[PATCH 1/4] [gsm_04_08_gprs] Display the identity type for GMM IDENTITY REQUEST

List overview All Threads
Download

newer

older

patch: fix of double free bug

Improper dispatch of MNCC_REL_CNF...

Sylvain Munaut

18 Nov 2009 18 Nov '09

11:40 p.m.

From: Sylvain Munaut <tnt(a)246tNt.com> Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/gsm_04_08_gprs.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/openbsc/src/gsm_04_08_gprs.c b/openbsc/src/gsm_04_08_gprs.c index cac28d7..dc1c69f 100644 --- a/openbsc/src/gsm_04_08_gprs.c +++ b/openbsc/src/gsm_04_08_gprs.c @@ -220,7 +220,7 @@ static int gsm48_tx_gmm_id_req(struct msgb *old_msg, u_int8_t id_type) struct msgb *msg = gsm48_msgb_alloc(); struct gsm48_hdr *gh; - DEBUGP(DMM, "-> GPRS IDENTITY REQUEST\n"); + DEBUGP(DMM, "-> GPRS IDENTITY REQUEST: mi_type=%02x\n", id_type); msg->tlli = old_msg->tlli; msg->trx = old_msg->trx; -- 1.6.5.1

Show replies by date

Sylvain Munaut

18 Nov 18 Nov

11:40 p.m.

New subject: [PATCH 2/4] [bsc_init] Don't set NM_ATT_IPACC_RLC_CFG_3 attribute

From: Sylvain Munaut <tnt(a)246tNt.com> This is for EDGE model only and breaks init on older (eg. 139) models. EDGE is not advertised in the SI anyway ... Disabled for now. When GPRS is working, we can get back to it and do a proper check and init/advertise them properly Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/bsc_init.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c index 20b6501..00f25d8 100644 --- a/openbsc/src/bsc_init.c +++ b/openbsc/src/bsc_init.c @@ -386,8 +386,12 @@ static unsigned char nanobts_attr_cell[] = { 0x00, 250, 0x00, 250, 2, /* MCS2 */ +#if 0 + /* EDGE model only, breaks older models. + * Should inquire the BTS capabilities */ NM_ATT_IPACC_RLC_CFG_3, 0, 1, 2, /* MCS2 */ +#endif }; static unsigned char nanobts_attr_nsvc0[] = { -- 1.6.5.1

Sylvain Munaut

11:40 p.m.

New subject: [PATCH 3/4] [gprs] Fix hardcoded IP addresses in GPRS UDP communication

From: Sylvain Munaut <tnt(a)246tNt.com> Note, there is still an ugly hack: We send packets to the first BTS we find and not the "right" one, mostly because I had no idea how to find the right one ... Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/include/openbsc/gsm_data.h | 4 ++++ openbsc/src/bsc_init.c | 4 ++-- openbsc/src/input/ipaccess.c | 24 +++++++++++++++++++++++- 3 files changed, 29 insertions(+), 3 deletions(-) diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h index ed36e9a..670df8f 100644 --- a/openbsc/include/openbsc/gsm_data.h +++ b/openbsc/include/openbsc/gsm_data.h @@ -2,6 +2,7 @@ #define _GSM_DATA_H #include <sys/types.h> +#include <arpa/inet.h> struct value_string { unsigned int value; @@ -346,6 +347,9 @@ struct gsm_bts { struct { u_int16_t site_id; u_int16_t bts_id; + + struct in_addr ina_local; + struct in_addr ina_remote; } ip_access; struct { struct { diff --git a/openbsc/src/bsc_init.c b/openbsc/src/bsc_init.c index 00f25d8..2526306 100644 --- a/openbsc/src/bsc_init.c +++ b/openbsc/src/bsc_init.c @@ -1045,8 +1045,8 @@ static void patch_nm_tables(struct gsm_bts *bts) nanobts_attr_nsvc0[3] = bts->gprs.nsvc[0].nsvci >> 8; nanobts_attr_nsvc0[4] = bts->gprs.nsvc[0].nsvci & 0xff; - /* FIXME: patch our own IP address as SGSN IP */ - //nanobts_attr_nsvc0[10] = + /* patch our own IP address as SGSN IP */ + memcpy(&nanobts_attr_nsvc0[10], &bts->ip_access.ina_local, 4); /* patch BVCI */ nanobts_attr_cell[12] = bts->gprs.cell.bvci >> 8; diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c index fb13570..6ec4e0b 100644 --- a/openbsc/src/input/ipaccess.c +++ b/openbsc/src/input/ipaccess.c @@ -221,6 +221,20 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg, } DEBUGP(DINP, "Identified BTS %u/%u/%u\n", site_id, bts_id, trx_id); if (bfd->priv_nr == 1) { + int rv; + socklen_t l = sizeof(struct sockaddr_in); + struct sockaddr_in sa; + + rv = getpeername(bfd->fd, (struct sockaddr *)&sa, &l); + if (rv || (l != sizeof(struct sockaddr_in))) + return -EINVAL; + bts->ip_access.ina_remote = sa.sin_addr; + + rv = getsockname(bfd->fd, (struct sockaddr *)&sa, &l); + if (rv || (l != sizeof(struct sockaddr_in))) + return -EINVAL; + bts->ip_access.ina_local = sa.sin_addr; + bts->oml_link = e1inp_sign_link_create(&line->ts[1-1], E1INP_SIGN_OML, bts->c0, bts->oml_tei, 0); @@ -513,11 +527,19 @@ static int handle_gprs_write(struct bsc_fd *bfd) int ipac_gprs_send(struct msgb *msg) { + struct gsm_bts *bts; struct sockaddr_in sin; int rc; + /* FIXME: Just take the first ip.access bts we find */ + llist_for_each_entry(bts, &e1h->gsmnet->bts_list, list) { + if (!is_ipaccess_bts(bts)) + continue; + break; + } + sin.sin_family = AF_INET; - inet_aton("192.168.100.111", &sin.sin_addr); + sin.sin_addr = bts->ip_access.ina_remote; sin.sin_port = htons(23000); rc = sendto(e1h->gprs_fd.fd, msg->data, msg->len, 0, -- 1.6.5.1

Sylvain Munaut

11:40 p.m.

New subject: [PATCH 4/4] [gsm_04_08_gprs] Change GMM ATTACH REQUEST identity req logic

From: Sylvain Munaut <tnt(a)246tNt.com> Instead of trying to guess what we need, we just try to authorize the user and the authorize method will check and do identity requests as needed. Signed-off-by: Sylvain Munaut <tnt(a)246tNt.com> --- openbsc/src/gsm_04_08_gprs.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/openbsc/src/gsm_04_08_gprs.c b/openbsc/src/gsm_04_08_gprs.c index dc1c69f..d954266 100644 --- a/openbsc/src/gsm_04_08_gprs.c +++ b/openbsc/src/gsm_04_08_gprs.c @@ -240,6 +240,10 @@ static int gsm48_gmm_authorize(struct sgsn_mm_ctx *ctx, struct msgb *msg) if (strlen(ctx->imei) && strlen(ctx->imsi)) { ctx->mm_state = GMM_REGISTERED_NORMAL; return gsm48_tx_gmm_att_ack(msg); + } else if (!strlen(ctx->imei)) { + return gsm48_tx_gmm_id_req(msg, GSM_MI_TYPE_IMEI); + } else if (!strlen(ctx->imsi)) { + return gsm48_tx_gmm_id_req(msg, GSM_MI_TYPE_IMSI); } return 0; @@ -371,8 +375,6 @@ static int gsm48_rx_gmm_att_req(struct msgb *msg) strncpy(ctx->imsi, mi_string, sizeof(ctx->imsi)); #endif } - /* we always want the IMEI, too */ - gsm48_tx_gmm_id_req(msg, GSM_MI_TYPE_IMEI); /* FIXME: Start some timer */ ctx->mm_state = GMM_COMMON_PROC_INIT; ctx->tlli = msg->tlli; @@ -383,8 +385,6 @@ static int gsm48_rx_gmm_att_req(struct msgb *msg) ctx = sgsn_mm_ctx_by_ptmsi(tmsi); if (!ctx) { ctx = sgsn_mm_ctx_alloc(msg->tlli, &ra_id); - /* Send MM INFO request for IMSI */ - gsm48_tx_gmm_id_req(msg, GSM_MI_TYPE_IMSI); /* FIXME: Start some timer */ ctx->mm_state = GMM_COMMON_PROC_INIT; ctx->tlli = msg->tlli; @@ -397,8 +397,9 @@ static int gsm48_rx_gmm_att_req(struct msgb *msg) /* FIXME: allocate a new P-TMSI (+ P-TMSI signature) */ /* FIXME: update the TLLI with the new local TLLI based on the P-TMSI */ - //return gsm48_tx_gmm_att_ack(msg); - return 0; + DEBUGPC(DMM, "\n"); + + return ctx ? gsm48_gmm_authorize(ctx, msg) : 0; err_inval: DEBUGPC(DMM, "\n"); -- 1.6.5.1

Harald Welte

20 Nov 20 Nov

10:21 a.m.

New subject: [PATCH 4/4] [gsm_04_08_gprs] Change GMM ATTACH REQUEST identity req logic

On Wed, Nov 18, 2009 at 11:40:11PM +0100, Sylvain Munaut wrote:

...

From: Sylvain Munaut <tnt(a)246tNt.com> Instead of trying to guess what we need, we just try to authorize the user and the authorize method will check and do identity requests as needed.

thanks, will apply. -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

Harald Welte

1:56 p.m.

New subject: [PATCH 3/4] [gprs] Fix hardcoded IP addresses in GPRS UDP communication

On Wed, Nov 18, 2009 at 11:40:10PM +0100, Sylvain Munaut wrote:

...

From: Sylvain Munaut <tnt(a)246tNt.com> Note, there is still an ugly hack: We send packets to the first BTS we find and not the "right" one, mostly because I had no idea how to find the right one ...

ok, I think we should wait for a proper solution, rather than replacing one hack with another one.

...

@@ -346,6 +347,9 @@ struct gsm_bts { struct { u_int16_t site_id; u_int16_t bts_id; + + struct in_addr ina_local; + struct in_addr ina_remote; } ip_access;

this makes sense, sure.

...

- /* FIXME: patch our own IP address as SGSN IP */ - //nanobts_attr_nsvc0[10] = + /* patch our own IP address as SGSN IP */ + memcpy(&nanobts_attr_nsvc0[10], &bts->ip_access.ina_local, 4);

that, too.

...

@@ -513,11 +527,19 @@ static int handle_gprs_write(struct bsc_fd *bfd) int ipac_gprs_send(struct msgb *msg) { + struct gsm_bts *bts; struct sockaddr_in sin; int rc; + /* FIXME: Just take the first ip.access bts we find */ + llist_for_each_entry(bts, &e1h->gsmnet->bts_list, list) { + if (!is_ipaccess_bts(bts)) + continue; + break; + } +

msg->trx will be set, so you can simply dereference msg->trx->bts to get to the bts to which this should be sent. please change that, test it and resubmit. Thanks! -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

Sylvain Munaut

3:11 p.m.

New subject: [PATCH 3/4] [gprs] Fix hardcoded IP addresses in GPRS UDP communication

Harald Welte wrote:

...

Note, there is still an ugly hack: We send packets to the first BTS we find and not the "right" one, mostly because I had no idea how to find the right one ...

ok, I think we should wait for a proper solution, rather than replacing one hack with another one.

Yes, I hesitated posting the patch, but the advantage of this hack was that it is automatic :)

...

+ /* FIXME: Just take the first ip.access bts we find */ + llist_for_each_entry(bts, &e1h->gsmnet->bts_list, list) { + if (!is_ipaccess_bts(bts)) + continue; + break;

msg->trx will be set, so you can simply dereference msg->trx->bts to get to the bts to which this should be sent.

That was my first thought. But it's not set (or at least not always), leading to a seg fault when I tried that. For examples packets send with gprs_ns_tx_simple don't have it set. And I didn't see any clean way to get it from where those were generated. Sylvain

Harald Welte

4:25 p.m.

New subject: [PATCH 3/4] [gprs] Fix hardcoded IP addresses in GPRS UDP communication

Hi Sylvain, On Fri, Nov 20, 2009 at 03:11:33PM +0100, Sylvain Munaut wrote:

...

+ /* FIXME: Just take the first ip.access bts we find */ + llist_for_each_entry(bts, &e1h->gsmnet->bts_list, list) { + if (!is_ipaccess_bts(bts)) + continue; + break;

msg->trx will be set, so you can simply dereference msg->trx->bts to get to the bts to which this should be sent.

ok, we need to fix those. I understand that the NS layer does not know yet which BTS has sent it. That's what the ns_link structure was intended for. However, what makes probably even more sense is to identify the BTS based on its source IP address in the input/ipaccess.c code. So for every packet we receive, we iterate over all BTS's and compare the source IP address. If we have a match, we assign msg->trx = bts->c0 and all higher layers have that knowledge and can use it. Regards, -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)