Renewing OpenBTS for 2023

.gitmodules

@@ -1,8 +1,8 @@
 [submodule "CommonLibs"]
 	path = CommonLibs
-	url = https://github.com/RangeNetworks/CommonLibs.git
+	url = https://github.com/PentHertz/CommonLibs.git
 	branch = master
 [submodule "NodeManager"]
 	path = NodeManager
-	url = https://github.com/RangeNetworks/NodeManager.git
+	url = https://github.com/PentHertz/NodeManager.git
 	branch = master

CLI/CLIServer.cpp

@@ -202,7 +202,7 @@ void Parser::cliServer()
 						close(i);
 						continue; // go to next socket
 					}
-					if (len < (int) sizeof(len)) // should never get here
+					if (nread < (int) sizeof(len)) // should never get here
 					{
 						char buf[BUFSIZ];
 						sprintf(buf, "Unable to read complete length, s.b. %d bytes, got %d bytes\n", sizeof(len), len);

Control/L3StateMachine.cpp

@@ -1,6 +1,7 @@
 /**@file Declarations for Circuit Switched State Machine and related classes. */
 /*
 * Copyright 2013, 2014 Range Networks, Inc.
+* Renewed for 2023 by FlUxIuS @ Penthertz
 *
 * This software is distributed under multiple licenses;
 * see the COPYING file in the main directory for licensing
@@ -85,11 +86,11 @@ void MachineBase::machineErrorMessage(int level, int state, const L3Message *l3m
 
 	// This kind sucks, digging into the Logger.  The logger could be better.
 	if (l3msg) {
-		Log(level).get() <<os <<" Unexpected L3 message:"<<l3msg;
+		Log(level).get() <<os.str() <<" Unexpected L3 message:"<<l3msg;
 	} else if (sipmsg) {
-		Log(level).get() <<os <<" Unexpected SIP message:"<<sipmsg;
+		Log(level).get() <<os.str() <<" Unexpected SIP message:"<<sipmsg;
 	} else {
-		Log(level).get() <<os <<" Unexpected"<<LOGHEX(state);
+		Log(level).get() <<os.str() <<" Unexpected"<<LOGHEX(state);
 	}
 }
 

GPRS/MSInfo.cpp

@@ -1,5 +1,6 @@
 /*
 * Copyright 2011, 2014 Range Networks, Inc.
+* Renewed for 2023 by FlUxIuS @ Penthertz
 *
 * This software is distributed under multiple licenses;
 * see the COPYING file in the main directory for licensing
@@ -638,7 +639,7 @@ bool MSInfo::msAssignChannels()
         if (msPCHDowns.size() > 1) {
             std::ostringstream os;
             msDumpChannels(os);
-            LOG(INFO) << "Multislot assignment for "<<this<<os;
+            LOG(INFO) << "Multislot assignment for "<<this<<os.str();
         }
 
 	} else {

GSMShare/A51.h

@@ -1,4 +1,4 @@
-
+// Renewed for 2023 by FlUxIuS @ Penthertz
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -7,5 +7,5 @@ typedef unsigned char byte;
 typedef unsigned long word;
 typedef word bit;
 
-void A51_GSM( byte *key, int klen, int count, byte *block1, byte *block2 );
+void A51_GSM( unsigned char *key, int klen, int count, unsigned char *block1, unsigned char *block2 );
 

Globals/GlobalVars.cpp

@@ -35,6 +35,7 @@ const char* gOpenBTSWelcome =
 	"Copyright 2008, 2009, 2010 Free Software Foundation, Inc.\n"
 	"Copyright 2010 Kestrel Signal Processing, Inc.\n"
 	"Copyright 2011-2021 Range Networks, Inc.\n"
+	"Reloaded for 2023 by FlUxIuS @ Penthertz SAS.\n"
 	"Release " VERSION "+" REPO_REV " " PROD_CAT " formal build date " TIMESTAMP_ISO "\n"
 	"\"OpenBTS\" is a registered trademark of Range Networks, Inc.\n"
 	"\nContributors:\n"

README → README.md

@@ -1,5 +1,88 @@
-Welcome to the OpenBTS source code.
+Welcome to the OpenBTS  source code reloaded for 2024 supporting new UHD drivers and Ubuntu 22.04 LTS to be compiled against C++11 and C++17.
 
+# What is this project?
+
+This projects provides a GSM+GPRS Radio Access Network Node with Software-Defined Radio.
+
+# Supported hardware
+
+* USRPs:
+	* USRP v1 (with 52 MHz clock -> but can be patched for default 64 MHz) 
+	* USRP2
+	* USRP B200/B210 and B205mini-*
+	* USRP N210
+	* USRP X3*0
+	* USRP N210
+* UmTRX
+* LimeSDR with OsmoTRX transceiver by now
+* ANTSDR E200: Warning! Super experimental as we don't own the hardware yet (send your captures centered on the used ARFCN for debug)
+
+# Quick usage
+
+## Setup
+
+Clone the repository and use the pre-installation script `preinstall.sh` to clone all other projects, submodules and install dependencies:
+
+```
+$ git clone https://github.com/PentHertz/OpenBTS.git
+$ cd OpenBTS
+$ # Optionally, checkout 5.1.0 branch which is the stable one with `git checkout 5.1.0`
+$ ./preinstall.sh # note that for now libcoredumper will show some failures but we quickly bypass them forcing the compilation
+```
+
+Once it is finished, you can proceed with the installation of OpenBTS as follows:
+
+```
+$ ./autogen.sh
+$ ./configure --with-uhd # use different options for other drivers
+$ make -j$(nproc)
+$ sudo make install
+$ sudo ldconfig
+```
+
+And then we can launch everything!
+
+## Running everything
+
+Preferably run the probe UHD tool to load the firmware and FPGA into the USRP first:
+
+```
+$ uhd_usrp_probe 
+[INFO] [UHD] linux; GNU C++ version 11.2.0; Boost_107400; UHD_4.1.0.5-3
+[INFO] [B200] Loading firmware image: /usr/share/uhd/images/usrp_b200_fw.hex...
+[INFO] [B200] Detected Device: B210
+[INFO] [B200] Loading FPGA image: /usr/share/uhd/images/usrp_b210_fpga.bin...
+[...]
+```
+
+You can use `screen`, `tmux` or just laucnh everything except `OpenBTS` in background:
+
+```
+$ sudo smqueue &
+$ sudo sipauthserve &
+$ sudo /OpenBTS/OpenBTS
+```
+
+And voilà!
+
+# Docker container
+
+A Docker images has been also generated for the backup and is ready to use with all installed tools: https://hub.docker.com/r/penthertz/openbts
+
+# Fuzzing with OpenBTS
+
+The Testcall feature has been reintroduced and includes also a SMS Fuzzing features thanks to @Djimmer work, and is under test with this new version of OpenBTS.
+
+You can already test it with the `fuzzing-dev` branch:
+
+```
+git checkout fuzzing-dev
+```
+
+Do not hesitate to send issue or pull requests in order to stabilize it.
+
+
+# Old README
 
 For free support, please subscribe to [email protected].
 See http://sourceforge.net/mailarchive/forum.php?forum_name=openbts-discuss
@@ -58,8 +141,7 @@ normal GNU build process with the rest of OpenBTS.  To build smqueue, go
 into the smqueue directory and just type "make -f Makefile.standalone".
 
 
-
-Release history:
+# Release history:
 
 Release	Name		SVN Reposiory	SVN Rev	Comments
 
@@ -178,3 +260,5 @@ Release	Name		SVN Reposiory	SVN Rev	Comments
 
 2.9	Plaquemine	Range				socket-based remote CLI
 							merge-in of "S" Release
+5.0     ?                ?                              ?
+5.1     FlUxIuS         Penthertz                       Release for 2023 compiling with fresh Ubuntu 22.04

SGSNGGSN/GPRSL3Messages.cpp

@@ -367,6 +367,22 @@ void GMMAttach::gmParseIEs(L3GmmFrame &src, size_t &rp, const char *culprit)
 			mTmsiStatus = iei & 1;
 			continue;
 		}
+		if ((iei & 0xf0) == 0xd0) {
+            	// 10.5.7.8 Device properties. Ignore for now
+            		continue;
+        	}
+        	if ((iei & 0xf0) == 0xe0) {
+            	// 10.5.5.29 P-TMSI type. Ignore for now
+            		continue;
+        	}
+        	if ((iei & 0xf0) == 0xc0) {
+            	// 10.5.1.15 MS network feature support. Ignore for now
+            		continue;
+        	}
+        	if ((iei & 0xf0) == 0xf0) {
+            	// 10.5.5.0 Additional update type. Ignore for now
+            		continue;
+        	}
 		switch (iei) {
 		case 0x19:	// TV Old P-TMSI signature.
 			// Dont have a 3 byte 'read' function so use getField then advance rp by 3.
@@ -385,6 +401,10 @@ void GMMAttach::gmParseIEs(L3GmmFrame &src, size_t &rp, const char *culprit)
 		// The specified length is of the ie itself, excluding the iei type and length byte.
 		// Get the length, but dont move rp - let the IEs do that, because
 		// some of them need the length byte.
+		if (rp >= src.size()) {
+			SGSNERROR("invalid message size in "<<culprit <<" bytes="<<src.hexstr());
+			return;
+		}
 		int len = src.getByte(rp);
 		size_t nextrp = rp + len + 1;
 		if (nextrp > src.size()) {	// last one will have nextrp == src.size()

SGSNGGSN/Sgsn.cpp

@@ -1,5 +1,6 @@
 /*
 * Copyright 2011, 2014 Range Networks, Inc.
+* Renewed for 2023 by FlUxIuS @ Penthertz
 *
 * This software is distributed under multiple licenses;
 * see the COPYING file in the main directory for licensing
@@ -127,7 +128,7 @@ void SgsnInfo::sirm()
 {
 	std::ostringstream ss;
 	sgsnInfoDump(this,ss);
-	SGSNLOG("Removing SgsnInfo:"<<ss);
+	SGSNLOG("Removing SgsnInfo:"<<ss.str());
 	sSgsnInfoList.remove(this);
 	delete this;
 }
@@ -224,7 +225,7 @@ static void GmmRemove(GmmInfo *gmm)
 {
 	std::ostringstream ss;
 	gmmInfoDump(gmm,ss,0);
-	SGSNLOG("Removing gmm:"<<ss);
+	SGSNLOG("Removing gmm:"<<ss.str());
 	SgsnInfo *si;
 	RN_FOR_ALL(SgsnInfoList_t,sSgsnInfoList,si) {
 		// The second test here should be redundant.

SIP/SIP2Interface.cpp

@@ -1,6 +1,7 @@
 /*
 * Copyright 2008, 2009, 2010 Free Software Foundation, Inc.
 * Copyright 2011, 2014 Range Networks, Inc.
+* Renewed for 2023 by FlUxIuS @ Penthertz
 *
 * This software is distributed under multiple licenses;
 * see the COPYING file in the main directory for licensing
@@ -756,7 +757,7 @@ void MySipInterface::msiInit()
 	// FIXME -- Can we coordinate this with the global logger?
 	//ortp_set_log_level_mask(ORTP_MESSAGE|ORTP_WARNING|ORTP_ERROR);
 
-	ortp_set_log_handler(ortpLogFunc);
+	ortp_set_log_handler((BctbxLogFunc) ortpLogFunc);
 
 	mDriveThread.start((void *(*)(void*))driveLoop2, &gSipInterface );
 	mPeriodicServiceThread.start((void *(*)(void*))periodicServiceLoop, &gSipInterface );

SIP/SIPRtp.cpp

@@ -1,5 +1,6 @@
 /*
 * Copyright 2014 Range Networks, Inc.
+* Renewed for 2023 by FlUxIuS @ Penthertz
 *
 * This software is distributed under multiple licenses;
 * see the COPYING file in the main directory for licensing
@@ -125,13 +126,13 @@ void SipRtp::initRTP1(const char *d_ip_addr, unsigned d_port, unsigned dialogId)
 	rtp_session_set_payload_type(mSession, 3);
 	// (pat added) The last argument is user payload data that is passed to ourRtpTimestampJumpCallback()
 	// I was going to use the dialogId but decided to look up the dialog by mSession.
-	rtp_session_signal_connect(mSession,"timestamp_jump",(RtpCallback)ourRtpTimestampJumpCallback,dialogId);
+	rtp_session_signal_connect(mSession,"timestamp_jump",(RtpCallback)ourRtpTimestampJumpCallback,(void *) dialogId);
 
 	gCountRtpSockets++;
 #ifdef ORTP_NEW_API
 	rtp_session_set_local_addr(mSession, "0.0.0.0", mRTPPort, -1);
 #else
-	rtp_session_set_local_addr(mSession, "0.0.0.0", mRTPPort);
+	rtp_session_set_local_addr(mSession, "0.0.0.0", mRTPPort, mRTPPort+1);
 #endif
 	rtp_session_set_remote_addr(mSession, d_ip_addr, d_port);
 	WATCHF("*** initRTP local=%d remote=%s %d\n",mRTPPort,d_ip_addr,d_port);

TRXManager/TRXManager.cpp

@@ -320,9 +320,8 @@ int ::ARFCNManager::sendCommand(const char*command, const char*param, int *respo
 	int rspLen = sendCommandPacket(cmdBuf,response);
 	if (rspLen<=0) return -1;
 	// Parse and check status.
-	char cmdNameTest[15];
+	char cmdNameTest[16] = { 0 };
 	int status;
-	cmdNameTest[0]='\0';
         if (!responseParam)
 	  sscanf(response,"RSP %15s %d", cmdNameTest, &status);
         else
@@ -340,9 +339,8 @@ int ::ARFCNManager::sendCommand(const char*command, int param, int *responsePara
 	int rspLen = sendCommandPacket(cmdBuf,response);
 	if (rspLen<=0) return -1;
 	// Parse and check status.
-	char cmdNameTest[15];
+	char cmdNameTest[16] = { 0 };
 	int status;
-	cmdNameTest[0]='\0';
         if (!responseParam)
 	  sscanf(response,"RSP %15s %d", cmdNameTest, &status);
         else
@@ -361,9 +359,8 @@ int ::ARFCNManager::sendCommand(const char*command, const char* param)
 	int rspLen = sendCommandPacket(cmdBuf,response);
 	if (rspLen<=0) return -1;
 	// Parse and check status.
-	char cmdNameTest[15];
+	char cmdNameTest[16] = { 0 };
 	int status;
-	cmdNameTest[0]='\0';
 	sscanf(response,"RSP %15s %d", cmdNameTest, &status);
 	if (strcmp(cmdNameTest,command)!=0) return -1;
 	return status;
@@ -380,9 +377,8 @@ int ::ARFCNManager::sendCommand(const char*command)
 	int rspLen = sendCommandPacket(cmdBuf,response);
 	if (rspLen<=0) return -1;
 	// Parse and check status.
-	char cmdNameTest[15];
+	char cmdNameTest[16] = { 0 };
 	int status;
-	cmdNameTest[0]='\0';
 	sscanf(response,"RSP %15s %d", cmdNameTest, &status);
 	if (strcmp(cmdNameTest,command)!=0) return -1;
 	return status;