- OpenBSC - lists.osmocom.org

Hello from Montreal
by Nick Khamis 03 Jun '13

03 Jun '13

Hello Everyone, Random weekend googling brought my attention to the very interesting projects of OpenBSC, Osmocom etc.. My background started off on a good foot in EE, and quickly spiraled downwards into the uninteresting world of information system or business applications with many lines of code written etc.. I still don't know how that happened, but lets blame it on demand.... Upon completing my research as a masters student, my specializations veered towards Natural Language Processing, Machine Learning, Semantic Web etc.. which was a little more interesting with formal concepts and so on. Manage to published papers, and even a book: http://scholar.google.ca/citations?user=lh6e3q0AAAAJ&hl=en http://www.amazon.com/Applying-Computational-Linguistics-API-Documentation/… Moving forward, and the PURPOSE for my email is I would really like to sink my teeth into the mysterious world of GSM, be it at the node side (i.e., cell phone, bank or via rail train) and the base station side or whatever... Maybe even devise a possible PhD topic funded by a research lab here in Canada. Security topics and exploitations are heavily funded here by DoD and so on, the trick really comes down to wording.... Anyhow, I am afraid that any more chatter may be perceived as "noise" so let's just call this the hello world of emails, and hope it's welcomed and not scrutinized for taking away from valuable development time, at which point I do apologize! Kind Regards, Ninus from the land of 1900Mhz and T1 networks

1 0

Using FakeBTS
by Priyanka Behl 31 May '13

31 May '13

Hi everyone, I have this 1 question: is it possible to have a complete communicating network with FakeBTS runing on 1 machine and all other processes on the other? (I have asked this question earlier but have not received any answer as yet. can somebody please care to reply, its a little urgent) Thanks and regards Priyanka

1 0

[PATCH] rsl: fix the unaligned memory access
by Nicolas J. Bouliane 29 May '13

29 May '13

the armv5 can do 32bit/16bit reads only from the aligned address use tlv.h macro to copy data to local variable Signed-off-by: Nicolas J. Bouliane <nicolas.bouliane(a)nutaq.com> --- src/common/rsl.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/src/common/rsl.c b/src/common/rsl.c index 9a50a33..5a1b867 100644 --- a/src/common/rsl.c +++ b/src/common/rsl.c @@ -1089,7 +1089,6 @@ static int rsl_tx_ipac_XXcx_ack(struct gsm_lchan *lchan, int inc_pt2, { struct msgb *msg; uint8_t chan_nr = gsm_lchan2chan_nr(lchan); - uint32_t *att_ip; const char *name; struct in_addr ia; @@ -1116,8 +1115,7 @@ static int rsl_tx_ipac_XXcx_ack(struct gsm_lchan *lchan, int inc_pt2, /* locally bound IP */ msgb_v_put(msg, RSL_IE_IPAC_LOCAL_IP); - att_ip = (uint32_t *) msgb_put(msg, sizeof(uint32_t)); - *att_ip = htonl(lchan->abis_ip.bound_ip); + msgb_put_u32(msg, lchan->abis_ip.bound_ip); /* locally bound port */ msgb_tv16_put(msg, RSL_IE_IPAC_LOCAL_PORT, @@ -1199,11 +1197,9 @@ static int tx_ipac_XXcx_nack(struct gsm_lchan *lchan, uint8_t cause, return -ENOMEM; if (inc_ipport) { - uint32_t *att_ip; /* remote IP */ msgb_v_put(msg, RSL_IE_IPAC_REMOTE_IP); - att_ip = (uint32_t *) msgb_put(msg, sizeof(uint32_t)); - *att_ip = htonl(lchan->abis_ip.connect_ip); + msgb_put_u32(msg, lchan->abis_ip.connect_ip); /* remote port */ msgb_tv16_put(msg, RSL_IE_IPAC_REMOTE_PORT, @@ -1248,8 +1244,8 @@ static int rsl_rx_ipac_XXcx(struct msgb *msg) struct gsm_lchan *lchan = msg->lchan; struct gsm_bts_role_bts *btsb = bts_role_bts(msg->lchan->ts->trx->bts); const uint8_t *payload_type, *speech_mode, *payload_type2; - const uint32_t *connect_ip; - const uint16_t *connect_port; + uint32_t connect_ip = 0; + uint16_t connect_port = 0; int rc, inc_ip_port = 0, port; char *name; @@ -1267,8 +1263,14 @@ static int rsl_rx_ipac_XXcx(struct msgb *msg) speech_mode = TLVP_VAL(&tp, RSL_IE_IPAC_SPEECH_MODE); payload_type = TLVP_VAL(&tp, RSL_IE_IPAC_RTP_PAYLOAD); payload_type2 = TLVP_VAL(&tp, RSL_IE_IPAC_RTP_PAYLOAD2); - connect_ip = (uint32_t *) TLVP_VAL(&tp, RSL_IE_IPAC_REMOTE_IP); - connect_port = (uint16_t *) TLVP_VAL(&tp, RSL_IE_IPAC_REMOTE_PORT); + + if (TLVP_PRESENT(&tp, RSL_IE_IPAC_REMOTE_IP)) { + connect_ip = tlvp_val32_unal(&tp, RSL_IE_IPAC_REMOTE_IP); + } + + if (TLVP_PRESENT(&tp, RSL_IE_IPAC_REMOTE_PORT)) { + connect_port = tlvp_val16_unal(&tp, RSL_IE_IPAC_REMOTE_PORT); + } if (dch->c.msg_type == RSL_MT_IPAC_CRCX && connect_ip && connect_port) inc_ip_port = 1; @@ -1350,14 +1352,14 @@ static int rsl_rx_ipac_XXcx(struct msgb *msg) /* Special rule: If connect_ip == 0.0.0.0, use RSL IP * address */ - if (*connect_ip == 0) { + if (connect_ip == 0) { struct ipabis_link *link = lchan->ts->trx->rsl_link; ia.s_addr = htonl(link->ip); } else - ia.s_addr = *connect_ip; + ia.s_addr = connect_ip; rc = osmo_rtp_socket_connect(lchan->abis_ip.rtp_socket, - inet_ntoa(ia), ntohs(*connect_port)); + inet_ntoa(ia), ntohs(connect_port)); if (rc < 0) { LOGP(DRSL, LOGL_ERROR, "%s Failed to connect RTP/RTCP sockets\n", @@ -1370,7 +1372,7 @@ static int rsl_rx_ipac_XXcx(struct msgb *msg) } /* save IP address and port number */ lchan->abis_ip.connect_ip = ntohl(ia.s_addr); - lchan->abis_ip.connect_port = ntohs(*connect_port); + lchan->abis_ip.connect_port = ntohs(connect_port); } else { /* FIXME: discard all codec frames */ -- 1.7.10.4

3 7

Testing OpenBSC with FakeBTS
by Priyanka Behl 28 May '13

28 May '13

Hi everyone, I am trying to test Openbsc with the FakeBTS and I wanted to know if it is possible to run FakeBTS on one machine and all other processes ie osmo-nitb, gggsn, osmo-sgsn and osmo-pcu on another machine and set up communication among these? Thanks and regards Priyanka

1 0

Error during the installation of the softBTS
by Priyanka Behl 23 May '13

23 May '13

Hi everyone, During the installation of the softBTS the following error incurred: root@ubuntu:/# aptitude install gnu-smalltalk osmo-st-openbsc-test couldn't find any package whose name or description matched "osmo-st-openbsc-test" while gnu smalltalk has been installed. can somebody help me with this? Thanks and regards Priyanka

1 0

For sale: 2 x nanoBTS 1800 and 1x nanoBTS booster 1800
by Konrad Meier 23 May '13

23 May '13

Hello, At the University of Freiburg (Germany) we have two nanoBTS 1800 and a nanoBTS booster 1800 for sale: NanoBTS Modell 139: 1500 Euro NanoBTS Modell 165G: 2500 Euro NanoBTS-Booster 1800: 1000 Euro The nanoBTS 139 needs to be unplugged if the software Open-BSC is restarted. Most likely this is only a software problem. Details for the booster are given here: http://www.proximus.com.ua/Nano_BTS_high_power_GSM_booster.html The NanoBTS-Booster package includes everything required: - Booster - Power supply - 2x cable to connect to the nanoBTS (0,5 meter) - 1x cable to the antenna (5 meter) - 1x omnidirectional antenna. 3 dBd gain / 1800 MHz The antenna is a high quality omnidirectional antenna from Procom (cxl-1800-3). Best regards Konrad Meier

2 2

Testing Openbsc without a BTS
by Priyanka Behl 22 May '13

22 May '13

Hi everyone, I am trying to test Openbsc without a BTS. I need your help as I am very new to Openbsc. After doing the configurations for openbsc-multitrx.cfg file this is how I started the process: cd openbsc/openbsc src/osmo-nitb -c doc/examples/osmo-nitb/nanobts/openbsc-multitrx.cfg -C And the output I received was: <0019> input/ipaccess.c:925 enabling ipaccess BSC mode DB: Database initialized. DB: Database prepared. <0001d> sms_queue.c:220 Attempting to send 20 SMS After this I added a subscriber in the hlr and the subscriber was added in the output: <0019> ipaccess.c:841 enabling ipaccess BSC mode DB: Database initialized. DB: Database prepared. <001d> sms_queue.c:232 Attempting to send 20 SMS <0002> gsm_subsciber.c:390 Expiring inactive subscriber Testing(ID 1) After this I used the following commands on the osmo-nitb console and receive the following output: Openbsc>show subscrber id 1 ID: 1, Authorized: 1 Name: 'Testing' Extension: 9999999999 LAC: 0/0x0 IMSI: 404012345678903 TMSI: 0012D681 Pending: 0 Usecount: 1 Openbsc> subscriber id 1 send sms Hello Openbsc> subscriber id 1 silent call start any %subscriber not attached Am I doing the right thing, are there some more configurations that I am required to do and is this the only output that can be achieved without a BTS? Also the lac is being displayed as 0/0x0, is this how it should have been? Please let me know, I really need help on this. Thanks and regards Priyanka

2 7

New handover algorithm
by jolly 16 May '13

16 May '13

Hi, Jean-Samuel and me developed an advanced handover algorithm for OpenBSC. Before implementing it, we would like to get any feedback, so I decided to post it in this mailing list. The document that describes the algorithm can be downloaded at: http://home.eversberg.eu/handover-algorithm-v2.3.pdf Regards, Andreas Handover shall ensure that the mobile station is always on the best cell during a call. This results in best speech quality and allows a lower TX level (up-link) to save battery and reduce interference. Sometimes this is not desirable, especially if a cell with large coverage becomes congested after handover. In this situation it makes sense to balance the usage between cells to prevent congestion. If a cell is congested, one or several mobile stations need to be handovered to a different cell, even if that cell is not the best cell for these mobile station. In case that a mobile station needs to handover to prevent a loss of radio link, it makes sense to handover it to a cell that is congested afterwards. In this situation, a different mobile station on the congested target cell must be handovered to a non-congested neighbor cell, to solve or balance the congestion. In order to negotiate used codec and TCH rate during call setup, Immediate Assignment shall assign an SDCCH channel, if available. After negotiation is complete, assignment to the available TCH slot is made.

2 2

Testing Openbsc with software BTS
by Priyanka Behl 14 May '13

14 May '13

Hi, As per your mails about a pure software BTS when I tried installing it as: root@server:~# echo 'deb http://download.opensuse.org/repositories/home:/zecke23/Debian_6.0/ ./' > /etc/apt/sources.list.d/ I got the following error bash: /etc/apt/sources.list.d/: Is a directory so next i tried installing it as: root@server:~# echo 'deb http://download.opensuse.org/repositories/home:/zecke23/Debian_6.0/ ./' > /etc/apt/sources.list root@server:~# apt-get update Get:1 http://download.opensuse.org/ ./ Release.gpg [189 B] Ign http://download.opensuse.org/repositories/home:/zecke23/Debian_6.0/ ./ Translation-en Ign http://download.opensuse.org/repositories/home:/zecke23/Debian_6.0/ ./ Translation-en_IN Get:2 http://download.opensuse.org/ ./ Release [463 B] Ign http://download.opensuse.org/ ./ Release Ign http://download.opensuse.org/ ./ Packages/DiffIndex Ign http://download.opensuse.org/ ./ Packages Hit http://download.opensuse.org/ ./ Packages Fetched 190 B in 1s (145 B/s) Reading package lists... Done W: GPG error: http://download.opensuse.org/ ./ Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7E816D4EB59F3637 root@server:~# gpg --keyserver pool.sks-keyservers.net --recv-keys 7E816D4EB59F3637 gpg: requesting key B59F3637 from hkp server pool.sks-keyservers.net gpgkeys: key 7E816D4EB59F3637 not found on keyserver gpg: no valid OpenPGP data found. gpg: Total number processed: 0 do you know how to troubleshoot this? Thanks and regards Priyanka ________________________________ From: Holger Hans Peter Freyther <holger(a)freyther.de> To: Priyanka Behl <priyankabehl(a)ymail.com> Cc: "openbsc(a)lists.osmocom.org" <openbsc(a)lists.osmocom.org> Sent: Thursday, 9 May 2013 1:59 PM Subject: Re: Testing Openbsc without a BTS On Thu, May 09, 2013 at 02:24:55PM +0800, Priyanka Behl wrote: Hi, > Hi everyone, > I am trying to test Openbsc without a BTS. I need your help as I am very new to Openbsc. > After doing the configurations for openbsc-multitrx.cfg file this is how I started the process: you might want to look at my mails about a pure software BTS used to test OpenBSC. The mails are here[1][2]. > cd openbsc/openbsc > src/osmo-nitb -c doc/examples/osmo-nitb/nanobts/openbsc-multitrx.cfg -C > Openbsc> subscriber id 1 send sms Hello > Openbsc> subscriber id 1 silent call start any > %subscriber not attached This is to be expected. Our system enforces a periodic location updating procedure and if a subscriber will not do that, it will be expired. Your subscriber needs to make a Location Updating Procedure. holger [1] http://lists.osmocom.org/pipermail/openbsc/2012-October/004210.html [2] http://lists.osmocom.org/pipermail/openbsc/2012-October/004250.html

1 0

[PATCH] nat: fix use after free in forward_sccp_to_bts
by pablo＠gnumonks.org 12 May '13

12 May '13

From: Pablo Neira Ayuso <pablo(a)gnumonks.org> valgrind detected an use after free in the path of forward_sccp_to_bts. The 'parsed' object is referenced from update_con_authorize. --- openbsc/src/osmo-bsc_nat/bsc_nat.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/openbsc/src/osmo-bsc_nat/bsc_nat.c b/openbsc/src/osmo-bsc_nat/bsc_nat.c index b9bf36c..be8d56a 100644 --- a/openbsc/src/osmo-bsc_nat/bsc_nat.c +++ b/openbsc/src/osmo-bsc_nat/bsc_nat.c @@ -718,15 +718,18 @@ static int forward_sccp_to_bts(struct bsc_msc_connection *msc_con, struct msgb * LOGP(DNAT, LOGL_ERROR, "Unknown connection for msg type: 0x%x from the MSC.\n", parsed->sccp_type); } - talloc_free(parsed); - if (!con) + if (!con) { + talloc_free(parsed); return -1; + } if (!con->bsc->authenticated) { + talloc_free(parsed); LOGP(DNAT, LOGL_ERROR, "Selected BSC not authenticated.\n"); return -1; } update_con_authorize(con, parsed, msg); + talloc_free(parsed); bsc_send_data(con->bsc, msg->l2h, msgb_l2len(msg), proto); return 0; -- 1.7.10.4

2 1