSN at 0x05060708:32000, msg length 19 +00 00 00 00 0b 1f 84 cc d1 75 8b 1b 86 11 22 33 40 50 60 + +result (BVC_SUSPEND) = 19 + +PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000 +00 00 00 00 0c 1f 84 cc d1 75 8b 1b 86 21 63 54 40 50 60 1d 81 01 + +CALLBACK, event 0, msg length 18, bvci 0x0000 +0c 1f 84 cc d1 75 8b 1b 86 21 63 54 40 50 60 1d 81 01 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 24 +41 07 81 05 15 92 0c 1f 84 cc d1 75 8b 1b 86 21 63 54 40 50 60 1d 81 01 + +MESSAGE to SGSN at 0x05060708:32000, msg length 28 +00 00 00 00 41 07 81 05 15 92 0c 1f 84 cc d1 75 8b 1b 86 21 63 54 40 50 60 1d 81 01 + +result (BVC_SUSPEND_ACK) = 28 + +Gbproxy global: + Invalid Routing Area Identifier : 1 +Peers: + NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96 +--- Send message from BSS 1 to SGSN, BVCI 0x1002 --- + +PROCESSING UNITDATA from 0x01020304:1111 +00 00 10 02 01 bb c5 46 79 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 34 01 c0 01 08 01 02 f5 e0 21 08 02 05 f4 fb c5 46 79 11 22 33 40 50 60 19 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 16 6d 01 + +CALLBACK, event 0, msg length 75, bvci 0x1002 +01 bb c5 46 79 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 34 01 c0 01 08 01 02 f5 e0 21 08 02 05 f4 fb c5 46 79 11 22 33 40 50 60 19 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 16 6d 01 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 75 +01 bb c5 46 79 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 34 01 c0 01 08 01 02 f5 e0 21 08 02 05 f4 fb c5 46 79 11 22 33 40 50 60 19 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 16 6d 01 + +MESSAGE to SGSN at 0x05060708:32000, msg length 79 +00 00 10 02 01 bb c5 46 79 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 34 01 c0 01 08 01 02 f5 e0 21 08 02 05 f4 fb c5 46 79 11 22 33 40 50 60 19 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 16 6d 01 + +result (UNITDATA) = 79 + +PROCESSING UNITDATA from 0x05060708:32000 +00 00 10 02 00 bb c5 46 79 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9e 41 c0 05 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 fb c5 47 22 42 67 9a + +CALLBACK, event 0, msg length 88, bvci 0x1002 +00 bb c5 46 79 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9e 41 c0 05 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 fb c5 47 22 42 67 9a + +NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 88 +00 bb c5 46 79 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9e 41 c0 05 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 fb c5 47 22 42 67 9a + +MESSAGE to BSS at 0x01020304:1111, msg length 92 +00 00 10 02 00 bb c5 46 79 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9e 41 c0 05 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 fb c5 47 22 42 67 9a + +result (UNITDATA) = 92 + +PROCESSING UNITDATA from 0x01020304:1111 +00 00 10 02 01 af e2 80 6e 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 + +CALLBACK, event 0, msg length 85, bvci 0x1002 +01 af e2 80 6e 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 85 +01 af e2 80 6e 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 + +MESSAGE to SGSN at 0x05060708:32000, msg length 89 +00 00 10 02 01 af e2 80 6e 00 00 04 08 88 11 22 33 40 50 60 70 80 00 80 0e 00 3e 01 c0 15 08 08 10 11 22 33 40 50 60 1d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 19 8b b2 92 17 16 27 07 04 31 02 e5 e0 32 02 20 00 96 3e 97 + +result (UNITDATA) = 89 + +PROCESSING UNITDATA from 0x05060708:32000 +00 00 10 02 00 af e2 80 6e 00 50 20 16 82 02 58 13 9d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 0a 82 07 04 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 19 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 ef e2 81 17 17 16 c3 bf cc + +CALLBACK, event 0, msg length 91, bvci 0x1002 +00 af e2 80 6e 00 50 20 16 82 02 58 13 9d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 0a 82 07 04 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 19 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 ef e2 81 17 17 16 c3 bf cc + +NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 91 +00 af e2 80 6e 00 50 20 16 82 02 58 13 9d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 0a 82 07 04 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 19 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 ef e2 81 17 17 16 c3 bf cc + +MESSAGE to BSS at 0x01020304:1111, msg length 95 +00 00 10 02 00 af e2 80 6e 00 50 20 16 82 02 58 13 9d 19 13 42 33 57 2b f7 c8 48 02 13 48 50 c8 48 02 14 48 50 c8 48 02 17 49 10 c8 48 02 00 0a 82 07 04 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9d 41 c0 19 08 09 00 49 21 63 54 40 50 60 19 54 ab b3 18 05 f4 ef e2 81 17 17 16 c3 bf cc + +result (UNITDATA) = 95 + +PROCESSING UNITDATA from 0x01020304:1111 +00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +CALLBACK, event 0, msg length 76, bvci 0x1002 +01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 76 +01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +MESSAGE to SGSN at 0x05060708:32000, msg length 80 +00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +result (UNITDATA) = 80 + +PROCESSING UNITDATA from 0x01020304:1111 +00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +CALLBACK, event 0, msg length 76, bvci 0x1002 +01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 76 +01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +MESSAGE to SGSN at 0x05060708:32000, msg length 80 +00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 11 22 33 40 50 60 75 30 00 80 0e 00 35 01 c0 0d 0a 41 05 03 0c 00 00 1f 10 00 00 00 00 00 00 00 00 02 01 21 28 03 02 61 62 27 14 80 80 21 10 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00 5a ff 02 + +result (UNITDATA) = 80 + +Gbproxy global: + Invalid Routing Area Identifier : 1 +Peers: + NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96 +--- Bad cases --- + +PROCESSING BVC_RESET_ACK from 0x05060708:32000 +00 00 00 00 23 04 82 1e ee + +CALLBACK, event 0, msg length 5, bvci 0x0000 +23 04 82 1e ee + +result (BVC_RESET_ACK) = -2 + +PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000 +00 00 00 00 0c 1f 84 cc d1 75 8b 1b 86 00 f1 99 00 63 60 1d 81 01 + +CALLBACK, event 0, msg length 18, bvci 0x0000 +0c 1f 84 cc d1 75 8b 1b 86 00 f1 99 00 63 60 1d 81 01 + +NS UNITDATA MESSAGE to SGSN, BVCI 0x0000, msg length 24 +41 07 81 05 15 92 0c 1f 84 cc d1 75 8b 1b 86 00 f1 99 00 63 60 1d 81 01 + +MESSAGE to SGSN at 0x05060708:32000, msg length 28 +00 00 00 00 41 07 81 05 15 92 0c 1f 84 cc d1 75 8b 1b 86 00 f1 99 00 63 60 1d 81 01 + +result (BVC_SUSPEND_ACK) = 28 + +Gbproxy global: + Invalid BVC Identifier : 1 + Invalid Routing Area Identifier : 2 +Peers: + NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96 ===== GbProxy test END -- 1.9.1

2 11

[osmo-pcu 1/3] bts, tbf: Separate functions for dl/ul tbf_by_tlli lookup
by Daniel Willmann 03 Jul '14

03 Jul '14

In the future we want to separate ul and dl tbf into different classes that inherit from a common base. Ticket: SYS#389 Sponsored-by: On-Waves ehf --- src/bts.cpp | 24 +++++++++++++++++------- src/bts.h | 4 +++- src/tbf.cpp | 18 +++++++++--------- tests/tbf/TbfTest.cpp | 12 ++++++------ 4 files changed, 35 insertions(+), 23 deletions(-) diff --git a/src/bts.cpp b/src/bts.cpp index 3dd5705..51be2d9 100644 --- a/src/bts.cpp +++ b/src/bts.cpp @@ -216,6 +216,18 @@ int BTS::add_paging(uint8_t chan_needed, uint8_t *identity_lv) return 0; } +/* search for active downlink tbf */ +gprs_rlcmac_tbf *BTS::dl_tbf_by_tlli(uint32_t tlli) +{ + return tbf_by_tlli(tlli, GPRS_RLCMAC_DL_TBF); +} + +/* search for active uplink tbf */ +gprs_rlcmac_tbf *BTS::ul_tbf_by_tlli(uint32_t tlli) +{ + return tbf_by_tlli(tlli, GPRS_RLCMAC_UL_TBF); +} + /* search for active downlink or uplink tbf */ gprs_rlcmac_tbf *BTS::tbf_by_tlli(uint32_t tlli, enum gprs_rlcmac_tbf_direction dir) { @@ -360,7 +372,7 @@ int BTS::rcv_imm_ass_cnf(const uint8_t *data, uint32_t fn) tlli |= (*data++) << 4; tlli |= (*data++) >> 4; - tbf = tbf_by_tlli(tlli, GPRS_RLCMAC_DL_TBF); + tbf = dl_tbf_by_tlli(tlli); if (!tbf) { LOGP(DRLCMAC, LOGL_ERROR, "Got IMM.ASS confirm, but TLLI=%08x " "does not exit\n", tlli); @@ -725,8 +737,7 @@ void gprs_rlcmac_pdch::rcv_control_ack(Packet_Control_Acknowledgement_t *packet, tbf->n3105 = 0; tbf->dl_ass_state = GPRS_RLCMAC_DL_ASS_NONE; if (tbf->direction == GPRS_RLCMAC_UL_TBF) - tbf = bts()->tbf_by_tlli(tbf->tlli(), - GPRS_RLCMAC_DL_TBF); + tbf = bts()->dl_tbf_by_tlli(tbf->tlli()); #warning "TBF is changing on the way... *sigh*" if (!tbf) { LOGP(DRLCMAC, LOGL_ERROR, "Got ACK, but DL " @@ -753,8 +764,7 @@ void gprs_rlcmac_pdch::rcv_control_ack(Packet_Control_Acknowledgement_t *packet, tbf->ul_ass_state = GPRS_RLCMAC_UL_ASS_NONE; #warning "TBF is changing on the way... *sigh*" if (tbf->direction == GPRS_RLCMAC_DL_TBF) - tbf = bts()->tbf_by_tlli(tbf->tlli(), - GPRS_RLCMAC_UL_TBF); + tbf = bts()->ul_tbf_by_tlli(tbf->tlli()); if (!tbf) { LOGP(DRLCMAC, LOGL_ERROR, "Got ACK, but UL " "TBF is gone TLLI=0x%08x\n", tlli); @@ -836,7 +846,7 @@ void gprs_rlcmac_pdch::rcv_resource_request(Packet_Resource_Request_t *request, struct gprs_rlcmac_tbf *dl_tbf; uint8_t ta; - tbf = bts()->tbf_by_tlli(tlli, GPRS_RLCMAC_UL_TBF); + tbf = bts()->ul_tbf_by_tlli(tlli); if (tbf) { LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from " "TLLI=0x%08x while %s still " @@ -846,7 +856,7 @@ void gprs_rlcmac_pdch::rcv_resource_request(Packet_Resource_Request_t *request, tbf = NULL; } - if ((dl_tbf = bts()->tbf_by_tlli(tlli, GPRS_RLCMAC_DL_TBF))) { + if ((dl_tbf = bts()->dl_tbf_by_tlli(tlli))) { LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from " "TLLI=0x%08x while %s still exists. " "Killing pending DL TBF\n", tlli, diff --git a/src/bts.h b/src/bts.h index aa68ed7..c83bb18 100644 --- a/src/bts.h +++ b/src/bts.h @@ -192,7 +192,8 @@ public: /** add paging to paging queue(s) */ int add_paging(uint8_t chan_needed, uint8_t *identity_lv); - gprs_rlcmac_tbf *tbf_by_tlli(uint32_t tlli, enum gprs_rlcmac_tbf_direction dir); + gprs_rlcmac_tbf *dl_tbf_by_tlli(uint32_t tlli); + gprs_rlcmac_tbf *ul_tbf_by_tlli(uint32_t tlli); gprs_rlcmac_tbf *tbf_by_poll_fn(uint32_t fn, uint8_t trx, uint8_t ts); gprs_rlcmac_tbf *tbf_by_tfi(uint8_t tfi, uint8_t trx, enum gprs_rlcmac_tbf_direction dir); @@ -238,6 +239,7 @@ private: SBAController m_sba; TimingAdvance m_ta; struct rate_ctr_group *m_ratectrs; + gprs_rlcmac_tbf *tbf_by_tlli(uint32_t tlli, enum gprs_rlcmac_tbf_direction dir); private: /* disable copying to avoid slicing */ diff --git a/src/tbf.cpp b/src/tbf.cpp index 5943674..f913f97 100644 --- a/src/tbf.cpp +++ b/src/tbf.cpp @@ -82,7 +82,7 @@ static struct gprs_rlcmac_tbf *tbf_lookup_dl(BTS *bts, const uint32_t tlli, const char *imsi) { /* TODO: look up by IMSI first, then tlli, then old_tlli */ - return bts->tbf_by_tlli(tlli, GPRS_RLCMAC_DL_TBF); + return bts->dl_tbf_by_tlli(tlli); } int gprs_rlcmac_tbf::append_data(const uint8_t ms_class, @@ -130,7 +130,7 @@ static int tbf_new_dl_assignment(struct gprs_rlcmac_bts *bts, /* check for uplink data, so we copy our informations */ #warning "Do the same look up for IMSI, TLLI and OLD_TLLI" #warning "Refactor the below lines... into a new method" - tbf = bts->bts->tbf_by_tlli(tlli, GPRS_RLCMAC_UL_TBF); + tbf = bts->bts->ul_tbf_by_tlli(tlli); if (tbf && tbf->dir.ul.contention_resolution_done && !tbf->dir.ul.final_ack_sent) { use_trx = tbf->trx->trx_no; @@ -308,7 +308,7 @@ int gprs_rlcmac_tbf::update() if (direction != GPRS_RLCMAC_DL_TBF) return -EINVAL; - ul_tbf = bts->tbf_by_tlli(m_tlli, GPRS_RLCMAC_UL_TBF); + ul_tbf = bts->ul_tbf_by_tlli(m_tlli); tbf_unlink_pdch(this); rc = bts_data->alloc_algorithm(bts_data, ul_tbf, this, bts_data->alloc_algorithm_curst, 0); @@ -1182,7 +1182,7 @@ struct msgb *gprs_rlcmac_tbf::create_dl_ass(uint32_t fn) return NULL; } #warning "THIS should probably go over the IMSI too" - new_tbf = bts->tbf_by_tlli(m_tlli, GPRS_RLCMAC_DL_TBF); + new_tbf = bts->dl_tbf_by_tlli(m_tlli); } else new_tbf = this; if (!new_tbf) { @@ -1252,7 +1252,7 @@ struct msgb *gprs_rlcmac_tbf::create_ul_ass(uint32_t fn) /* on down TBF we get the uplink TBF to be assigned. */ #warning "Probably want to find by IMSI too" if (direction == GPRS_RLCMAC_DL_TBF) - new_tbf = bts->tbf_by_tlli(m_tlli, GPRS_RLCMAC_UL_TBF); + new_tbf = bts->ul_tbf_by_tlli(m_tlli); else new_tbf = this; @@ -1497,7 +1497,7 @@ void gprs_rlcmac_tbf::update_tlli(uint32_t tlli) */ if (m_tlli_valid && direction == GPRS_RLCMAC_DL_TBF) { gprs_rlcmac_tbf *ul_tbf; - ul_tbf = bts->tbf_by_tlli(m_tlli, GPRS_RLCMAC_UL_TBF); + ul_tbf = bts->ul_tbf_by_tlli(m_tlli); if (ul_tbf) { ul_tbf->m_tlli = tlli; @@ -1537,7 +1537,7 @@ int gprs_rlcmac_tbf::extract_tlli(const uint8_t *data, const size_t len) update_tlli(new_tlli); LOGP(DRLCMACUL, LOGL_INFO, "Decoded premier TLLI=0x%08x of " "UL DATA TFI=%d.\n", tlli(), rh->tfi); - if ((dl_tbf = bts->tbf_by_tlli(tlli(), GPRS_RLCMAC_DL_TBF))) { + if ((dl_tbf = bts->dl_tbf_by_tlli(tlli()))) { LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from " "TLLI=0x%08x while %s still exists. " "Killing pending DL TBF\n", tlli(), @@ -1545,9 +1545,9 @@ int gprs_rlcmac_tbf::extract_tlli(const uint8_t *data, const size_t len) tbf_free(dl_tbf); dl_tbf = NULL; } - /* tbf_by_tlli will not find your TLLI, because it is not + /* ul_tbf_by_tlli will not find your TLLI, because it is not * yet marked valid */ - if ((ul_tbf = bts->tbf_by_tlli(tlli(), GPRS_RLCMAC_UL_TBF))) { + if ((ul_tbf = bts->ul_tbf_by_tlli(tlli()))) { LOGP(DRLCMACUL, LOGL_NOTICE, "Got RACH from " "TLLI=0x%08x while %s still exists. " "Killing pending UL TBF\n", tlli(), diff --git a/tests/tbf/TbfTest.cpp b/tests/tbf/TbfTest.cpp index 86c5bbd..38975f9 100644 --- a/tests/tbf/TbfTest.cpp +++ b/tests/tbf/TbfTest.cpp @@ -59,8 +59,8 @@ static void test_tbf_tlli_update() ul_tbf->tlli_mark_valid(); - OSMO_ASSERT(the_bts.tbf_by_tlli(0x2342, GPRS_RLCMAC_DL_TBF) == dl_tbf); - OSMO_ASSERT(the_bts.tbf_by_tlli(0x2342, GPRS_RLCMAC_UL_TBF) == ul_tbf); + OSMO_ASSERT(the_bts.dl_tbf_by_tlli(0x2342) == dl_tbf); + OSMO_ASSERT(the_bts.ul_tbf_by_tlli(0x2342) == ul_tbf); /* @@ -68,12 +68,12 @@ static void test_tbf_tlli_update() * has changed. */ dl_tbf->update_tlli(0x4232); - OSMO_ASSERT(!the_bts.tbf_by_tlli(0x2342, GPRS_RLCMAC_DL_TBF)); - OSMO_ASSERT(!the_bts.tbf_by_tlli(0x2342, GPRS_RLCMAC_UL_TBF)); + OSMO_ASSERT(!the_bts.dl_tbf_by_tlli(0x2342)); + OSMO_ASSERT(!the_bts.ul_tbf_by_tlli(0x2342)); - OSMO_ASSERT(the_bts.tbf_by_tlli(0x4232, GPRS_RLCMAC_DL_TBF) == dl_tbf); - OSMO_ASSERT(the_bts.tbf_by_tlli(0x4232, GPRS_RLCMAC_UL_TBF) == ul_tbf); + OSMO_ASSERT(the_bts.dl_tbf_by_tlli(0x4232) == dl_tbf); + OSMO_ASSERT(the_bts.ul_tbf_by_tlli(0x4232) == ul_tbf); OSMO_ASSERT(the_bts.timing_advance()->recall(0x4232) == 4); } -- 1.8.4.2

1 2

Nokia UltraSite
by Sipos Csaba 29 Jun '14

29 Jun '14

Hi, I wonder if anybody was ever able to start a Nokia UltraSite with OpenBSC? In a nut shell: OML link is up and running, TRX1 is successfully loaded software, configured, and now it is stuck in "Waiting for LAPD..." state. The problem is that OpenBSC initiates the RSLSIG link for this TRX, but it seems the BTS is never answering to that: Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:159 LAPD state change on TEI 1: NONE -> ASSIGNED Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:212 LAPD Allocating SAP for SAPI=0 / TEI=1 Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:223 k=2 N200=3 N201=260 T200=1.0 T203=10.0 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:288 Init DL layer: sequence range = 128, k = 2, history range = 4 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:227 new state LAPD_STATE_NULL -> LAPD_STATE_IDLE Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:485 LAPD DL-ESTABLISH request TEI=1 SAPI=0 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:2180 Message DL-ESTABLISH-REQUEST received in state LAPD_STATE_IDLE Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1694 perform normal establishm. (SABM) Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:227 new state LAPD_STATE_IDLE -> LAPD_STATE_SABM_SENT Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1779 lapd_send_i() called from line 1609 Sat Jun 28 14:33:27 2014 <0018> lapd_core.c:1618 we are not busy and have no pending data, send RR Sat Jun 28 14:33:27 2014 <0018> input/lapd.c:600 TX: f8 03 01 08 Sat Jun 28 14:33:28 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:28 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:28 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:29 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:29 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:29 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:30 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:30 2014 <0018> input/lapd.c:600 TX: 02 03 7f Sat Jun 28 14:33:30 2014 <0018> lapd_core.c:196 start T200 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:545 Timeout T200 (0x993ad40) state=5 Sat Jun 28 14:33:31 2014 <0018> input/lapd.c:628 LAPD DL-RELEASE indication TEI=1 SAPI=0 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:303 Resetting LAPDm instance Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:227 new state LAPD_STATE_SABM_SENT -> LAPD_STATE_IDLE Sat Jun 28 14:33:31 2014 <001b> bsc_init.c:318 Lost some E1 TEI link: 2 0x991b8f0 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:378 sending MDL-ERROR-IND cause 1 Sat Jun 28 14:33:31 2014 <0018> lapd_core.c:227 new state LAPD_STATE_IDLE -> LAPD_STATE_IDLE I set the correct E1 TS for TRX1 RSLSIG in Traffic manager, and double checked the RSLSIG config parameters on both end (OpenBSC config file and the BTS manager). Nokia Insite and MetroSite uses RSL TEI = 1 for the first TRX. Maybe Ultra uses other TEI number for the first TRX, this is something I will try, but otherwise I don't know how it is possible that not even the LAPD connection is being established... Any help is appreciated. Thanks, Csaba

1 0

Bounce action notification
by mailman＠lists.osmocom.org 28 Jun '14

28 Jun '14

This is a Mailman mailing list bounce action notice: List: OpenBSC Member: devinechristophe(a)gmail.com Action: Subscription disabled. Reason: Excessive or fatal bounces. The triggering bounce notice is attached below. Questions? Contact the Mailman site administrator at mailman(a)lists.osmocom.org.

1 0

[openbsc 1/3] libbsc, osmo-bsc{, _nat}: Prevent unaligned access when casting TLVP_VAL
by Daniel Willmann 28 Jun '14

28 Jun '14

foo = *((uintXX_t *) TLVP_VAL(...) can lead to unaligned access. To prevent that use tlvp_valXX_unal() to get the values. --- openbsc/src/libbsc/abis_rsl.c | 10 +++++----- openbsc/src/osmo-bsc/osmo_bsc_bssap.c | 2 +- openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/openbsc/src/libbsc/abis_rsl.c b/openbsc/src/libbsc/abis_rsl.c index 748ab7e..d193078 100644 --- a/openbsc/src/libbsc/abis_rsl.c +++ b/openbsc/src/libbsc/abis_rsl.c @@ -1804,20 +1804,20 @@ static void ipac_parse_rtp(struct gsm_lchan *lchan, struct tlv_parsed *tv) uint16_t port, conn_id; if (TLVP_PRESENT(tv, RSL_IE_IPAC_LOCAL_IP)) { - ip.s_addr = *((uint32_t *) TLVP_VAL(tv, RSL_IE_IPAC_LOCAL_IP)); + ip.s_addr = tlvp_val32_unal(tv, RSL_IE_IPAC_LOCAL_IP); DEBUGPC(DRSL, "LOCAL_IP=%s ", inet_ntoa(ip)); lchan->abis_ip.bound_ip = ntohl(ip.s_addr); } if (TLVP_PRESENT(tv, RSL_IE_IPAC_LOCAL_PORT)) { - port = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_LOCAL_PORT)); + port = tlvp_val16_unal(tv, RSL_IE_IPAC_LOCAL_PORT); port = ntohs(port); DEBUGPC(DRSL, "LOCAL_PORT=%u ", port); lchan->abis_ip.bound_port = port; } if (TLVP_PRESENT(tv, RSL_IE_IPAC_CONN_ID)) { - conn_id = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_CONN_ID)); + conn_id = tlvp_val16_unal(tv, RSL_IE_IPAC_CONN_ID); conn_id = ntohs(conn_id); DEBUGPC(DRSL, "CON_ID=%u ", conn_id); lchan->abis_ip.conn_id = conn_id; @@ -1838,13 +1838,13 @@ static void ipac_parse_rtp(struct gsm_lchan *lchan, struct tlv_parsed *tv) } if (TLVP_PRESENT(tv, RSL_IE_IPAC_REMOTE_IP)) { - ip.s_addr = *((uint32_t *) TLVP_VAL(tv, RSL_IE_IPAC_REMOTE_IP)); + ip.s_addr = tlvp_val32_unal(tv, RSL_IE_IPAC_REMOTE_IP); DEBUGPC(DRSL, "REMOTE_IP=%s ", inet_ntoa(ip)); lchan->abis_ip.connect_ip = ntohl(ip.s_addr); } if (TLVP_PRESENT(tv, RSL_IE_IPAC_REMOTE_PORT)) { - port = *((uint16_t *) TLVP_VAL(tv, RSL_IE_IPAC_REMOTE_PORT)); + port = tlvp_val16_unal(tv, RSL_IE_IPAC_REMOTE_PORT); port = ntohs(port); DEBUGPC(DRSL, "REMOTE_PORT=%u ", port); lchan->abis_ip.connect_port = port; diff --git a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c index c2c2417..f58d96f 100644 --- a/openbsc/src/osmo-bsc/osmo_bsc_bssap.c +++ b/openbsc/src/osmo-bsc/osmo_bsc_bssap.c @@ -135,7 +135,7 @@ static int bssmap_handle_paging(struct osmo_msc_data *msc, if (TLVP_PRESENT(&tp, GSM0808_IE_TMSI) && TLVP_LEN(&tp, GSM0808_IE_TMSI) == 4) { - tmsi = ntohl(*(uint32_t *) TLVP_VAL(&tp, GSM0808_IE_TMSI)); + tmsi = ntohl(tlvp_val32_unal(&tp, GSM0808_IE_TMSI)); } /* diff --git a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c index 22b8a35..e13827b 100644 --- a/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c +++ b/openbsc/src/osmo-bsc_nat/bsc_mgcp_utils.c @@ -191,7 +191,7 @@ int bsc_mgcp_assign_patch(struct nat_sccp_connection *con, struct msgb *msg) return -1; } - cic = ntohs(*(uint16_t *)TLVP_VAL(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); + cic = ntohs(tlvp_val16_unal(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)); timeslot = cic & 0x1f; multiplex = (cic & ~0x1f) >> 5; -- 1.8.4.2

1 2

new buzzword for HLR
by ☎ 26 Jun '14

26 Jun '14

Hi all. I recall talks about sqlite-backed HLR being bottleneck and that it should be replaced with something more decent. As far as I recall that idea is not materialized yet so I'd like to bring new db buzz-word I've stumbled upon recently: http://www.aerospike.com/press-releases/aerospike-open-sources-visionary-da… If you remove all the marketing junk it's essentially greatly revamped AlchemyDB with AGPL license for server (various language bindings for client library under apache license), transactions and claim for very-small latencies (approx 5 ms!) which grabbed my attention. It's unlikely that I'll be able to allocate time to work on that ATM but maybe it'll spark interest in someone else :) -- best regards, Max, http://fairwaves.co

2 1

OpenBSC unsubscribe notification
by mailman-bounces＠lists.osmocom.org 25 Jun '14

25 Jun '14

osmocom(a)ninoc.nl has been removed from OpenBSC.

1 0

osmo-nitb: %This BTS does not support TSC!=BCC
by Erich Dachleger 24 Jun '14

24 Jun '14

Hi all, I have followed the the guide in network_from_scratch and use 1 osmocom phone as transceiver. I use the suggested configs for open-bsc.cfg and osmo-bts.cfg and can register to the network I run. However in the output from osmo--nitb ,in the start I get a message about the training sequence: ________________________________________________ % This BTS does not support a TSC!=BCC, Falling back to BCC and after the DB: Database initialized messages DB: Database prepared ---------------------------------- -------------------------------- <0005>bsc.init.c:265 bootstrapping RSL for BTS/TRX(0/0) on ARFCN 533 using MCC=1 MNC=1 LAC=1 CID=0 BSIC=63 TSC 7 ------------------------------------------ <0002> gsm.subscriber.c: 378 Subscriber <imsi> ATTACHED LAC=1 ----------------------------------------------------------------------------------------------------- I have entered hlr.sqlite and assigned an extension to my imsi but when I enter the VTY and execute enable subscriber imsi <imsi> sms send test123 I get: %Unknown command So it appears smsqueue is not enabled. Does anyone know what to look for to enable it? I have tried the vty commands trigger smsqueue but to no avail.. According to the network from scratch wiki sms (and broadcast) should function with one phone where TS0 is served ------------------------------------------------------------------- osmo-bts-trx outputs lines of <0006> scheduler.c 338 ---- chan=SDCC/4(0) --- chan=SACC/4(0) ----- chan=BCCH(0) ---------------------------------------------------------------------------------------------------------- When the firmware is loaded onto the phone I get time on arrival and signal to noise ratio messages: TOA=4 snr=16384 (Thres 2560) freq_err=40 pm=-70 -------------------------------------------------------- So that is grossly exceeding the threshold value. But is that related to not being able to use smsqueue? Regards Erich

1 0

trau_decode_fr memory corruption. Fix requested
by Holger Hans Peter Freyther 23 Jun '14

23 Jun '14

Dear Andreas, Harald, I don't really know much about the bit order of TRAU frames but the trau_test.c is causing an out of bounds access to the gsm_fr_map. Re-produce (GCC >= 3.8 or clang >= 3.2 required): $ make clean && make CFLAGS+="-ggdb3 -Og -fsanitize=address" $ cd tests/trau $ ./trau_test Issue: Breakpoint 1, 0xb69e7810 in __asan_report_error () from /usr/lib/i386-linux-gnu/libasan.so.0 (gdb) bt #0 0xb69e7810 in __asan_report_error () from /usr/lib/i386-linux-gnu/libasan.so.0 #1 0xb69e08cf in __asan_report_load1 () from /usr/lib/i386-linux-gnu/libasan.so.0 #2 0x0804c4e7 in trau_encode_fr (tf=tf@entry=0xbffff530, data=data@entry=0xbffff700 <incomplete sequence \320>) at trau_mux.c:441 #3 0x08048e06 in test_trau_fr_efr (data=<optimized out>, data@entry=0xbffff700 <incomplete sequence \320>) at trau_test.c:35 #4 0x080494bf in main () at trau_test.c:70 (gdb) frame2 Undefined command: "frame2". Try "help". (gdb) frame 2 #2 0x0804c4e7 in trau_encode_fr (tf=tf@entry=0xbffff530, data=data@entry=0xbffff700 <incomplete sequence \320>) at trau_mux.c:441 441 k = gsm_fr_map[++l]-1; (gdb) p l $1 = 76 (gdb) p l $2 = 76 (gdb) p sizeof(gsm_fr_map) $3 = 76 Please fix as soon as possible as I would like to enable ASAN checking on the jenkins as soon as possible. kind regards holger

2 2

[PATCH 1/2] trau_mux.c: Prevent out-of-bounds read in trau_encode_fr()
by Harald Welte 23 Jun '14

23 Jun '14

found by -fsanitize=address the last iteration of the loop, where i == 259 and o == 260. It is read out-of-bounds but the content is never used. --- openbsc/src/libtrau/trau_mux.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/openbsc/src/libtrau/trau_mux.c b/openbsc/src/libtrau/trau_mux.c index fd1895f..4f159e4 100644 --- a/openbsc/src/libtrau/trau_mux.c +++ b/openbsc/src/libtrau/trau_mux.c @@ -436,6 +436,9 @@ void trau_encode_fr(struct decoded_trau_frame *tf, o = 0; /* offset output bits */ while (i < 260) { tf->d_bits[k+o] = (data[j/8] >> (7-(j%8))) & 1; + /* to avoid out-of-bounds access in gsm_fr_map[++l] */ + if (i == 259) + break; if (--k < 0) { o += gsm_fr_map[l]; k = gsm_fr_map[++l]-1; -- 2.0.0 -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

OpenBSC