new release with possible fix for the blackberry...

The GSM04.08 Section 10.5.2.19 specifies the L2 Pseudo Length
and the length does not include rest octets, so we will need
to use a zero for the length.

The patch is coming from Dieter Spaar.

openbsc/configure.in

@@ -1,7 +1,6 @@
 dnl Process this file with autoconf to produce a configure script
-AC_INIT
-
-AM_INIT_AUTOMAKE(openbsc, 0.3.92onwaves)
+AC_INIT(openbsc, 0.3.99.16onwaves)
+AM_INIT_AUTOMAKE(AC_PACKAGE_NAME, AC_PACKAGE_VERSION)
 
 dnl kernel style compile messages
 m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
@@ -16,7 +15,7 @@ dnl checks for libraries
 AC_SEARCH_LIBS(crypt, crypt,
     [LIBCRYPT="-lcrypt"; AC_DEFINE([VTY_CRYPT_PW], [], [Use crypt functionality of vty.])])
 
-PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 0.1.3)
+PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 0.1.11)
 
 dnl checks for header files
 AC_HEADER_STDC

openbsc/include/openbsc/Makefile.am

@@ -6,7 +6,7 @@ noinst_HEADERS = abis_nm.h abis_rsl.h db.h gsm_04_08.h gsm_data.h \
 		 bsc_rll.h mncc.h transaction.h ussd.h gsm_04_80.h \
 		 silent_call.h mgcp.h meas_rep.h rest_octets.h \
 		 system_information.h handover.h mgcp_internal.h \
-		 vty.h bssap.h bsc_msc.h bsc_nat.h
+		 vty.h bssap.h bsc_msc.h bsc_nat.h bsc_msc_rf.h
 
 openbsc_HEADERS = gsm_04_08.h meas_rep.h bsc_api.h
 openbscdir = $(includedir)/openbsc

openbsc/include/openbsc/abis_nm.h

@@ -92,7 +92,7 @@ int abis_nm_sw_act_req_ack(struct gsm_bts *bts, u_int8_t obj_class, u_int8_t i1,
 int abis_nm_raw_msg(struct gsm_bts *bts, int len, u_int8_t *msg);
 int abis_nm_event_reports(struct gsm_bts *bts, int on);
 int abis_nm_reset_resource(struct gsm_bts *bts);
-int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
+int abis_nm_software_load(struct gsm_bts *bts, int trx_nr, const char *fname,
 			  u_int8_t win_size, int forced,
 			  gsm_cbfn *cbfn, void *cb_data);
 int abis_nm_software_load_status(struct gsm_bts *bts);
@@ -148,7 +148,7 @@ int abis_nm_ipaccess_msg(struct gsm_bts *bts, u_int8_t msg_type,
 			 u_int8_t *attr, int attr_len);
 int abis_nm_ipaccess_set_nvattr(struct gsm_bts_trx *trx, u_int8_t *attr,
 				int attr_len);
-int abis_nm_ipaccess_restart(struct gsm_bts *bts);
+int abis_nm_ipaccess_restart(struct gsm_bts_trx *trx);
 int abis_nm_ipaccess_set_attr(struct gsm_bts *bts, u_int8_t obj_class,
 				u_int8_t bts_nr, u_int8_t trx_nr, u_int8_t ts_nr,
 				u_int8_t *attr, u_int8_t attr_len);
@@ -164,7 +164,8 @@ enum nm_evt {
 	EVT_STATECHG_ADM,
 };
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state); 
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst);
 
 const char *nm_opstate_name(u_int8_t os);
 const char *nm_avail_name(u_int8_t avail);

openbsc/include/openbsc/abis_rsl.h

@@ -70,10 +70,14 @@ u_int64_t str_to_imsi(const char *imsi_str);
 u_int8_t lchan2chan_nr(const struct gsm_lchan *lchan);
 int rsl_release_request(struct gsm_lchan *lchan, u_int8_t link_id, u_int8_t release_reason);
 
+int rsl_lchan_set_state(struct gsm_lchan *lchan, int);
+
+int rsl_lchan_set_state(struct gsm_lchan *lchan, int);
+
 /* to be provided by external code */
 int abis_rsl_sendmsg(struct msgb *msg);
 int rsl_deact_sacch(struct gsm_lchan *lchan);
-int rsl_chan_release(struct gsm_lchan *lchan);
+int rsl_lchan_rll_release(struct gsm_lchan *lchan, u_int8_t link_id);
 
 /* BCCH related code */
 int rsl_ccch_conf_to_bs_cc_chans(int ccch_conf);

openbsc/include/openbsc/bsc_msc.h

@@ -29,18 +29,23 @@
 struct bsc_msc_connection {
 	struct write_queue write_queue;
 	int is_connected;
+	int is_authenticated;
 	const char *ip;
 	int port;
+	int prio;
 
 	void (*connection_loss) (struct bsc_msc_connection *);
 	void (*connected) (struct bsc_msc_connection *);
 	struct timer_list reconnect_timer;
+	struct timer_list timeout_timer;
 };
 
-struct bsc_msc_connection *bsc_msc_create(const char *ip, int port);
+struct bsc_msc_connection *bsc_msc_create(const char *ip, int port, int prio);
 int bsc_msc_connect(struct bsc_msc_connection *);
 void bsc_msc_schedule_connect(struct bsc_msc_connection *);
 
 void bsc_msc_lost(struct bsc_msc_connection *);
 
+struct msgb *bsc_msc_id_get_resp(const char *token);
+
 #endif

openbsc/include/openbsc/bsc_msc_rf.h

@@ -0,0 +1,20 @@
+#ifndef BSC_MSC_RF
+#define BSC_MSC_RF
+
+#include <osmocore/write_queue.h>
+
+struct gsm_network;
+
+struct bsc_msc_rf {
+	struct bsc_fd listen;
+	struct gsm_network *gsm_network;
+};
+
+struct bsc_msc_rf_conn {
+	struct write_queue queue;
+	struct gsm_network *gsm_network;
+};
+
+struct bsc_msc_rf *bsc_msc_rf_create(const char *path, struct gsm_network *net);
+
+#endif

openbsc/include/openbsc/bsc_nat.h

@@ -31,6 +31,9 @@
 #include <osmocore/msgb.h>
 #include <osmocore/timer.h>
 #include <osmocore/write_queue.h>
+#include <osmocore/statistics.h>
+
+#include <regex.h>
 
 #define DIR_BSC 1
 #define DIR_MSC 2
@@ -39,6 +42,15 @@
 
 struct bsc_nat;
 
+enum {
+	NAT_CON_TYPE_NONE,
+	NAT_CON_TYPE_LU,
+	NAT_CON_TYPE_CM_SERV_REQ,
+	NAT_CON_TYPE_PAG_RESP,
+	NAT_CON_TYPE_LOCAL_REJECT,
+	NAT_CON_TYPE_OTHER,
+};
+
 /*
  * For the NAT we will need to analyze and later patch
  * the received message. This would require us to parse
@@ -90,6 +102,10 @@ struct bsc_connection {
 	/* a timeout node */
 	struct timer_list id_timeout;
 
+	/* pong timeout */
+	struct timer_list ping_timeout;
+	struct timer_list pong_timeout;
+
 	/* a back pointer */
 	struct bsc_nat *nat;
 };
@@ -107,10 +123,33 @@ struct sccp_connections {
 	struct sccp_source_reference real_ref;
 	struct sccp_source_reference patched_ref;
 	struct sccp_source_reference remote_ref;
+	int has_remote_ref;
+
+	/* status */
+	int con_type;
+	int con_local;
 
 	/* GSM audio handling. That is 32 * multiplex + ts */
+	int crcx;
 	int msc_timeslot;
 	int bsc_timeslot;
+
+	/* timeout handling */
+	struct timespec creation_time;
+};
+
+/**
+ * Stats per BSC
+ */
+struct bsc_config_stats {
+	struct {
+		struct counter *conn;
+		struct counter *calls;
+	} sccp;
+
+	struct {
+		struct counter *reconn;
+	} net;
 };
 
 /**
@@ -123,7 +162,17 @@ struct bsc_config {
 	unsigned int lac;
 	int nr;
 
+	char *description;
+
+	/* imsi white and blacklist */
+	char *acc_lst_name;
+
+	int forbid_paging;
+
+	/* backpointer */
 	struct bsc_nat *nat;
+
+	struct bsc_config_stats stats;
 };
 
 /**
@@ -134,8 +183,43 @@ struct bsc_endpoint {
 	char *transaction_id;
 	/* the bsc we are talking to */
 	struct bsc_connection *bsc;
-	/* pending delete */
-	int pending_delete;
+};
+
+/**
+ * Statistic for the nat.
+ */
+struct bsc_nat_statistics {
+	struct {
+		struct counter *conn;
+		struct counter *calls;
+	} sccp;
+
+	struct {
+		struct counter *reconn;
+                struct counter *auth_fail;
+	} bsc;
+
+	struct {
+		struct counter *reconn;
+	} msc;
+};
+
+struct bsc_nat_acc_lst {
+	struct llist_head list;
+
+	/* the name of the list */
+	const char *name;
+	struct llist_head fltr_list;
+};
+
+struct bsc_nat_acc_lst_entry {
+	struct llist_head list;
+
+	/* the filter */
+	char *imsi_allow;
+	regex_t imsi_allow_re;
+	char *imsi_deny;
+	regex_t imsi_deny_re;
 };
 
 /**
@@ -148,9 +232,13 @@ struct bsc_nat {
 	/* active BSC connections that need patching */
 	struct llist_head bsc_connections;
 
+	/* access lists */
+	struct llist_head access_lists;
+
 	/* known BSC's */
 	struct llist_head bsc_configs;
 	int num_bsc;
+	int bsc_ip_tos;
 
 	/* MGCP config */
 	struct mgcp_config *mgcp_cfg;
@@ -158,7 +246,25 @@ struct bsc_nat {
 	u_int8_t mgcp_msg[4096];
 	int mgcp_length;
 
+	/* msc things */
+	char *msc_ip;
+	int msc_port;
+	int first_contact;
+	struct bsc_msc_connection *msc_con;
+	char *token;
+
+	/* timeouts */
+	int auth_timeout;
+	int ping_timeout;
+	int pong_timeout;
+
 	struct bsc_endpoint *bsc_endpoints;
+
+	/* filter */
+	char *acc_lst_name;
+
+	/* statistics */
+	struct bsc_nat_statistics stats;
 };
 
 /* create and init the structures */
@@ -166,8 +272,12 @@ struct bsc_config *bsc_config_alloc(struct bsc_nat *nat, const char *token, unsi
 struct bsc_config *bsc_config_num(struct bsc_nat *nat, int num);
 struct bsc_nat *bsc_nat_alloc(void);
 struct bsc_connection *bsc_connection_alloc(struct bsc_nat *nat);
+void bsc_nat_set_msc_ip(struct bsc_nat *bsc, const char *ip);
 
 void sccp_connection_destroy(struct sccp_connections *);
+void bsc_close_connection(struct bsc_connection *);
+
+const char *bsc_con_type_to_string(int type);
 
 /**
  * parse the given message into the above structure
@@ -179,29 +289,34 @@ struct bsc_nat_parsed *bsc_nat_parse(struct msgb *msg);
  */
 int bsc_nat_filter_ipa(int direction, struct msgb *msg, struct bsc_nat_parsed *parsed);
 int bsc_nat_vty_init(struct bsc_nat *nat);
-struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg);
+struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg, int *_lac);
+
+/**
+ * Content filtering.
+ */
+int bsc_nat_filter_sccp_cr(struct bsc_connection *bsc, struct msgb *msg,
+			   struct bsc_nat_parsed *, int *con_type);
 
 /**
  * SCCP patching and handling
  */
-int create_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed);
+struct sccp_connections *create_sccp_src_ref(struct bsc_connection *bsc, struct bsc_nat_parsed *parsed);
 int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *parsed);
 void remove_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed);
 struct sccp_connections *patch_sccp_src_ref_to_bsc(struct msgb *, struct bsc_nat_parsed *, struct bsc_nat *);
-struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *, struct bsc_nat_parsed *, struct bsc_nat *);
+struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *, struct bsc_nat_parsed *, struct bsc_connection *);
 
 /**
  * MGCP/Audio handling
  */
-int bsc_write_mgcp_msg(struct bsc_connection *bsc, struct msgb *msg);
 int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length);
 int bsc_mgcp_assign(struct sccp_connections *, struct msgb *msg);
-void bsc_mgcp_clear(struct sccp_connections *);
-void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int);
+void bsc_mgcp_init(struct sccp_connections *);
+void bsc_mgcp_dlcx(struct sccp_connections *);
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat);
-int bsc_mgcp_init(struct bsc_nat *nat);
+int bsc_mgcp_nat_init(struct bsc_nat *nat);
 
-struct bsc_connection *bsc_mgcp_find_con(struct bsc_nat *, int endpoint_number);
+struct sccp_connections *bsc_mgcp_find_con(struct bsc_nat *, int endpoint_number);
 struct msgb *bsc_mgcp_rewrite(char *input, int length, const char *ip, int port);
 void bsc_mgcp_forward(struct bsc_connection *bsc, struct msgb *msg);
 
@@ -209,4 +324,15 @@ void bsc_mgcp_clear_endpoints_for(struct bsc_connection *bsc);
 int bsc_mgcp_parse_response(const char *str, int *code, char transaction[60]);
 int bsc_mgcp_extract_ci(const char *resp);
 
+
+int bsc_write(struct bsc_connection *bsc, struct msgb *msg, int id);
+
+/* IMSI allow/deny handling */
+void bsc_parse_reg(void *ctx, regex_t *reg, char **imsi, int argc, const char **argv);
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_find(struct bsc_nat *nat, const char *name);
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_get(struct bsc_nat *nat, const char *name);
+void bsc_nat_acc_lst_delete(struct bsc_nat_acc_lst *lst);
+
+struct bsc_nat_acc_lst_entry *bsc_nat_acc_lst_entry_create(struct bsc_nat_acc_lst *);
+
 #endif

openbsc/include/openbsc/bssap.h

@@ -326,11 +326,8 @@ void bsc_queue_connection_write(struct sccp_connection *conn, struct msgb *msg);
 void bsc_free_queued(struct sccp_connection *conn);
 void bsc_send_queued(struct sccp_connection *conn);
 
-void bts_queue_send(struct msgb *msg, int link_id);
 void bts_send_queued(struct bss_sccp_connection_data*);
 void bts_free_queued(struct bss_sccp_connection_data*);
 void bts_unblock_queue(struct bss_sccp_connection_data*);
 
-const struct tlv_definition *gsm0808_att_tlvdef();
-
 #endif

openbsc/include/openbsc/chan_alloc.h

@@ -63,10 +63,11 @@ struct gsm_lchan *lchan_find(struct gsm_bts *bts, struct gsm_subscriber *subscr)
 struct gsm_lchan *lchan_for_subscr(struct gsm_subscriber *subscr);
 
 /* Allocate a logical channel (SDCCH, TCH, ...) */
-struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type);
+struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type, int allow_bigger);
 
 /* Free a logical channel (SDCCH, TCH, ...) */
 void lchan_free(struct gsm_lchan *lchan);
+void lchan_reset(struct gsm_lchan *lchan);
 
 /* internal.. do not use */
 int _lchan_release(struct gsm_lchan *lchan, u_int8_t release_reason);

openbsc/include/openbsc/e1_input.h

@@ -66,6 +66,8 @@ struct e1inp_ts {
 		struct {
 			/* list of all signalling links on this TS */
 			struct llist_head sign_links;
+			/* delay for the queue */
+			int delay;
 			/* timer when to dequeue next frame */
 			struct timer_list tx_timer;
 		} sign;
@@ -93,6 +95,7 @@ struct e1inp_driver {
 	struct llist_head list;
 	const char *name;
 	int (*want_write)(struct e1inp_ts *ts);
+	int default_delay;
 };	
 
 struct e1inp_line {

openbsc/include/openbsc/gsm_04_08.h

@@ -45,12 +45,15 @@ int decode_bcd_number(char *output, int output_len, const u_int8_t *bcd_lv,
 		      int h_len);
 
 int send_siemens_mrpci(struct gsm_lchan *lchan, u_int8_t *classmark2_lv);
-int gsm48_paging_extract_mi(struct msgb *msg, char *mi_string, u_int8_t *mi_type);
+int gsm48_extract_mi(uint8_t *classmark2, int length, char *mi_string, uint8_t *mi_type);
+int gsm48_paging_extract_mi(struct gsm48_pag_resp *pag, int length, char *mi_string, u_int8_t *mi_type);
 int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr);
 
 int gsm48_lchan_modify(struct gsm_lchan *lchan, u_int8_t lchan_mode);
 int gsm48_rx_rr_modif_ack(struct msgb *msg);
 int gsm48_parse_meas_rep(struct gsm_meas_rep *rep, struct msgb *msg);
 
+struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value);
+struct msgb *gsm48_create_loc_upd_rej(uint8_t cause);
 
 #endif

openbsc/include/openbsc/gsm_data.h

@@ -3,6 +3,8 @@
 
 #include <sys/types.h>
 
+struct bsc_msc_connection;
+
 enum gsm_phys_chan_config {
 	GSM_PCHAN_NONE,
 	GSM_PCHAN_CCCH,
@@ -73,17 +75,18 @@ enum gsm_paging_event {
 	GSM_PAGING_OOM,
 };
 
+enum bts_gprs_mode {
+	BTS_GPRS_NONE = 0,
+	BTS_GPRS_GPRS = 1,
+	BTS_GPRS_EGPRS = 2,
+};
+
 struct msgb;
 typedef int gsm_cbfn(unsigned int hooknum,
 		     unsigned int event,
 		     struct msgb *msg,
 		     void *data, void *param);
 
-/* communications link with a BTS */
-struct gsm_bts_link {
-	struct gsm_bts *bts;
-};
-
 struct sccp_connection;
 
 /* Real authentication information containing Ki */
@@ -126,6 +129,7 @@ struct bss_sccp_connection_data {
         struct timer_list T10;
 
 	/* for SCCP ... */
+	struct timer_list sccp_cc_timeout;
 	struct timer_list sccp_it;
 
 	/* audio handling */
@@ -198,6 +202,7 @@ enum gsm_lchan_state {
 	LCHAN_S_ACT_REQ,	/* channel activatin requested */
 	LCHAN_S_ACTIVE,		/* channel is active and operational */
 	LCHAN_S_REL_REQ,	/* channel release has been requested */
+	LCHAN_S_REL_ERR,	/* channel is in an error state */
 	LCHAN_S_INACTIVE,	/* channel is set inactive */
 };
 
@@ -213,6 +218,7 @@ struct gsm_subscriber_connection {
 
 	/* use count. how many users use this channel */
 	unsigned int use_count;
+	int hand_off;
 
 	/* Are we part of a special "silent" call */
 	int silent_call;
@@ -246,6 +252,8 @@ struct gsm_lchan {
 	} encr;
 
 	struct timer_list T3101;
+	struct timer_list T3111;
+	struct timer_list error_timer;
 
 	/* AMR bits */
 	struct gsm48_multi_rate_conf mr_conf;
@@ -278,6 +286,12 @@ struct gsm_lchan {
 	} abis_ip;
 
 	struct gsm_subscriber_connection conn;
+
+	/* release reason */
+	u_int8_t release_reason;
+
+	/* timestamp */
+	struct timeval alloc_time;
 };
 
 struct gsm_e1_subslot {
@@ -390,10 +404,13 @@ struct gsm_paging_request {
 struct gsm_bts_paging_state {
 	/* pending requests */
 	struct llist_head pending_requests;
-	struct gsm_paging_request *last_request;
 	struct gsm_bts *bts;
 
 	struct timer_list work_timer;
+	struct timer_list credit_timer;
+
+	/* free chans needed */
+	int free_chans_need;
 
 	/* load */
 	u_int16_t available_slots;
@@ -498,18 +515,24 @@ struct gsm_bts {
 
 	/* Not entirely sure how ip.access specific this is */
 	struct {
-		int enabled;
+		enum bts_gprs_mode mode;
 		struct {
 			struct gsm_nm_state nm_state;
 			u_int16_t nsei;
+			uint8_t timer[7];
 		} nse;
 		struct {
 			struct gsm_nm_state nm_state;
 			u_int16_t bvci;
+			uint8_t timer[11];
 		} cell;
 		struct gsm_bts_gprs_nsvc nsvc[2];
 		u_int8_t rac;
 	} gprs;
+
+	/* RACH NM values */
+	int rach_b_thresh;
+	int rach_ldavg_slots;
 	
 	/* transceivers */
 	int num_trx;
@@ -557,6 +580,14 @@ struct gsmnet_stats {
 		struct counter *alerted;	/* we alerted the other end */
 		struct counter *connected;/* how many calls were accepted */
 	} call;
+	struct {
+		struct counter *rf_fail;
+		struct counter *rll_err;
+	} chan;
+	struct {
+		struct counter *oml_fail;
+		struct counter *rsl_fail;
+	} bts;
 };
 
 enum gsm_auth_policy {
@@ -648,6 +679,12 @@ struct gsm_network {
 
 	/* a simple token for this network... */
 	char *bsc_token;
+	char *msc_ip;
+	int msc_port;
+	int msc_prio;
+	struct bsc_msc_connection *msc_con;
+	int ping_timeout;
+	int pong_timeout;
 };
 
 #define SMS_HDR_SIZE	128
@@ -744,15 +781,10 @@ const char *gsm_auth_policy_name(enum gsm_auth_policy policy);
 enum rrlp_mode rrlp_mode_parse(const char *arg);
 const char *rrlp_mode_name(enum rrlp_mode mode);
 
-void gsm_trx_lock_rf(struct gsm_bts_trx *trx, int locked);
+enum bts_gprs_mode bts_gprs_mode_parse(const char *arg);
+const char *bts_gprs_mode_name(enum bts_gprs_mode mode);
 
-/* A parsed GPRS routing area */
-struct gprs_ra_id {
-	u_int16_t	mnc;
-	u_int16_t	mcc;
-	u_int16_t	lac;
-	u_int8_t	rac;
-};
+void gsm_trx_lock_rf(struct gsm_bts_trx *trx, int locked);
 
 int gsm48_ra_id_by_bts(u_int8_t *buf, struct gsm_bts *bts);
 void gprs_ra_id_by_bts(struct gprs_ra_id *raid, struct gsm_bts *bts);

openbsc/include/openbsc/ipaccess.h

@@ -53,6 +53,8 @@ int ipaccess_send_id_req(int fd);
 
 int ipaccess_idtag_parse(struct tlv_parsed *dec, unsigned char *buf, int len);
 
+int ipaccess_drop_oml(struct gsm_bts *bts);
+int ipaccess_drop_rsl(struct gsm_bts_trx *trx);
 
 /*
  * Firmware specific header

openbsc/include/openbsc/mgcp.h

@@ -93,6 +93,7 @@ struct mgcp_config {
 	int audio_loop;
 	int early_bind;
 	int rtp_base_port;
+	int endp_tos;
 
 	/* only used in forward mode */
 	char *forward_ip;
@@ -104,6 +105,9 @@ struct mgcp_config {
 	unsigned int number_endpoints;
 	struct mgcp_endpoint *endpoints;
 
+	/* spec handling */
+	int force_realloc;
+
 	/* callback functionality */
 	mgcp_change change_cb;
 	mgcp_policy policy_cb;

openbsc/include/openbsc/mgcp_internal.h

@@ -57,6 +57,10 @@ struct mgcp_endpoint {
 
 	/* backpointer */
 	struct mgcp_config *cfg;
+
+	/* statistics */
+	unsigned int in_bts;
+	unsigned int in_remote;
 };
 
 #define ENDPOINT_NUMBER(endp) abs(endp - endp->cfg->endpoints)
@@ -69,5 +73,6 @@ struct mgcp_msg_ptr {
 int mgcp_analyze_header(struct mgcp_config *cfg, struct msgb *msg,
 			struct mgcp_msg_ptr *ptr, int size,
 			const char **transaction_id, struct mgcp_endpoint **endp);
+int mgcp_send_dummy(struct mgcp_endpoint *endp);
 
 #endif

openbsc/include/openbsc/paging.h

@@ -43,4 +43,7 @@ void paging_request_stop(struct gsm_bts *bts, struct gsm_subscriber *subscr,
 /* update paging load */
 void paging_update_buffer_space(struct gsm_bts *bts, u_int16_t);
 
+/* pending paging requests */
+unsigned int paging_pending_requests_nr(struct gsm_bts *bts);
+
 #endif

openbsc/include/openbsc/rest_octets.h

@@ -71,6 +71,7 @@ enum gprs_nmo {
 	GPRS_NMO_III	= 2,	/* no paging coordination */
 };
 
+/* TS 04.60 12.24 */
 struct gprs_cell_options {
 	enum gprs_nmo nmo;
 	/* T3168: wait for packet uplink assignment message */
@@ -79,6 +80,16 @@ struct gprs_cell_options {
 	u_int32_t t3192;	/* in milliseconds */
 	u_int32_t drx_timer_max;/* in seconds */
 	u_int32_t bs_cv_max;
+
+	u_int8_t ext_info_present;
+	struct {
+		u_int8_t egprs_supported;
+			u_int8_t use_egprs_p_ch_req;
+			u_int8_t bep_period;
+		u_int8_t pfc_supported;
+		u_int8_t dtm_supported;
+		u_int8_t bss_paging_coordination;
+	} ext_info;
 };
 
 /* TS 04.60 Table 12.9.2 */

openbsc/include/openbsc/signal.h

@@ -133,7 +133,7 @@ struct scall_signal_data {
 };
 
 struct ipacc_ack_signal_data {
-	struct gsm_bts *bts;
+	struct gsm_bts_trx *trx;
 	u_int8_t msg_type;	
 };
 

openbsc/include/openbsc/vty.h

@@ -1,6 +1,10 @@
 #ifndef OPENBSC_VTY_H
 #define OPENBSC_VTY_H
 
+struct gsm_network;
+struct vty;
+
 void openbsc_vty_add_cmds(void);
+void openbsc_vty_print_statistics(struct vty *vty, struct gsm_network *);
 
 #endif

openbsc/include/sccp/sccp.h

@@ -148,6 +148,11 @@ extern const struct sockaddr_sccp sccp_ssn_bssap;
 u_int32_t sccp_src_ref_to_int(struct sccp_source_reference *ref);
 struct sccp_source_reference sccp_src_ref_from_int(u_int32_t);
 
+struct msgb *sccp_create_refuse(struct sccp_source_reference *src_ref, int cause, uint8_t *data, int length);
+struct msgb *sccp_create_cc(struct sccp_source_reference *src_ref, struct sccp_source_reference *dst_ref);
+struct msgb *sccp_create_rlsd(struct sccp_source_reference *src_ref, struct sccp_source_reference *dst_ref, int cause);
+struct msgb *sccp_create_dt1(struct sccp_source_reference *dst_ref, uint8_t *data, uint8_t len);
+
 /**
  * Below this are helper functions and structs for parsing SCCP messages
  */

openbsc/include/sccp/sccp_types.h

@@ -411,4 +411,10 @@ struct sccp_data_it {
 	u_int8_t			credit;
 } __attribute__((packed));
 
+struct sccp_proto_err {
+	u_int8_t			type;
+	struct sccp_source_reference	destination_local_reference;
+	u_int8_t			error_cause;
+};
+
 #endif

openbsc/include/vty/buffer.h

@@ -28,7 +28,7 @@
 /* Create a new buffer.  Memory will be allocated in chunks of the given
    size.  If the argument is 0, the library will supply a reasonable
    default size suitable for buffering socket I/O. */
-struct buffer *buffer_new(size_t);
+struct buffer *buffer_new(void *ctx, size_t);
 
 /* Free all data in the buffer. */
 void buffer_reset(struct buffer *);

openbsc/src/Makefile.am

@@ -35,7 +35,7 @@ bsc_hack_LDADD = libmsc.a libbsc.a libmsc.a libvty.a -ldl -ldbi $(LIBCRYPT)
 bs11_config_SOURCES = bs11_config.c abis_nm.c gsm_data.c debug.c \
 		      rs232.c bts_siemens_bs11.c
 bsc_msc_ip_SOURCES = bssap.c bsc_msc_ip.c bsc_init.c vty_interface.c vty_interface_bsc.c \
-		bsc_msc.c
+		bsc_msc.c bsc_msc_rf.c
 bsc_msc_ip_LDADD = libbsc.a libvty.a libsccp.a
 
 
@@ -56,4 +56,4 @@ bsc_nat_SOURCES = nat/bsc_nat.c nat/bsc_filter.c nat/bsc_sccp.c \
 		  nat/bsc_nat_utils.c nat/bsc_nat_vty.c nat/bsc_mgcp_utils.c \
 		  mgcp/mgcp_protocol.c mgcp/mgcp_network.c mgcp/mgcp_vty.c \
 		  bsc_msc.c bssap.c
-bsc_nat_LDADD = libvty.a libbsc.a libsccp.a
+bsc_nat_LDADD = libvty.a libbsc.a libsccp.a -lrt

openbsc/src/abis_nm.c

@@ -678,7 +678,7 @@ static int update_admstate(struct gsm_bts *bts, u_int8_t obj_class,
 	new_state = *nm_state;
 	new_state.administrative = adm_state;
 
-	rc = nm_state_event(EVT_STATECHG_ADM, obj_class, obj, nm_state, &new_state);
+	rc = nm_state_event(EVT_STATECHG_ADM, obj_class, obj, nm_state, &new_state, obj_inst);
 
 	nm_state->administrative = adm_state;
 
@@ -732,7 +732,7 @@ static int abis_nm_rx_statechg_rep(struct msgb *mb)
 		/* Update the operational state of a given object in our in-memory data
  		* structures and send an event to the higher layer */
 		void *obj = objclass2obj(bts, foh->obj_class, &foh->obj_inst);
-		rc = nm_state_event(EVT_STATECHG_OPER, foh->obj_class, obj, nm_state, &new_state);
+		rc = nm_state_event(EVT_STATECHG_OPER, foh->obj_class, obj, nm_state, &new_state, &foh->obj_inst);
 		nm_state->operational = new_state.operational;
 		nm_state->availability = new_state.availability;
 		if (nm_state->administrative == 0)
@@ -822,15 +822,56 @@ static int ipacc_sw_activate(struct gsm_bts *bts, u_int8_t obj_class, u_int8_t i
 	return abis_nm_sendmsg(bts, msg);
 }
 
+static int abis_nm_parse_sw_descr(const u_int8_t *sw_descr, int sw_descr_len)
+{
+	static const struct tlv_definition sw_descr_def = {
+		.def = {
+			[NM_ATT_FILE_ID] =		{ TLV_TYPE_TL16V, },
+			[NM_ATT_FILE_VERSION] =		{ TLV_TYPE_TL16V, },
+		},
+	};
+
+	u_int8_t tag;
+	u_int16_t tag_len;
+	const u_int8_t *val;
+	int ofs = 0, len;
+
+	/* Classic TLV parsing doesn't work well with SW_DESCR because of it's
+	 * nested nature and the fact you have to assume it contains only two sub
+	 * tags NM_ATT_FILE_VERSION & NM_ATT_FILE_ID to parse it */
+
+	if (sw_descr[0] != NM_ATT_SW_DESCR) {
+		DEBUGP(DNM, "SW_DESCR attribute identifier not found!\n");
+		return -1;
+	}
+	ofs += 1;
+
+	len = tlv_parse_one(&tag, &tag_len, &val,
+		&sw_descr_def, &sw_descr[ofs], sw_descr_len-ofs);
+	if (len < 0 || (tag != NM_ATT_FILE_ID)) {
+		DEBUGP(DNM, "FILE_ID attribute identifier not found!\n");
+		return -2;
+	}
+	ofs += len;
+
+	len = tlv_parse_one(&tag, &tag_len, &val,
+		&sw_descr_def, &sw_descr[ofs], sw_descr_len-ofs);
+	if (len < 0 || (tag != NM_ATT_FILE_VERSION)) {
+		DEBUGP(DNM, "FILE_VERSION attribute identifier not found!\n");
+		return -3;
+	}
+	ofs += len;
+
+	return ofs;
+}
+
 static int abis_nm_rx_sw_act_req(struct msgb *mb)
 {
 	struct abis_om_hdr *oh = msgb_l2(mb);
 	struct abis_om_fom_hdr *foh = msgb_l3(mb);
 	struct tlv_parsed tp;
 	const u_int8_t *sw_config;
-	int sw_config_len;
-	int file_id_len;
-	int ret;
+	int ret, sw_config_len, sw_descr_len;
 
 	debugp_foh(foh);
 
@@ -854,20 +895,16 @@ static int abis_nm_rx_sw_act_req(struct msgb *mb)
 		DEBUGP(DNM, "Found SW config: %s\n", hexdump(sw_config, sw_config_len));
 	}
 
-	if (sw_config[0] != NM_ATT_SW_DESCR)
-		DEBUGP(DNM, "SW_DESCR attribute identifier not found!\n");
-	if (sw_config[1] != NM_ATT_FILE_ID)
-		DEBUGP(DNM, "FILE_ID attribute identifier not found!\n");
-	file_id_len = sw_config[2] * 256 + sw_config[3];
+		/* Use the first SW_DESCR present in SW config */
+	sw_descr_len = abis_nm_parse_sw_descr(sw_config, sw_config_len);
+	if (sw_descr_len < 0)
+		return -EINVAL;
 
-	/* Assumes first SW file in list is the one to be activated */
-	/* sw_config + 4 to skip over 2 attribute ID bytes and 16-bit length field */
 	return ipacc_sw_activate(mb->trx->bts, foh->obj_class,
 				 foh->obj_inst.bts_nr,
 				 foh->obj_inst.trx_nr,
 				 foh->obj_inst.ts_nr,
-				 sw_config + 4,
-				 file_id_len);
+				 sw_config, sw_descr_len);
 }
 
 /* Receive a CHANGE_ADM_STATE_ACK, parse the TLV and update local state */
@@ -1102,6 +1139,7 @@ enum sw_state {
 
 struct abis_nm_sw {
 	struct gsm_bts *bts;
+	int trx_nr;
 	gsm_cbfn *cbfn;
 	void *cb_data;
 	int forced;
@@ -1555,7 +1593,7 @@ static int abis_nm_rcvmsg_sw(struct msgb *mb)
 }
 
 /* Load the specified software into the BTS */
-int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
+int abis_nm_software_load(struct gsm_bts *bts, int trx_nr, const char *fname,
 			  u_int8_t win_size, int forced,
 			  gsm_cbfn *cbfn, void *cb_data)
 {
@@ -1569,6 +1607,7 @@ int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
 		return -EBUSY;
 
 	sw->bts = bts;
+	sw->trx_nr = trx_nr;
 
 	switch (bts->type) {
 	case GSM_BTS_TYPE_BS11:
@@ -1579,8 +1618,8 @@ int abis_nm_software_load(struct gsm_bts *bts, const char *fname,
 		break;
 	case GSM_BTS_TYPE_NANOBTS:
 		sw->obj_class = NM_OC_BASEB_TRANSC;
-		sw->obj_instance[0] = 0x00;
-		sw->obj_instance[1] = 0x00;
+		sw->obj_instance[0] = sw->bts->nr;
+		sw->obj_instance[1] = sw->trx_nr;
 		sw->obj_instance[2] = 0xff;
 		break;
 	case GSM_BTS_TYPE_UNKNOWN:
@@ -2514,7 +2553,7 @@ static int bs11_swload_cbfn(unsigned int hook, unsigned int event,
 		fle = fl_dequeue(&bs11_sw->file_list);
 		if (fle) {
 			/* start download the next file of our file list */
-			rc = abis_nm_software_load(bs11_sw->bts, fle->fname,
+			rc = abis_nm_software_load(bs11_sw->bts, 0xff, fle->fname,
 						   bs11_sw->win_size,
 						   bs11_sw->forced,
 						   &bs11_swload_cbfn, bs11_sw);
@@ -2570,7 +2609,7 @@ int abis_nm_bs11_load_swl(struct gsm_bts *bts, const char *fname,
 		return -EINVAL;
 
 	/* start download the next file of our file list */
-	rc = abis_nm_software_load(bts, fle->fname, win_size, forced,
+	rc = abis_nm_software_load(bts, 0xff, fle->fname, win_size, forced,
 				   bs11_swload_cbfn, bs11_sw);
 	talloc_free(fle);
 	return rc;
@@ -2738,12 +2777,12 @@ static int abis_nm_rx_ipacc(struct msgb *msg)
 	case NM_MT_IPACC_RSL_CONNECT_NACK:
 	case NM_MT_IPACC_SET_NVATTR_NACK:
 	case NM_MT_IPACC_GET_NVATTR_NACK:
-		signal.bts = msg->trx->bts;
+		signal.trx = gsm_bts_trx_by_nr(msg->trx->bts, foh->obj_inst.trx_nr);
 		signal.msg_type = foh->msg_type;
 		dispatch_signal(SS_NM, S_NM_IPACC_NACK, &signal);
 		break;
 	case NM_MT_IPACC_SET_NVATTR_ACK:
-		signal.bts = msg->trx->bts;
+		signal.trx = gsm_bts_trx_by_nr(msg->trx->bts, foh->obj_inst.trx_nr);
 		signal.msg_type = foh->msg_type;
 		dispatch_signal(SS_NM, S_NM_IPACC_ACK, &signal);
 		break;
@@ -2829,9 +2868,16 @@ int abis_nm_ipaccess_rsl_connect(struct gsm_bts_trx *trx,
 }
 
 /* restart / reboot an ip.access nanoBTS */
-int abis_nm_ipaccess_restart(struct gsm_bts *bts)
+int abis_nm_ipaccess_restart(struct gsm_bts_trx *trx)
 {
-	return __simple_cmd(bts, NM_MT_IPACC_RESTART);
+	struct abis_om_hdr *oh;
+	struct msgb *msg = nm_msgb_alloc();
+
+	oh = (struct abis_om_hdr *) msgb_put(msg, ABIS_OM_FOM_HDR_SIZE);
+	fill_om_fom_hdr(oh, 0, NM_MT_IPACC_RESTART, NM_OC_BASEB_TRANSC,
+			trx->bts->nr, trx->nr, 0xff);
+
+	return abis_nm_sendmsg(trx->bts, msg);
 }
 
 int abis_nm_ipaccess_set_attr(struct gsm_bts *bts, u_int8_t obj_class,

openbsc/src/abis_rsl.c

@@ -568,12 +568,33 @@ int rsl_deact_sacch(struct gsm_lchan *lchan)
 	return abis_rsl_sendmsg(msg);
 }
 
+static void error_timeout_cb(void *data)
+{
+	struct gsm_lchan *lchan = data;
+	if (lchan->state != LCHAN_S_REL_ERR) {
+		LOGP(DRSL, LOGL_ERROR, "%s error timeout but not in error state: %d\n",
+		     gsm_lchan_name(lchan), lchan->state);
+		return;
+	}
+
+	/* go back to the none state */
+	LOGP(DRSL, LOGL_NOTICE, "%s is back in operation.\n", gsm_lchan_name(lchan));
+	rsl_lchan_set_state(lchan, LCHAN_S_NONE);
+}
+
 /* Chapter 8.4.14 / 4.7: Tell BTS to release the radio channel */
-int rsl_rf_chan_release(struct gsm_lchan *lchan)
+static int rsl_rf_chan_release(struct gsm_lchan *lchan, int error)
 {
 	struct abis_rsl_dchan_hdr *dh;
-	struct msgb *msg = rsl_msgb_alloc();
+	struct msgb *msg;
 
+	if (lchan->state == LCHAN_S_REL_ERR) {
+		LOGP(DRSL, LOGL_NOTICE, "%s is in error state not sending release.\n",
+		     gsm_lchan_name(lchan));
+		return -1;
+	}
+
+	msg = rsl_msgb_alloc();
 	dh = (struct abis_rsl_dchan_hdr *) msgb_put(msg, sizeof(*dh));
 	init_dchan_hdr(dh, RSL_MT_RF_CHAN_REL);
 	dh->chan_nr = lchan2chan_nr(lchan);
@@ -581,7 +602,20 @@ int rsl_rf_chan_release(struct gsm_lchan *lchan)
 	msg->lchan = lchan;
 	msg->trx = lchan->ts->trx;
 
-	DEBUGP(DRSL, "%s RF Channel Release CMD\n", gsm_lchan_name(lchan));
+	DEBUGP(DRSL, "%s RF Channel Release CMD due error %d\n", gsm_lchan_name(lchan), error);
+
+	if (error) {
+		/*
+		 * the nanoBTS sends RLL release indications after the channel release. This can
+		 * be a problem when we have reassigned the channel to someone else and then can
+		 * not figure out who used this channel.
+		 */
+		rsl_lchan_set_state(lchan, LCHAN_S_REL_ERR);
+		lchan->error_timer.data = lchan;
+		lchan->error_timer.cb = error_timeout_cb;
+		bsc_schedule_timer(&lchan->error_timer,
+				   msg->trx->bts->network->T3111 + 2, 0);
+	}
 
 	/* BTS will respond by RF CHAN REL ACK */
 	return abis_rsl_sendmsg(msg);
@@ -728,7 +762,6 @@ int rsl_release_request(struct gsm_lchan *lchan, u_int8_t link_id, u_int8_t reas
         /* 0 is normal release, 1 is local end */
 	msgb_tv_put(msg, RSL_IE_RELEASE_MODE, reason);
 
-	lchan->state = LCHAN_S_REL_REQ;
 	/* FIXME: start some timer in case we don't receive a REL ACK ? */
 
 	msg->trx = lchan->ts->trx;
@@ -736,6 +769,12 @@ int rsl_release_request(struct gsm_lchan *lchan, u_int8_t link_id, u_int8_t reas
 	return abis_rsl_sendmsg(msg);
 }
 
+int rsl_lchan_set_state(struct gsm_lchan *lchan, int state)
+{
+	lchan->state = state;
+	return 0;
+}
+
 /* Chapter 8.4.2: Channel Activate Acknowledge */
 static int rsl_rx_chan_act_ack(struct msgb *msg)
 {
@@ -750,7 +789,7 @@ static int rsl_rx_chan_act_ack(struct msgb *msg)
 		LOGP(DRSL, LOGL_NOTICE, "%s CHAN ACT ACK, but state %s\n",
 			gsm_lchan_name(msg->lchan),
 			gsm_lchans_name(msg->lchan->state));
-	msg->lchan->state = LCHAN_S_ACTIVE;
+	rsl_lchan_set_state(msg->lchan, LCHAN_S_ACTIVE);
 
 	dispatch_signal(SS_LCHAN, S_LCHAN_ACTIVATE_ACK, msg->lchan);
 
@@ -776,9 +815,9 @@ static int rsl_rx_chan_act_nack(struct msgb *msg)
 		print_rsl_cause(LOGL_ERROR, cause,
 				TLVP_LEN(&tp, RSL_IE_CAUSE));
 		if (*cause != RSL_ERR_RCH_ALR_ACTV_ALLOC)
-			msg->lchan->state = LCHAN_S_NONE;
+			rsl_lchan_set_state(msg->lchan, LCHAN_S_NONE);
 	} else
-		msg->lchan->state = LCHAN_S_NONE;
+		rsl_lchan_set_state(msg->lchan, LCHAN_S_NONE);
 
 	LOGPC(DRSL, LOGL_ERROR, "\n");
 
@@ -806,7 +845,8 @@ static int rsl_rx_conn_fail(struct msgb *msg)
 
 	LOGPC(DRSL, LOGL_NOTICE, "\n");
 	/* FIXME: only free it after channel release ACK */
-	return rsl_rf_chan_release(msg->lchan);
+	counter_inc(msg->lchan->ts->trx->bts->network->stats.chan.rf_fail);
+	return rsl_rf_chan_release(msg->lchan, 1);
 }
 
 static void print_meas_rep_uni(struct gsm_meas_rep_unidir *mru,
@@ -871,7 +911,7 @@ static int rsl_rx_meas_res(struct msgb *msg)
 	/* check if this channel is actually active */
 	/* FIXME: maybe this check should be way more generic/centralized */
 	if (msg->lchan->state != LCHAN_S_ACTIVE) {
-		LOGP(DRSL, LOGL_NOTICE, "%s: MEAS RES for inactive channel\n",
+		LOGP(DRSL, LOGL_DEBUG, "%s: MEAS RES for inactive channel\n",
 			gsm_lchan_name(msg->lchan));
 		return 0;
 	}
@@ -978,11 +1018,14 @@ static int abis_rsl_rx_dchan(struct msgb *msg)
 		break;
 	case RSL_MT_RF_CHAN_REL_ACK:
 		DEBUGP(DRSL, "%s RF CHANNEL RELEASE ACK\n", ts_name);
-		if (msg->lchan->state != LCHAN_S_REL_REQ)
+		if (msg->lchan->state != LCHAN_S_REL_REQ && msg->lchan->state != LCHAN_S_REL_ERR)
 			LOGP(DRSL, LOGL_NOTICE, "%s CHAN REL ACK but state %s\n",
 				gsm_lchan_name(msg->lchan),
 				gsm_lchans_name(msg->lchan->state));
-		msg->lchan->state = LCHAN_S_NONE;
+		bsc_del_timer(&msg->lchan->T3111);
+		/* we have an error timer pending to release that */
+		if (msg->lchan->state != LCHAN_S_REL_ERR)
+			rsl_lchan_set_state(msg->lchan, LCHAN_S_NONE);
 		lchan_free(msg->lchan);
 		break;
 	case RSL_MT_MODE_MODIFY_ACK:
@@ -1074,7 +1117,15 @@ static void t3101_expired(void *data)
 {
 	struct gsm_lchan *lchan = data;
 
-	rsl_rf_chan_release(lchan);
+	rsl_rf_chan_release(lchan, 1);
+}
+
+/* If T3111 expires, we will send the RF Channel Request */
+static void t3111_expired(void *data)
+{
+	struct gsm_lchan *lchan = data;
+
+	rsl_rf_chan_release(lchan, 0);
 }
 
 /* MS has requested a channel on the RACH */
@@ -1089,6 +1140,7 @@ static int rsl_rx_chan_rqd(struct msgb *msg)
 	struct gsm_lchan *lchan;
 	u_int8_t rqd_ta;
 	int ret;
+	int is_lu;
 
 	u_int16_t arfcn;
 	u_int8_t ts_number, subch;
@@ -1111,8 +1163,14 @@ static int rsl_rx_chan_rqd(struct msgb *msg)
 
 	counter_inc(bts->network->stats.chreq.total);
 
+	/*
+	 * We want LOCATION UPDATES to succeed and will assign a TCH
+	 * if we have no SDCCH available.
+	 */
+	is_lu = !!(chreq_reason == GSM_CHREQ_REASON_LOCATION_UPD);
+
 	/* check availability / allocate channel */
-	lchan = lchan_alloc(bts, lctype);
+	lchan = lchan_alloc(bts, lctype, is_lu);
 	if (!lchan) {
 		LOGP(DRSL, LOGL_NOTICE, "BTS %d CHAN RQD: no resources for %s 0x%x\n",
 		     msg->lchan->ts->trx->bts->nr, gsm_lchant_name(lctype), rqd_ref->ra);
@@ -1125,7 +1183,7 @@ static int rsl_rx_chan_rqd(struct msgb *msg)
 		LOGP(DRSL, LOGL_NOTICE, "%s lchan_alloc() returned channel "
 		     "in state %s\n", gsm_lchan_name(lchan),
 		     gsm_lchans_name(lchan->state));
-	lchan->state = LCHAN_S_ACT_REQ;
+	rsl_lchan_set_state(lchan, LCHAN_S_ACT_REQ);
 
 	ts_number = lchan->ts->nr;
 	arfcn = lchan->ts->trx->arfcn;
@@ -1182,6 +1240,10 @@ static int rsl_rx_ccch_load(struct msgb *msg)
 	switch (rslh->data[0]) {
 	case RSL_IE_PAGING_LOAD:
 		pg_buf_space = rslh->data[1] << 8 | rslh->data[2];
+		if (is_ipaccess_bts(msg->trx->bts) && pg_buf_space == 0xffff) {
+			/* paging load below configured threshold, use 50 as default */
+			pg_buf_space = 50;
+		}
 		paging_update_buffer_space(msg->trx->bts, pg_buf_space);
 		break;
 	case RSL_IE_RACH_LOAD:
@@ -1241,12 +1303,40 @@ static int rsl_rx_rll_err_ind(struct msgb *msg)
 
 	rll_indication(msg->lchan, rllh->link_id, BSC_RLLR_IND_ERR_IND);
 
-	if (rlm_cause[1] == RLL_CAUSE_T200_EXPIRED)
-		return rsl_rf_chan_release(msg->lchan);
+	if (rlm_cause[1] == RLL_CAUSE_T200_EXPIRED) {
+		counter_inc(msg->lchan->ts->trx->bts->network->stats.chan.rll_err);
+		return rsl_rf_chan_release(msg->lchan, 1);
+	}
 
 	return 0;
 }
 
+static void rsl_handle_release(struct gsm_lchan *lchan)
+{
+	int sapi;
+	struct gsm_bts *bts;
+
+	/* maybe we have only brought down one RLL */
+	if (lchan->state != LCHAN_S_REL_REQ)
+		return;
+
+	for (sapi = 0; sapi < ARRAY_SIZE(lchan->sapis); ++sapi) {
+		if (lchan->sapis[sapi] == LCHAN_SAPI_UNUSED)
+			continue;
+		LOGP(DRSL, LOGL_NOTICE, "%s waiting for SAPI=%d to be released.\n",
+		     gsm_lchan_name(lchan), sapi);
+		return;
+	}
+			
+
+
+	/* wait a bit to send the RF Channel Release */
+	lchan->T3111.cb = t3111_expired;
+	lchan->T3111.data = lchan;
+	bts = lchan->ts->trx->bts;
+	bsc_schedule_timer(&lchan->T3111, bts->network->T3111, 0);
+}
+
 /*	ESTABLISH INDICATION, LOCATION AREA UPDATE REQUEST
 	0x02, 0x06,
 	0x01, 0x20,
@@ -1298,20 +1388,16 @@ static int abis_rsl_rx_rll(struct msgb *msg)
 		msg->lchan->sapis[rllh->link_id & 0x7] = LCHAN_SAPI_UNUSED;
 		rll_indication(msg->lchan, rllh->link_id,
 				  BSC_RLLR_IND_REL_IND);
-		/* we can now releae the channel on the BTS/Abis side */
-		/* FIXME: officially we need to start T3111 and wait for
-		 * some grace period */
-		rsl_rf_chan_release(msg->lchan);
+		rsl_handle_release(msg->lchan);
+		rsl_lchan_rll_release(msg->lchan, rllh->link_id);
 		break;
 	case RSL_MT_REL_CONF:
 		/* BTS informs us of having received UA from MS,
 		 * in response to DISC that we've sent earlier */
 		DEBUGPC(DRLL, "RELEASE CONFIRMATION\n");
 		msg->lchan->sapis[rllh->link_id & 0x7] = LCHAN_SAPI_UNUSED;
-		/* we can now releae the channel on the BTS/Abis side */
-		/* FIXME: officially we need to start T3111 and wait for
-		 * some grace period */
-		rsl_rf_chan_release(msg->lchan);
+		rsl_handle_release(msg->lchan);
+		rsl_lchan_rll_release(msg->lchan, rllh->link_id);
 		break;
 	case RSL_MT_ERROR_IND:
 		rc = rsl_rx_rll_err_ind(msg);

openbsc/src/bs11_config.c

@@ -481,7 +481,7 @@ static int handle_state_resp(enum abis_bs11_phase state)
 		 * argument, so our swload_cbfn can distinguish
 		 * a safety load from a regular software */
 		if (file_is_readable(fname_safety))
-			rc = abis_nm_software_load(g_bts, fname_safety,
+			rc = abis_nm_software_load(g_bts, 0xff, fname_safety,
 						   win_size, param_forced,
 						   swload_cbfn, g_bts);
 		else
@@ -697,7 +697,8 @@ int handle_serial_msg(struct msgb *rx_msg)
 }
 
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_ins)
 {
 	return 0;
 }

openbsc/src/bsc-nat.cfg

@@ -7,6 +7,7 @@ line vty
  no login
 !
 nat
+ msc ip 10.0.0.23
  bsc 0
    token zecke
    location_area_code 3
@@ -15,7 +16,7 @@ nat
    location_area_code 4
 mgcp
   local ip 10.0.0.23
-  bts ip 0.0.0.0
+!  bts ip 0.0.0.0
   bind ip 127.0.0.1
   bind port 2427
   bind early 1

openbsc/src/bsc_init.c

@@ -31,6 +31,7 @@
 #include <openbsc/system_information.h>
 #include <openbsc/paging.h>
 #include <openbsc/signal.h>
+#include <openbsc/chan_alloc.h>
 #include <osmocore/talloc.h>
 
 /* global pointer to the gsm network data structure */
@@ -316,14 +317,14 @@ static unsigned char bs11_attr_radio[] =
 static unsigned char nanobts_attr_bts[] = {
 	NM_ATT_INTERF_BOUND, 0x55, 0x5b, 0x61, 0x67, 0x6d, 0x73,
 	/* interference avg. period in numbers of SACCH multifr */
-	NM_ATT_INTAVE_PARAM, 0x06,
+	NM_ATT_INTAVE_PARAM, 0x1f,
 	/* conn fail based on SACCH error rate */
-	NM_ATT_CONN_FAIL_CRIT, 0x00, 0x02, 0x01, 0x10,
-	NM_ATT_T200, 0x1e, 0x24, 0x24, 0xa8, 0x34, 0x21, 0xa8,
-	NM_ATT_MAX_TA, 0x3f,
-	NM_ATT_OVERL_PERIOD, 0x00, 0x01, 10, /* seconds */
-	NM_ATT_CCCH_L_T, 10, /* percent */
-	NM_ATT_CCCH_L_I_P, 1, /* seconds */
+	NM_ATT_CONN_FAIL_CRIT, 0x00, 0x02, 0x01, 0x20,
+	NM_ATT_T200, 0x1e, 0x1e, 0x24, 0xa8, 0x34, 0x21, 0xa8,
+	NM_ATT_MAX_TA, 0x00,
+	NM_ATT_OVERL_PERIOD, 0x00, 0x01, 5, /* seconds */
+	NM_ATT_CCCH_L_T, 32, /* percent */
+	NM_ATT_CCCH_L_I_P, 5, /* seconds */
 	NM_ATT_RACH_B_THRESH, 10, /* busy threshold in - dBm */
 	NM_ATT_LDAVG_SLOTS, 0x03, 0xe8, /* rach load averaging 1000 slots */
 	NM_ATT_BTS_AIR_TIMER, 128, /* miliseconds */
@@ -344,7 +345,7 @@ static unsigned char nanobts_attr_nse[] = {
 				    3,  /* (un)blocking retries */
 				    3,  /* reset timer (Tns-reset) */
 				    3,  /* reset retries */
-				    30,  /* test timer (Tns-test) */
+				    3,  /* test timer (Tns-test) */
 				    3,  /* alive timer (Tns-alive) */
 				    10, /* alive retrires */
 	NM_ATT_IPACC_BSSGP_CFG, 0, 11,
@@ -365,29 +366,27 @@ static unsigned char nanobts_attr_cell[] = {
 	NM_ATT_IPACC_RAC, 0, 1,  1, /* routing area code */
 	NM_ATT_IPACC_GPRS_PAGING_CFG, 0, 2,
 		5,	/* repeat time (50ms) */
-		3,	/* repeat count */
+		1,	/* repeat count */
 	NM_ATT_IPACC_BVCI, 0, 2,  0x03, 0x9d, /* BVCI 925 */
 	NM_ATT_IPACC_RLC_CFG, 0, 9,
-		20, 	/* T3142 */
-		5, 	/* T3169 */
-		5,	/* T3191 */
-		200,	/* T3193 */
-		5,	/* T3195 */
-		10,	/* N3101 */
-		4,	/* N3103 */
-		8,	/* N3105 */
-		15,	/* RLC CV countdown */
-	NM_ATT_IPACC_CODING_SCHEMES, 0, 2,  0x0f, 0x00,
+		0x14, 	/* T3142 */
+		0x05, 	/* T3169 */
+		0x05,	/* T3191 */
+		0x14,	/* T3193 */
+		0x05,	/* T3195 */
+		0x0a,	/* N3101 */
+		0x04,	/* N3103 */
+		0x08,	/* N3105 */
+		0x0f,	/* RLC CV countdown */
+	NM_ATT_IPACC_CODING_SCHEMES, 0, 2,  0x8f, 0xff,	/* CS1..CS4 */
 	NM_ATT_IPACC_RLC_CFG_2, 0, 5,
-		0x00, 250,
-		0x00, 250,
-		2,	/* MCS2 */
-#if 0
+		0x00, 0x96,	/* T downlink TBF extension (0..500) */
+		0x00, 0x32,	/* T uplink TBF extension (0..500) */
+		2,	/* CS2 */
 	/* EDGE model only, breaks older models.
 	 * Should inquire the BTS capabilities */
 	NM_ATT_IPACC_RLC_CFG_3, 0, 1,
 		2,	/* MCS2 */
-#endif
 };
 
 static unsigned char nanobts_attr_nsvc0[] = {
@@ -400,7 +399,8 @@ static unsigned char nanobts_attr_nsvc0[] = {
 
 /* Callback function to be called whenever we get a GSM 12.21 state change event */
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst)
 {
 	struct gsm_bts *bts;
 	struct gsm_bts_trx *trx;
@@ -417,16 +417,15 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	switch (obj_class) {
 	case NM_OC_SITE_MANAGER:
 		bts = container_of(obj, struct gsm_bts, site_mgr);
-		if ((new_state->operational == 2 &&
+		if ((new_state->operational == NM_OPSTATE_ENABLED &&
 		     new_state->availability == NM_AVSTATE_OK) ||
-		    (new_state->operational == 1 &&
+		    (new_state->operational == NM_OPSTATE_DISABLED &&
 		     new_state->availability == NM_AVSTATE_OFF_LINE))
 			abis_nm_opstart(bts, obj_class, 0xff, 0xff, 0xff);
 		break;
 	case NM_OC_BTS:
 		bts = obj;
 		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
-			printf("STARTING BTS...\n");
 			patch_nm_tables(bts);
 			abis_nm_set_bts_attr(bts, nanobts_attr_bts,
 					     sizeof(nanobts_attr_bts));
@@ -440,9 +439,8 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	case NM_OC_CHANNEL:
 		ts = obj;
 		trx = ts->trx;
-		if (new_state->operational == 1 &&
+		if (new_state->operational == NM_OPSTATE_DISABLED &&
 		    new_state->availability == NM_AVSTATE_DEPENDENCY) {
-			printf("STARTING OC Channel...\n");
 			patch_nm_tables(trx->bts);
 			enum abis_nm_chan_comb ccomb =
 						abis_nm_chcomb4pchan(ts->pchan);
@@ -456,16 +454,16 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		break;
 	case NM_OC_RADIO_CARRIER:
 		trx = obj;
-		if (new_state->operational == 1 &&
+		if (new_state->operational == NM_OPSTATE_DISABLED &&
 		    new_state->availability == NM_AVSTATE_OK)
 			abis_nm_opstart(trx->bts, obj_class, trx->bts->bts_nr,
 					trx->nr, 0xff);
 		break;
 	case NM_OC_GPRS_NSE:
 		bts = container_of(obj, struct gsm_bts, gprs.nse);
-		if (!bts->gprs.enabled)
+		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-		if (new_state->availability == 5) {
+		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
 			abis_nm_ipaccess_set_attr(bts, obj_class, bts->bts_nr,
 						  0xff, 0xff, nanobts_attr_nse,
 						  sizeof(nanobts_attr_nse));
@@ -477,9 +475,9 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 		break;
 	case NM_OC_GPRS_CELL:
 		bts = container_of(obj, struct gsm_bts, gprs.cell);
-		if (!bts->gprs.enabled)
+		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-		if (new_state->availability == 5) {
+		if (new_state->availability == NM_AVSTATE_DEPENDENCY) {
 			abis_nm_ipaccess_set_attr(bts, obj_class, bts->bts_nr,
 						  0, 0xff, nanobts_attr_cell,
 						  sizeof(nanobts_attr_cell));
@@ -492,9 +490,9 @@ int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
 	case NM_OC_GPRS_NSVC:
 		nsvc = obj;
 		bts = nsvc->bts;
-		if (!bts->gprs.enabled)
+		if (bts->gprs.mode == BTS_GPRS_NONE)
 			break;
-	        /* We skip NSVC1 since we only use NSVC0 */
+		/* We skip NSVC1 since we only use NSVC0 */
 		if (nsvc->id == 1)
 			break;
 		if (new_state->availability == NM_AVSTATE_OFF_LINE) {
@@ -800,7 +798,7 @@ static int set_system_infos(struct gsm_bts_trx *trx)
 			DEBUGP(DRR, "SI%2u: %s\n", i, hexdump(si_tmp, rc));
 			rsl_bcch_info(trx, i, si_tmp, sizeof(si_tmp));
 		}
-		if (bts->gprs.enabled) {
+		if (bts->gprs.mode != BTS_GPRS_NONE) {
 			i = 13;
 			rc = gsm_generate_si(si_tmp, trx->bts, RSL_SYSTEM_INFO_13);
 			if (rc < 0)
@@ -854,6 +852,22 @@ static void patch_nm_tables(struct gsm_bts *bts)
 	bs11_attr_radio[2] |= arfcn_high;
 	bs11_attr_radio[3] = arfcn_low;
 
+	/* patch the RACH attributes */
+	if (bts->rach_b_thresh != -1) {
+		nanobts_attr_bts[33] = bts->rach_b_thresh & 0xff;
+		bs11_attr_bts[33] = bts->rach_b_thresh & 0xff;
+	}
+
+	if (bts->rach_ldavg_slots != -1) {
+		u_int8_t avg_high = bts->rach_ldavg_slots & 0xff;
+		u_int8_t avg_low = (bts->rach_ldavg_slots >> 8) & 0x0f;
+
+		nanobts_attr_bts[35] = avg_high;
+		nanobts_attr_bts[36] = avg_low;
+		bs11_attr_bts[35] = avg_high;
+		bs11_attr_bts[36] = avg_low;
+	}
+
 	/* patch BSIC */
 	bs11_attr_bts[1] = bts->bsic;
 	nanobts_attr_bts[sizeof(nanobts_attr_bts)-11] = bts->bsic;
@@ -868,6 +882,10 @@ static void patch_nm_tables(struct gsm_bts *bts)
 	/* patch NSEI */
 	nanobts_attr_nse[3] = bts->gprs.nse.nsei >> 8;
 	nanobts_attr_nse[4] = bts->gprs.nse.nsei & 0xff;
+	memcpy(nanobts_attr_nse+8, bts->gprs.nse.timer,
+		ARRAY_SIZE(bts->gprs.nse.timer));
+	memcpy(nanobts_attr_nse+18, bts->gprs.cell.timer,
+		ARRAY_SIZE(bts->gprs.cell.timer));
 
 	/* patch NSVCI */
 	nanobts_attr_nsvc0[3] = bts->gprs.nsvc[0].nsvci >> 8;
@@ -887,6 +905,11 @@ static void patch_nm_tables(struct gsm_bts *bts)
 	/* patch RAC */
 	nanobts_attr_cell[3] = bts->gprs.rac;
 
+	if (bts->gprs.mode == BTS_GPRS_EGPRS) {
+		/* patch EGPRS coding schemes MCS 1..9 */
+		nanobts_attr_cell[29] = 0x8f;
+		nanobts_attr_cell[30] = 0xff;
+	}
 }
 
 static void bootstrap_rsl(struct gsm_bts_trx *trx)
@@ -901,6 +924,8 @@ static void bootstrap_rsl(struct gsm_bts_trx *trx)
 
 void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 {
+	int ts_no, lchan_no;
+
 	switch (event) {
 	case EVT_E1_TEI_UP:
 		switch (type) {
@@ -915,8 +940,35 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 		}
 		break;
 	case EVT_E1_TEI_DN:
-		LOGP(DMI, LOGL_NOTICE, "Lost some E1 TEI link\n");
-		/* FIXME: deal with TEI or L1 link loss */
+		LOGP(DMI, LOGL_ERROR, "Lost some E1 TEI link: %d %p\n", type, trx);
+
+		if (type == E1INP_SIGN_OML)
+			counter_inc(trx->bts->network->stats.bts.oml_fail);
+		else if (type == E1INP_SIGN_RSL)
+			counter_inc(trx->bts->network->stats.bts.rsl_fail);
+
+		/*
+		 * free all allocated channels. change the nm_state so the
+		 * trx and trx_ts becomes unusable and chan_alloc.c can not
+		 * allocate from it.
+		 */
+		for (ts_no = 0; ts_no < ARRAY_SIZE(trx->ts); ++ts_no) {
+			struct gsm_bts_trx_ts *ts = &trx->ts[ts_no];
+
+			for (lchan_no = 0; lchan_no < ARRAY_SIZE(ts->lchan); ++lchan_no) {
+				if (ts->lchan[lchan_no].state != GSM_LCHAN_NONE)
+					lchan_free(&ts->lchan[lchan_no]);
+				lchan_reset(&ts->lchan[lchan_no]);
+			}
+
+			ts->nm_state.operational = 0;
+			ts->nm_state.availability = 0;
+		}
+
+		trx->nm_state.operational = 0;
+		trx->nm_state.availability = 0;
+		trx->bb_transc.nm_state.operational = 0;
+		trx->bb_transc.nm_state.availability = 0;
 		break;
 	default:
 		break;
@@ -925,6 +977,8 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 
 static int bootstrap_bts(struct gsm_bts *bts)
 {
+	int i, n;
+
 	switch (bts->band) {
 	case GSM_BAND_1800:
 		if (bts->c0->arfcn < 512 || bts->c0->arfcn > 885) {
@@ -961,13 +1015,37 @@ static int bootstrap_bts(struct gsm_bts *bts)
 
 	/* Control Channel Description */
 	bts->si_common.chan_desc.att = 1;
-	bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_C;
 	bts->si_common.chan_desc.bs_pa_mfrms = RSL_BS_PA_MFRMS_5;
 	/* T3212 is set from vty/config */
 
+	/* Set ccch config by looking at ts config */
+	for (n=0, i=0; i<8; i++)
+		n += bts->c0->ts[i].pchan == GSM_PCHAN_CCCH ? 1 : 0;
+
+	switch (n) {
+	case 0:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_C;
+		break;
+	case 1:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_1_NC;
+		break;
+	case 2:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_2_NC;
+		break;
+	case 3:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_3_NC;
+		break;
+	case 4:
+		bts->si_common.chan_desc.ccch_conf = RSL_BCCH_CCCH_CONF_4_NC;
+		break;
+	default:
+		LOGP(DNM, LOGL_ERROR, "Unsupported CCCH timeslot configuration\n");
+		return -EINVAL;
+	}
+
 	/* some defaults for our system information */
-	bts->si_common.cell_options.radio_link_timeout = 2; /* 12 */
-	bts->si_common.cell_options.dtx = 2; /* MS shall not use upplink DTX */
+	bts->si_common.cell_options.radio_link_timeout = 7; /* 12 */
+	bts->si_common.cell_options.dtx = 0; /* MS may use upplink DTX */
 	bts->si_common.cell_options.pwrc = 0; /* PWRC not set */
 
 	bts->si_common.cell_sel_par.acs = 0;

openbsc/src/bsc_msc.c

@@ -22,6 +22,7 @@
 
 #include <openbsc/bsc_msc.h>
 #include <openbsc/debug.h>
+#include <openbsc/ipaccess.h>
 
 #include <osmocore/write_queue.h>
 #include <osmocore/talloc.h>
@@ -49,6 +50,28 @@ static void connection_loss(struct bsc_msc_connection *con)
 	con->connection_loss(con);
 }
 
+static void msc_con_timeout(void *_con)
+{
+	struct bsc_msc_connection *con = _con;
+
+	LOGP(DMSC, LOGL_ERROR, "MSC Connection timeout.\n");
+	bsc_msc_lost(con);
+}
+
+static int bsc_msc_except(struct bsc_fd *bfd)
+{
+	struct write_queue *wrt;
+	struct bsc_msc_connection *con;
+
+	LOGP(DMSC, LOGL_ERROR, "Exception on the BFD. Closing down.\n");
+
+	wrt = container_of(bfd, struct write_queue, bfd);
+	con = container_of(wrt, struct bsc_msc_connection, write_queue);
+
+	connection_loss(con);
+	return 0;
+}
+
 /* called in the case of a non blocking connect */
 static int msc_connection_connect(struct bsc_fd *fd, unsigned int what)
 {
@@ -81,9 +104,10 @@ static int msc_connection_connect(struct bsc_fd *fd, unsigned int what)
 
 	/* go to full operation */
 	fd->cb = write_queue_bfd_cb;
-	fd->when = BSC_FD_READ;
+	fd->when = BSC_FD_READ | BSC_FD_EXCEPT;
 
 	con->is_connected = 1;
+	bsc_del_timer(&con->timeout_timer);
 	LOGP(DMSC, LOGL_NOTICE, "(Re)Connected to the MSC.\n");
 	if (con->connected)
 		con->connected(con);
@@ -139,6 +163,13 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 	/* make it non blocking */
 	setnonblocking(fd);
 
+	/* set the socket priority */
+	ret = setsockopt(fd->fd, IPPROTO_IP, IP_TOS,
+			 &con->prio, sizeof(con->prio));
+	if (ret != 0)
+		LOGP(DMSC, LOGL_ERROR, "Failed to set prio to %d. %s\n",
+		     con->prio, strerror(errno));
+
 	memset(&sin, 0, sizeof(sin));
 	sin.sin_family = AF_INET;
 	sin.sin_port = htons(con->port);
@@ -151,12 +182,15 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 		LOGP(DMSC, LOGL_ERROR, "MSC Connection in progress\n");
 		fd->when = BSC_FD_WRITE;
 		fd->cb = msc_connection_connect;
+		con->timeout_timer.cb = msc_con_timeout;
+		con->timeout_timer.data = con;
+		bsc_schedule_timer(&con->timeout_timer, 20, 0);
 	} else if (ret < 0) {
 		perror("Connection failed");
 		connection_loss(con);
 		return ret;
 	} else {
-		fd->when = BSC_FD_READ;
+		fd->when = BSC_FD_READ | BSC_FD_EXCEPT;
 		fd->cb = write_queue_bfd_cb;
 		con->is_connected = 1;
 		if (con->connected)
@@ -174,7 +208,7 @@ int bsc_msc_connect(struct bsc_msc_connection *con)
 }
 
 
-struct bsc_msc_connection *bsc_msc_create(const char *ip, int port)
+struct bsc_msc_connection *bsc_msc_create(const char *ip, int port, int prio)
 {
 	struct bsc_msc_connection *con;
 
@@ -186,7 +220,9 @@ struct bsc_msc_connection *bsc_msc_create(const char *ip, int port)
 
 	con->ip = ip;
 	con->port = port;
+	con->prio = prio;
 	write_queue_init(&con->write_queue, 100);
+	con->write_queue.except_cb = bsc_msc_except;
 	return con;
 }
 
@@ -212,3 +248,24 @@ void bsc_msc_schedule_connect(struct bsc_msc_connection *con)
 	con->reconnect_timer.data = con;
 	bsc_schedule_timer(&con->reconnect_timer, 5, 0);
 }
+
+struct msgb *bsc_msc_id_get_resp(const char *token)
+{
+	struct msgb *msg;
+
+	if (!token) {
+		LOGP(DMSC, LOGL_ERROR, "No token specified.\n");
+		return NULL;
+	}
+
+	msg = msgb_alloc_headroom(4096, 128, "id resp");
+	if (!msg) {
+		LOGP(DMSC, LOGL_ERROR, "Failed to create the message.\n");
+		return NULL;
+	}
+
+	msg->l2h = msgb_v_put(msg, IPAC_MSGT_ID_RESP);
+	msgb_l16tv_put(msg, strlen(token) + 1,
+			IPAC_IDTAG_UNITNAME, (u_int8_t *) token);
+	return msg;
+}

openbsc/src/bsc_msc_ip.c

@@ -1,4 +1,4 @@
-/* A hackish minimal BSC (+MSC +HLR) implementation */
+/* The BSC Process to handle GSM08.08 (A-Interface) */
 
 /* (C) 2008-2009 by Harald Welte <laforge@gnumonks.org>
  * (C) 2009 by Holger Hans Peter Freyther <zecke@selfish.org>
@@ -30,6 +30,7 @@
 
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <arpa/inet.h>
 
 #define _GNU_SOURCE
@@ -44,10 +45,12 @@
 #include <openbsc/chan_alloc.h>
 #include <openbsc/bsc_msc.h>
 #include <openbsc/bsc_nat.h>
+#include <openbsc/bsc_msc_rf.h>
 
 #include <osmocore/select.h>
 #include <osmocore/talloc.h>
 #include <osmocore/write_queue.h>
+#include <osmocore/gsm0808.h>
 
 #include <sccp/sccp.h>
 
@@ -58,16 +61,39 @@
 static struct log_target *stderr_target;
 struct gsm_network *bsc_gsmnet = 0;
 static const char *config_file = "openbsc.cfg";
-static char *msc_address = "127.0.0.1";
-static struct bsc_msc_connection *msc_con;
+static char *msc_address = NULL;
 static struct in_addr local_addr;
 static LLIST_HEAD(active_connections);
 static struct write_queue mgcp_agent;
+static const char *rf_ctl = NULL;
+static int testmode = 0;
 extern int ipacc_rtp_direct;
 
+/* msc handling */
+static struct timer_list msc_ping_timeout;
+static struct timer_list msc_pong_timeout;
+
 extern int bsc_bootstrap_network(int (*layer4)(struct gsm_network *, int, void *), const char *cfg_file);
 extern int bsc_shutdown_net(struct gsm_network *net);
 
+struct llist_head *bsc_sccp_connections()
+{
+	return &active_connections;
+}
+
+/*
+ * Having a subscriber in the lchan is used to indicate that a SACH DEACTIVATE
+ * should be send. We will just introduce a fake subscriber and bind it to the
+ * lchan.
+ */
+static void assign_dummy_subscr(struct gsm_lchan *lchan)
+{
+	if (!lchan->conn.subscr) {
+		lchan->conn.subscr = subscr_get_or_create(bsc_gsmnet, "2323");
+		lchan->conn.subscr->lac = 2323;
+	}
+}
+
 struct bss_sccp_connection_data *bss_sccp_create_data()
 {
 	struct bss_sccp_connection_data *data;
@@ -87,6 +113,7 @@ struct bss_sccp_connection_data *bss_sccp_create_data()
 void bss_sccp_free_data(struct bss_sccp_connection_data *data)
 {
 	bsc_del_timer(&data->T10);
+	bsc_del_timer(&data->sccp_cc_timeout);
 	bsc_del_timer(&data->sccp_it);
 	if (data->sccp)
 		bsc_free_queued(data->sccp);
@@ -104,6 +131,49 @@ static void sccp_it_fired(void *_data)
 	bsc_schedule_timer(&data->sccp_it, SCCP_IT_TIMER, 0);
 }
 
+/* make sure to stop the T10 timer... bss_sccp_free_data is doing that */
+static void bss_close_lchans(struct bss_sccp_connection_data *bss)
+{
+	if (bss->lchan) {
+		bss->lchan->msc_data = NULL;
+		bss->lchan->conn.hand_off += 1;
+		put_subscr_con(&bss->lchan->conn, 0);
+		bss->lchan = NULL;
+	}
+
+	if (bss->secondary_lchan) {
+		bss->secondary_lchan->msc_data = NULL;
+		bss->secondary_lchan->conn.hand_off += 1;
+		put_subscr_con(&bss->secondary_lchan->conn, 0);
+		bss->secondary_lchan = NULL;
+	}
+}
+
+static void bss_force_close(struct bss_sccp_connection_data *bss)
+{
+	bss_close_lchans(bss);
+
+	/* force the close by poking stuff */
+	if (bss->sccp) {
+		sccp_connection_force_free(bss->sccp);
+		bss->sccp = NULL;
+	}
+
+	bss_sccp_free_data(bss);
+}
+
+/* check if this connection was ever confirmed and then recycle */
+static void sccp_check_cc(void *_data)
+{
+	struct bss_sccp_connection_data *data = _data;
+
+	if (data->sccp->connection_state >= SCCP_CONNECTION_STATE_ESTABLISHED)
+		return;
+
+	LOGP(DMSC, LOGL_ERROR, "The connection was never established\n");
+	bss_force_close(data);
+}
+
 
 /* GSM subscriber drop-ins */
 extern struct llist_head *subscr_bsc_active_subscriber(void);
@@ -114,7 +184,7 @@ struct gsm_subscriber *find_subscriber(u_int8_t type, const char *mi_string)
 	if (type == GSM_MI_TYPE_TMSI) {
 		tmsi = tmsi_from_string(mi_string);
 		if (tmsi == GSM_RESERVED_TMSI) {
-			DEBUGP(DMSC, "The TMSI is the reserved one.\n");
+			LOGP(DMSC, LOGL_ERROR, "The TMSI is the reserved one.\n");
 			return NULL;
 		}
 	}
@@ -127,7 +197,7 @@ struct gsm_subscriber *find_subscriber(u_int8_t type, const char *mi_string)
 		}
 	}
 
-	DEBUGP(DMSC, "No subscriber has been found.\n");
+	LOGP(DMSC, LOGL_ERROR, "No subscriber has been found.\n");
 	return NULL;
 }
 
@@ -136,50 +206,66 @@ struct gsm_subscriber *find_subscriber(u_int8_t type, const char *mi_string)
 /* SCCP handling */
 void msc_outgoing_sccp_data(struct sccp_connection *conn, struct msgb *msg, unsigned int len)
 {
+	struct gsm_lchan *lchan;
 	struct bssmap_header *bs;
 
 	if (len < 1) {
-		DEBUGP(DMSC, "The header is too short.\n");
+		LOGP(DMSC, LOGL_ERROR, "The header is too short.\n");
+		return;
+	}
+
+	lchan = sccp_get_lchan(conn->data_ctx);
+	if (!lchan) {
+		LOGP(DMSC, LOGL_ERROR, "SCCP data without lchan for type: 0x%x\n", msg->l3h[0]);
+		return;
+	}
+
+	/* that is bad */
+	if (!lchan->msc_data) {
+		LOGP(DMSC, LOGL_ERROR, "SCCP data for lchan without msc data type: 0x%x\n",
+		     msg->l3h[0]);
 		return;
 	}
 
 	switch (msg->l3h[0]) {
 	case BSSAP_MSG_BSS_MANAGEMENT:
 		msg->l4h = &msg->l3h[sizeof(*bs)];
-		msg->lchan = sccp_get_lchan(conn->data_ctx);
+		msg->lchan = lchan;
 		bssmap_rcvmsg_dt1(conn, msg, len - sizeof(*bs));
 		break;
 	case BSSAP_MSG_DTAP:
-		dtap_rcvmsg(sccp_get_lchan(conn->data_ctx), msg, len);
+		dtap_rcvmsg(lchan, msg, len);
 		break;
 	default:
-		DEBUGPC(DMSC, "Unimplemented msg type: %d\n", msg->l3h[0]);
+		LOGP(DMSC, LOGL_DEBUG, "Unimplemented msg type: %d\n", msg->l3h[0]);
 	}
 }
 
 void msc_outgoing_sccp_state(struct sccp_connection *conn, int old_state)
 {
+	struct bss_sccp_connection_data *con_data;
+
 	if (conn->connection_state >= SCCP_CONNECTION_STATE_RELEASE_COMPLETE) {
-		DEBUGP(DMSC, "Freeing sccp conn: %p state: %d\n", conn, conn->connection_state);
-		if (sccp_get_lchan(conn->data_ctx) != NULL) {
-			struct gsm_lchan *lchan = sccp_get_lchan(conn->data_ctx);
+		con_data = (struct bss_sccp_connection_data *) conn->data_ctx;
 
-			DEBUGP(DMSC, "ERROR: The lchan is still associated\n.");
-
-			lchan->msc_data = NULL;
-			put_subscr_con(&lchan->conn, 0);
+		LOGP(DMSC, LOGL_DEBUG, "Freeing sccp conn: %p state: %d\n", conn, conn->connection_state);
+		if (con_data->lchan || con_data->secondary_lchan) {
+			LOGP(DMSC, LOGL_ERROR, "ERROR: The lchan is still associated\n.");
+			bss_close_lchans(con_data);
 		}
 
-		bss_sccp_free_data((struct bss_sccp_connection_data *)conn->data_ctx);
+		bss_sccp_free_data(con_data);
 		sccp_connection_free(conn);
 		return;
 	} else if (conn->connection_state == SCCP_CONNECTION_STATE_ESTABLISHED) {
-		struct bss_sccp_connection_data *con_data;
+		LOGP(DMSC, LOGL_DEBUG, "Connection established: %p\n", conn);
 
-		DEBUGP(DMSC, "Connection established: %p\n", conn);
+		con_data = (struct bss_sccp_connection_data *) conn->data_ctx;
+
+		/* stop the CC timeout */
+		bsc_del_timer(&con_data->sccp_cc_timeout);
 
 		/* start the inactivity test timer */
-		con_data = (struct bss_sccp_connection_data *) conn->data_ctx;
 		con_data->sccp_it.cb = sccp_it_fired;
 		con_data->sccp_it.data = con_data;
 		bsc_schedule_timer(&con_data->sccp_it, SCCP_IT_TIMER, 0);
@@ -203,30 +289,28 @@ static int open_sccp_connection(struct msgb *layer3)
 	struct msgb *data;
 
 	/* When not connected to a MSC. We will simply close things down. */
-	if (!msc_con->is_connected) {
+	if (!bsc_gsmnet->msc_con->is_authenticated) {
 		LOGP(DMSC, LOGL_ERROR, "Not connected to a MSC. Not forwarding data.\n");
-		use_subscr_con(&layer3->lchan->conn);
-		put_subscr_con(&layer3->lchan->conn, 0);
 		return -1;
 	}
 
-	DEBUGP(DMSC, "Opening new layer3 connection\n");
+	LOGP(DMSC, LOGL_DEBUG, "Opening new layer3 connection\n");
 	sccp_connection = sccp_connection_socket();
 	if (!sccp_connection) {
-		DEBUGP(DMSC, "Failed to allocate memory.\n");
+		LOGP(DMSC, LOGL_ERROR, "Failed to allocate memory.\n");
 		return -ENOMEM;
 	}
 
 	data = bssmap_create_layer3(layer3);
 	if (!data) {
-		DEBUGP(DMSC, "Failed to allocate complete layer3.\n");
+		LOGP(DMSC, LOGL_ERROR, "Failed to allocate complete layer3.\n");
 		sccp_connection_free(sccp_connection);
 		return -ENOMEM;
 	}
 
 	con_data = bss_sccp_create_data();
 	if (!con_data) {
-		DEBUGP(DMSC, "Failed to allocate bss<->msc data.\n");
+		LOGP(DMSC, LOGL_ERROR, "Failed to allocate bss<->msc data.\n");
 		sccp_connection_free(sccp_connection);
 		msgb_free(data);
 		return -ENOMEM;
@@ -241,7 +325,14 @@ static int open_sccp_connection(struct msgb *layer3)
 	sccp_connection->data_ctx = con_data;
 	layer3->lchan->msc_data = con_data;
 
+	/* Make sure we open the connection */
+	con_data->sccp_cc_timeout.data = con_data;
+	con_data->sccp_cc_timeout.cb = sccp_check_cc;
+	bsc_schedule_timer(&con_data->sccp_cc_timeout, 10, 0);
+
 	/* FIXME: Use transaction for this */
+	/* assign a dummy subscriber */
+	assign_dummy_subscr(layer3->lchan);
 	use_subscr_con(&layer3->lchan->conn);
 	sccp_connection_connect(sccp_connection, &sccp_ssn_bssap, data);
 	msgb_free(data);
@@ -255,7 +346,7 @@ static int send_dtap_or_open_connection(struct msgb *msg)
 	if (msg->lchan->msc_data) {
 		struct msgb *dtap = dtap_create_msg(msg, 0);
 		if (!dtap) {
-			DEBUGP(DMSC, "Creating a DTAP message failed.\n");
+			LOGP(DMSC, LOGL_ERROR, "Creating a DTAP message failed.\n");
 			return -1;
 		}
 
@@ -273,8 +364,15 @@ static int handle_paging_response(struct msgb *msg)
 	char mi_string[GSM48_MI_SIZE];
 	u_int8_t mi_type;
 
-	gsm48_paging_extract_mi(msg, mi_string, &mi_type);
-	DEBUGP(DMSC, "PAGING RESPONSE: mi_type=0x%02x MI(%s)\n",
+	struct gsm48_hdr *hdr;
+	struct gsm48_pag_resp *resp;
+
+	hdr = msgb_l3(msg);
+	resp = (struct gsm48_pag_resp *) &hdr->data[0];
+
+	gsm48_paging_extract_mi(resp, msgb_l3len(msg) - sizeof(*hdr),
+				mi_string, &mi_type);
+	LOGP(DMSC, LOGL_DEBUG, "PAGING RESPONSE: mi_type=0x%02x MI(%s)\n",
 		mi_type, mi_string);
 
 	subscr = find_subscriber(mi_type, mi_string);
@@ -284,7 +382,7 @@ static int handle_paging_response(struct msgb *msg)
 	/* force the paging to stop at every bts */
 	subscr->lac = GSM_LAC_RESERVED_ALL_BTS;
 	if (gsm48_handle_paging_resp(msg, subscr) != 0) {
-		DEBUGP(DMSC, "Paging failed.\n");
+		LOGP(DMSC, LOGL_ERROR, "Paging failed.\n");
 		return -1;
 	}
 
@@ -302,10 +400,10 @@ static int handle_cipher_m_complete(struct msgb *msg)
 		return -1;
 	}
 
-	DEBUGP(DMSC, "CIPHER MODE COMPLETE from MS, forwarding to MSC\n");
+	LOGP(DMSC, LOGL_DEBUG, "CIPHER MODE COMPLETE from MS, forwarding to MSC\n");
 	resp = bssmap_create_cipher_complete(msg);
 	if (!resp) {
-		DEBUGP(DMSC, "Creating MSC response failed.\n");
+		LOGP(DMSC, LOGL_ERROR, "Creating MSC response failed.\n");
 		return -1;
 	}
 
@@ -322,37 +420,47 @@ static int handle_ass_compl(struct msgb *msg)
 	struct gsm_lchan *old_chan;
 	struct gsm48_hdr *gh = msgb_l3(msg);
 
-	DEBUGP(DMSC, "ASSIGNMENT COMPLETE from MS, forwarding to MSC\n");
+	LOGP(DMSC, LOGL_DEBUG, "ASSIGNMENT COMPLETE from MS, forwarding to MSC\n");
 
 	if (!msg->lchan->msc_data) {
 		LOGP(DMSC, LOGL_ERROR, "No MSC data\n");
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 		return -1;
 	}
 
 	if (msg->lchan->msc_data->secondary_lchan != msg->lchan) {
-		LOGP(DMSC, LOGL_NOTICE, "Wrong assignment complete.\n");
+		LOGP(DMSC, LOGL_ERROR, "Wrong assignment complete.\n");
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 		return -1;
 	}
 
 	if (msgb_l3len(msg) - sizeof(*gh) != 1) {
-		DEBUGP(DMSC, "assignment failure invalid: %d\n",
+		LOGP(DMSC, LOGL_ERROR, "assignment compl invalid: %d\n",
 			msgb_l3len(msg) - sizeof(*gh));
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 		return -1;
 	}
 
+	/* assign a dummy subscriber */
+	assign_dummy_subscr(msg->lchan);
+
 	/* swap the channels and release the old */
 	old_chan = msg->lchan->msc_data->lchan;
-	msg->lchan->msc_data->lchan = msg->lchan;
-	msg->lchan->msc_data->secondary_lchan = NULL;
-	old_chan->msc_data = NULL;
+	if (old_chan) {
+		msg->lchan->msc_data->lchan = msg->lchan;
+		msg->lchan->msc_data->secondary_lchan = NULL;
+		old_chan->msc_data = NULL;
 
-	/* give up the old channel to not do a SACCH deactivate */
-	subscr_put(old_chan->conn.subscr);
-	old_chan->conn.subscr = NULL;
-	put_subscr_con(&old_chan->conn, 1);
+		/* give up the old channel to not do a SACCH deactivate */
+		if (old_chan->conn.subscr)
+			subscr_put(old_chan->conn.subscr);
+		old_chan->conn.subscr = NULL;
+		old_chan->conn.hand_off += 1;
+		put_subscr_con(&old_chan->conn, 1);
+	}
 
 	/* activate audio on it... */
 	if (is_ipaccess_bts(msg->lchan->ts->trx->bts) && msg->lchan->tch_mode != GSM48_CMODE_SIGN)
@@ -368,30 +476,38 @@ static int handle_ass_compl(struct msgb *msg)
  */
 static int handle_ass_fail(struct msgb *msg)
 {
+	u_int8_t *rr_cause;
 	struct gsm48_hdr *gh = msgb_l3(msg);
 
-	DEBUGP(DMSC, "ASSIGNMENT FAILURE from MS, forwarding to MSC\n");
+	LOGP(DMSC, LOGL_ERROR, "ASSIGNMENT FAILURE from MS, forwarding to MSC\n");
 	if (!msg->lchan->msc_data) {
 		LOGP(DMSC, LOGL_ERROR, "No MSC data\n");
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 		return -1;
 	}
 
-	if (msg->lchan->msc_data->secondary_lchan != msg->lchan) {
-		LOGP(DMSC, LOGL_NOTICE, "Wrong assignment complete.\n");
+	/* assignment failure comes on the old link */
+	if (msg->lchan->msc_data->lchan != msg->lchan) {
+		LOGP(DMSC, LOGL_NOTICE, "Failure should come on the old link.\n");
+		msg->lchan->msc_data = NULL;
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 		return -1;
 	}
 
+	/* Giving up the secondary will happen in bssap */
 	if (msgb_l3len(msg) - sizeof(*gh) != 1) {
-		DEBUGP(DMSC, "assignment failure invalid: %d\n",
+		LOGP(DMSC, LOGL_ERROR, "assignment failure invalid: %d\n",
 			msgb_l3len(msg) - sizeof(*gh));
-		put_subscr_con(&msg->lchan->conn, 0);
-		return -1;
+		rr_cause = NULL;
+	} else {
+		rr_cause = &gh->data[0];
 	}
 
+	/* this will also free the secondary channel */
 	gsm0808_send_assignment_failure(msg->lchan,
-		GSM0808_CAUSE_RADIO_INTERFACE_MESSAGE_FAILURE, &gh->data[0]);
+		GSM0808_CAUSE_RADIO_INTERFACE_MESSAGE_FAILURE, rr_cause);
 	return 1;
 }
 
@@ -496,11 +612,18 @@ int gsm0408_rcvmsg(struct msgb *msg, u_int8_t link_id)
 	if (rc == 0 && msg->lchan->msc_data && lchan_get_sccp(msg->lchan)) {
 		struct msgb *dtap = dtap_create_msg(msg, link_id);
 		if (!dtap) {
-			DEBUGP(DMSC, "Creating a DTAP message failed.\n");
+			LOGP(DMSC, LOGL_ERROR, "Creating a DTAP message failed.\n");
 			return -1;
 		}
 
 		bsc_queue_connection_write(lchan_get_sccp(msg->lchan), dtap);
+	} else if (rc <= 0 && !msg->lchan->msc_data && msg->lchan->conn.use_count == 0) {
+		if (msg->lchan->state == LCHAN_S_ACTIVE) {
+			LOGP(DMSC, LOGL_NOTICE, "Closing unowned channel.\n");
+			msg->lchan->conn.hand_off += 1;
+			use_subscr_con(&msg->lchan->conn);
+			put_subscr_con(&msg->lchan->conn, 0);
+		}
 	}
 
 	return rc;
@@ -523,7 +646,7 @@ static int handle_abisip_signal(unsigned int subsys, unsigned int signal,
 	case S_ABISIP_CRCX_ACK:
 		/* we can ask it to connect now */
 		if (lchan->msc_data) {
-			DEBUGP(DMSC, "Connecting BTS to port: %d conn: %d\n",
+			LOGP(DMSC, LOGL_DEBUG, "Connecting BTS to port: %d conn: %d\n",
 				lchan->msc_data->rtp_port, lchan->abis_ip.conn_id);
 
 			int rtp_payload = ts->trx->bts->network->rtp_payload;
@@ -534,7 +657,7 @@ static int handle_abisip_signal(unsigned int subsys, unsigned int signal,
 					    lchan->msc_data->rtp_port,
 					    rtp_payload);
 			if (rc < 0) {
-				DEBUGP(DMSC, "Failed to send connect: %d\n", rc);
+				LOGP(DMSC, LOGL_ERROR, "Failed to send connect: %d\n", rc);
 				return rc;
 			}
 		}
@@ -548,7 +671,7 @@ static int handle_abisip_signal(unsigned int subsys, unsigned int signal,
 
 static void print_usage()
 {
-	printf("Usage: bsc_hack\n");
+	printf("Usage: bsc_msc_ip\n");
 }
 
 /*
@@ -557,7 +680,7 @@ static void print_usage()
 static int msc_queue_write(struct msgb *msg, int proto)
 {
 	ipaccess_prepend_header(msg, proto);
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
+	if (write_queue_enqueue(&bsc_gsmnet->msc_con->write_queue, msg) != 0) {
 		LOGP(DMSC, LOGL_FATAL, "Failed to queue IPA/%d\n", proto);
 		msgb_free(msg);
 		return -1;
@@ -570,10 +693,10 @@ static int msc_sccp_do_write(struct bsc_fd *fd, struct msgb *msg)
 {
 	int ret;
 
-	DEBUGP(DMSC, "Sending SCCP to MSC: %u\n", msgb_l2len(msg));
-	DEBUGP(DMI, "MSC TX %s\n", hexdump(msg->l2h, msgb_l2len(msg)));
+	LOGP(DMSC, LOGL_DEBUG, "Sending SCCP to MSC: %u\n", msgb_l2len(msg));
+	LOGP(DMI, LOGL_DEBUG, "MSC TX %s\n", hexdump(msg->l2h, msgb_l2len(msg)));
 
-	ret = write(msc_con->write_queue.bfd.fd, msg->data, msg->len);
+	ret = write(bsc_gsmnet->msc_con->write_queue.bfd.fd, msg->data, msg->len);
 	if (ret < msg->len)
 		perror("MSC: Failed to send SCCP");
 
@@ -612,7 +735,7 @@ static int mgcp_do_read(struct bsc_fd *fd)
 		return -1;
 	}
 
-	ret = read(fd->fd, mgcp->data, mgcp->data_len);
+	ret = read(fd->fd, mgcp->data, 4096 - 128);
 	if (ret <= 0) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to read: %d/%s\n", errno, strerror(errno));
 		msgb_free(mgcp);
@@ -705,7 +828,7 @@ static int mgcp_create_port(void)
 
 static int msc_sccp_accept(struct sccp_connection *connection, void *data)
 {
-	DEBUGP(DMSC, "Rejecting incoming SCCP connection.\n");
+	LOGP(DMSC, LOGL_DEBUG, "Rejecting incoming SCCP connection.\n");
 	return -1;
 }
 
@@ -713,10 +836,10 @@ static int msc_sccp_read(struct msgb *msgb, unsigned int length, void *data)
 {
 	struct bssmap_header *bs;
 
-	DEBUGP(DMSC, "Incoming SCCP message ftom MSC: %s\n", hexdump(msgb->l3h, length));
+	LOGP(DMSC, LOGL_DEBUG, "Incoming SCCP message ftom MSC: %s\n", hexdump(msgb->l3h, length));
 
 	if (length < sizeof(*bs)) {
-		DEBUGP(DMSC, "The header is too short.\n");
+		LOGP(DMSC, LOGL_ERROR, "The header is too short.\n");
 		return -1;
 	}
 
@@ -730,7 +853,7 @@ static int msc_sccp_read(struct msgb *msgb, unsigned int length, void *data)
 		bssmap_rcvmsg_udt(bsc_gsmnet, msgb, length - sizeof(*bs));
 		break;
 	default:
-		DEBUGPC(DMSC, "Unimplemented msg type: %d\n", bs->type);
+		LOGP(DMSC, LOGL_ERROR, "Unimplemented msg type: %d\n", bs->type);
 	}
 
 	return 0;
@@ -742,27 +865,20 @@ static int msc_sccp_read(struct msgb *msgb, unsigned int length, void *data)
  */
 static void initialize_if_needed(void)
 {
-	if (!bsc_gsmnet) {
-		int rc;
-		struct msgb *msg;
-
-		fprintf(stderr, "Bootstraping the network. Sending GSM08.08 reset.\n");
-		rc = bsc_bootstrap_network(NULL, config_file);
-		if (rc < 0) {
-			fprintf(stderr, "Bootstrapping the network failed. exiting.\n");
-			exit(1);
-		}
+	struct msgb *msg;
 
 
+	if (!bsc_gsmnet->msc_con->is_authenticated) {
 		/* send a gsm 08.08 reset message from here */
-		msg = bssmap_create_reset();
+		msg = gsm0808_create_reset();
 		if (!msg) {
-			DEBUGP(DMSC, "Failed to create the reset message.\n");
+			LOGP(DMSC, LOGL_ERROR, "Failed to create the reset message.\n");
 			return;
 		}
 
 		sccp_write(msg, &sccp_ssn_bssap, &sccp_ssn_bssap, 0);
 		msgb_free(msg);
+		bsc_gsmnet->msc_con->is_authenticated = 1;
 	}
 }
 
@@ -774,23 +890,36 @@ static void send_id_get_response(int fd)
 		return;
 	}
 
-	if (!bsc_gsmnet->bsc_token) {
-		LOGP(DMSC, LOGL_ERROR, "The bsc token is not set.\n");
+	msg = bsc_msc_id_get_resp(bsc_gsmnet->bsc_token);
+	if (!msg)
 		return;
-	}
+	msc_queue_write(msg, IPAC_PROTO_IPACCESS);
+}
 
-	msg = msgb_alloc_headroom(4096, 128, "id resp");
+/*
+ * Send some packets to test the MSC.
+ */
+static void test_msc()
+{
+	struct msgb *msg;
 
-	msg->l2h = msgb_v_put(msg, IPAC_MSGT_ID_RESP);
-	msgb_l16tv_put(msg, strlen(bsc_gsmnet->bsc_token) + 1,
-			IPAC_IDTAG_UNITNAME, (u_int8_t *) bsc_gsmnet->bsc_token);
-	ipaccess_prepend_header(msg, IPAC_PROTO_IPACCESS);
+	if (!testmode)
+		return;
 
-	if (write(fd, msg->data, msg->len) != msg->len) {
-		LOGP(DMSC, LOGL_ERROR, "Short write.\n");
-	}
+	static const uint8_t pag_resp[] = {
+		0x01, 0xf3, 0x26, 0x09, 0x02, 0x02, 0x04, 0x02, 0x42,
+		0xfe, 0x0f, 0x1f, 0x00, 0x1d, 0x57, 0x05, 0x08, 0x00,
+		0x72, 0xf4, 0x80, 0x10, 0x1c, 0x9c, 0x40, 0x17, 0x10,
+		0x06, 0x27, 0x02, 0x03, 0x30, 0x18, 0xa0, 0x08, 0x59,
+		0x51, 0x30, 0x10, 0x30, 0x32, 0x80, 0x06, 0x00
+	};
 
-	msgb_free(msg);
+	msg = msgb_alloc_headroom(4096, 128, "paging response");
+	if (!msg)
+		return;
+	msg->l2h = msgb_put(msg, sizeof(pag_resp));
+	memcpy(msg->l2h, pag_resp, sizeof(pag_resp));
+	msc_queue_write(msg, IPAC_PROTO_SCCP);
 }
 
 /*
@@ -804,30 +933,63 @@ static void msc_connection_was_lost(struct bsc_msc_connection *msc)
 	LOGP(DMSC, LOGL_ERROR, "Lost MSC connection. Freing stuff.\n");
 
 	llist_for_each_entry_safe(bss, tmp, &active_connections, active_connections) {
-		if (bss->lchan) {
-			bss->lchan->msc_data = NULL;
-			put_subscr_con(&bss->lchan->conn, 0);
-			bss->lchan = NULL;
-		}
-
-		if (bss->secondary_lchan) {
-			bss->secondary_lchan->msc_data = NULL;
-			put_subscr_con(&bss->secondary_lchan->conn, 0);
-			bss->secondary_lchan = NULL;
-		}
-
-		/* force the close by poking stuff */
-		if (bss->sccp) {
-			sccp_connection_force_free(bss->sccp);
-			bss->sccp = NULL;
-		}
-
-		bss_sccp_free_data(bss);
+		bss_force_close(bss);
 	}
 
+	bsc_del_timer(&msc_ping_timeout);
+	bsc_del_timer(&msc_pong_timeout);
+
+	msc->is_authenticated = 0;
 	bsc_msc_schedule_connect(msc);
 }
 
+static void msc_pong_timeout_cb(void *data)
+{
+	LOGP(DMSC, LOGL_ERROR, "MSC didn't answer PING. Closing connection.\n");
+	bsc_msc_lost(bsc_gsmnet->msc_con);
+}
+
+static void send_ping(void)
+{
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(4096, 128, "ping");
+	if (!msg) {
+		LOGP(DMSC, LOGL_ERROR, "Failed to create PING.\n");
+		return;
+	}
+
+	msg->l2h = msgb_put(msg, 1);
+	msg->l2h[0] = IPAC_MSGT_PING;
+
+	msc_queue_write(msg, IPAC_PROTO_IPACCESS);
+}
+
+static void msc_ping_timeout_cb(void *data)
+{
+	if (bsc_gsmnet->ping_timeout < 0)
+		return;
+
+	send_ping();
+
+	/* send another ping in 20 seconds */
+	bsc_schedule_timer(&msc_ping_timeout, bsc_gsmnet->ping_timeout, 0);
+
+	/* also start a pong timer */
+	bsc_schedule_timer(&msc_pong_timeout, bsc_gsmnet->pong_timeout, 0);
+}
+
+static void msc_connection_connected(struct bsc_msc_connection *con)
+{
+	int ret, on;
+	on = 1;
+	ret = setsockopt(con->write_queue.bfd.fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+	if (ret != 0)
+                LOGP(DMSC, LOGL_ERROR, "Failed to set TCP_NODELAY: %s\n", strerror(errno));
+
+	msc_ping_timeout_cb(con);
+}
+
 /*
  * callback with IP access data
  */
@@ -840,7 +1002,7 @@ static int ipaccess_a_fd_cb(struct bsc_fd *bfd)
 	if (!msg) {
 		if (error == 0) {
 			LOGP(DMSC, LOGL_ERROR, "The connection to the MSC was lost.\n");
-			bsc_msc_lost(msc_con);
+			bsc_msc_lost(bsc_gsmnet->msc_con);
 			return -1;
 		}
 
@@ -848,7 +1010,7 @@ static int ipaccess_a_fd_cb(struct bsc_fd *bfd)
 		return -1;
 	}
 
-	DEBUGP(DMSC, "From MSC: %s proto: %d\n", hexdump(msg->data, msg->len), msg->l2h[0]);
+	LOGP(DMSC, LOGL_DEBUG, "From MSC: %s proto: %d\n", hexdump(msg->data, msg->len), msg->l2h[0]);
 
 	/* handle base message handling */
 	hh = (struct ipaccess_head *) msg->data;
@@ -860,6 +1022,9 @@ static int ipaccess_a_fd_cb(struct bsc_fd *bfd)
 			initialize_if_needed();
 		else if (msg->l2h[0] == IPAC_MSGT_ID_GET) {
 			send_id_get_response(bfd->fd);
+			test_msc();
+		} else if (msg->l2h[0] == IPAC_MSGT_PONG) {
+			bsc_del_timer(&msc_pong_timeout);
 		}
 	} else if (hh->proto == IPAC_PROTO_SCCP) {
 		sccp_system_incoming(msg);
@@ -877,10 +1042,13 @@ static void print_help()
 	printf("  -h --help this text\n");
 	printf("  -d option --debug=DRLL:DCC:DMM:DRR:DRSL:DNM enable debugging\n");
 	printf("  -s --disable-color\n");
+	printf("  -T --timestamp. Print a timestamp in the debug output.\n");
 	printf("  -c --config-file filename The config file to use.\n");
 	printf("  -m --msc=IP. The address of the MSC.\n");
 	printf("  -l --local=IP. The local address of the MGCP.\n");
 	printf("  -e --log-level number. Set a global loglevel.\n");
+	printf("  -r --rf-ctl NAME. A unix domain socket to listen for cmds.\n");
+	printf("  -t --testmode. A special mode to provoke failures at the MSC.\n");
 }
 
 static void handle_options(int argc, char** argv)
@@ -893,14 +1061,15 @@ static void handle_options(int argc, char** argv)
 			{"config-file", 1, 0, 'c'},
 			{"disable-color", 0, 0, 's'},
 			{"timestamp", 0, 0, 'T'},
-			{"rtp-proxy", 0, 0, 'P'},
 			{"msc", 1, 0, 'm'},
 			{"local", 1, 0, 'l'},
 			{"log-level", 1, 0, 'e'},
+			{"rf-ctl", 1, 0, 'r'},
+			{"testmode", 0, 0, 't'},
 			{0, 0, 0, 0}
 		};
 
-		c = getopt_long(argc, argv, "hd:sTPc:m:l:",
+		c = getopt_long(argc, argv, "hd:sTc:m:l:e:r:t",
 				long_options, &option_index);
 		if (c == -1)
 			break;
@@ -926,7 +1095,7 @@ static void handle_options(int argc, char** argv)
 			ipacc_rtp_direct = 0;
 			break;
 		case 'm':
-			msc_address = strdup(optarg);
+			msc_address = optarg;
 			break;
 		case 'l':
 			inet_aton(optarg, &local_addr);
@@ -934,6 +1103,12 @@ static void handle_options(int argc, char** argv)
 		case 'e':
 			log_set_log_level(stderr_target, atoi(optarg));
 			break;
+		case 'r':
+			rf_ctl = optarg;
+			break;
+		case 't':
+			testmode = 1;
+			break;
 		default:
 			/* ignore */
 			break;
@@ -947,8 +1122,10 @@ static void signal_handler(int signal)
 
 	switch (signal) {
 	case SIGINT:
-		bsc_shutdown_net(bsc_gsmnet);
-		sleep(3);
+		if (bsc_gsmnet) {
+			bsc_shutdown_net(bsc_gsmnet);
+			sleep(3);
+		}
 		exit(0);
 		break;
 	case SIGABRT:
@@ -958,9 +1135,9 @@ static void signal_handler(int signal)
 		talloc_report_full(tall_bsc_ctx, stderr);
 		break;
 	case SIGUSR2:
-		if (!msc_con->is_connected)
+		if (!bsc_gsmnet->msc_con || !bsc_gsmnet->msc_con->is_connected)
 			return;
-		bsc_msc_lost(msc_con);
+		bsc_msc_lost(bsc_gsmnet->msc_con);
 		break;
 	default:
 		break;
@@ -1013,6 +1190,9 @@ extern int bts_model_nanobts_init(void);
 
 int main(int argc, char **argv)
 {
+	char *msc;
+	int rc;
+
 	log_init(&log_info);
 	tall_bsc_ctx = talloc_named_const(NULL, 1, "openbsc");
 	stderr_target = log_target_create_stderr();
@@ -1031,6 +1211,12 @@ int main(int argc, char **argv)
 	/* seed the PRNG */
 	srand(time(NULL));
 
+	signal(SIGINT, &signal_handler);
+	signal(SIGABRT, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
+	signal(SIGUSR2, &signal_handler);
+	signal(SIGPIPE, SIG_IGN);
+
 	/* attempt to register the local mgcp forward */
 	if (mgcp_create_port() != 0) {
 		fprintf(stderr, "Failed to bind local MGCP port\n");
@@ -1045,27 +1231,48 @@ int main(int argc, char **argv)
 	/* initialize ipaccess handling */
 	register_signal_handler(SS_ABISIP, handle_abisip_signal, NULL);
 
+	fprintf(stderr, "Bootstraping the network. Sending GSM08.08 reset.\n");
+	rc = bsc_bootstrap_network(NULL, config_file);
+	if (rc < 0) {
+		fprintf(stderr, "Bootstrapping the network failed. exiting.\n");
+		exit(1);
+	}
+
+	if (rf_ctl) {
+		struct bsc_msc_rf *rf;
+		rf = bsc_msc_rf_create(rf_ctl, bsc_gsmnet);
+		if (!rf) {
+			fprintf(stderr, "Failed to create the RF service.\n");
+			exit(1);
+		}
+	}
 
 	/* setup MSC Connection handling */
-	msc_con = bsc_msc_create(msc_address, 5000);
-	if (!msc_con) {
+	msc = bsc_gsmnet->msc_ip;
+	if (msc_address)
+		msc = msc_address;
+
+	bsc_gsmnet->msc_con = bsc_msc_create(msc,
+					     bsc_gsmnet->msc_port,
+					     bsc_gsmnet->msc_prio);
+	if (!bsc_gsmnet->msc_con) {
 		fprintf(stderr, "Creating a bsc_msc_connection failed.\n");
 		exit(1);
 	}
 
-	msc_con->connection_loss = msc_connection_was_lost;
-	msc_con->write_queue.read_cb = ipaccess_a_fd_cb;
-	msc_con->write_queue.write_cb = msc_sccp_do_write;
-	bsc_msc_connect(msc_con);
+	msc_ping_timeout.cb = msc_ping_timeout_cb;
+	msc_pong_timeout.cb = msc_pong_timeout_cb;
+
+	bsc_gsmnet->msc_con->connection_loss = msc_connection_was_lost;
+	bsc_gsmnet->msc_con->connected = msc_connection_connected;
+	bsc_gsmnet->msc_con->write_queue.read_cb = ipaccess_a_fd_cb;
+	bsc_gsmnet->msc_con->write_queue.write_cb = msc_sccp_do_write;
+	bsc_msc_connect(bsc_gsmnet->msc_con);
 
 
-	signal(SIGINT, &signal_handler);
-	signal(SIGABRT, &signal_handler);
-	signal(SIGUSR1, &signal_handler);
-	signal(SIGUSR2, &signal_handler);
-	signal(SIGPIPE, SIG_IGN);
 
 	while (1) {
 		bsc_select_main(0);
 	}
 }
+

openbsc/src/bsc_msc_rf.c

@@ -0,0 +1,249 @@
+/* RF Ctl handling socket */
+
+/* (C) 2010 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther <zecke@selfish.org>
+ * (C) 2010 by On-Waves
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <openbsc/bsc_msc_rf.h>
+#include <openbsc/debug.h>
+#include <openbsc/gsm_data.h>
+
+#include <osmocore/talloc.h>
+#include <osmocore/protocol/gsm_12_21.h>
+
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <errno.h>
+#include <unistd.h>
+
+#define RF_CMD_QUERY '?'
+#define RF_CMD_OFF   '0'
+#define RF_CMD_ON    '1'
+
+static int lock_each_trx(struct gsm_network *net, int lock)
+{
+	struct gsm_bts *bts;
+
+	llist_for_each_entry(bts, &net->bts_list, list) {
+		struct gsm_bts_trx *trx;
+		llist_for_each_entry(trx, &bts->trx_list, list) {
+			gsm_trx_lock_rf(trx, lock);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * Send a '1' when one TRX is online, otherwise send 0
+ */
+static void handle_query(struct bsc_msc_rf_conn *conn)
+{
+	struct msgb *msg;
+	struct gsm_bts *bts;
+	char send = RF_CMD_OFF;
+
+	llist_for_each_entry(bts, &conn->gsm_network->bts_list, list) {
+		struct gsm_bts_trx *trx;
+		llist_for_each_entry(trx, &bts->trx_list, list) {
+			if (trx->nm_state.availability == NM_AVSTATE_OK &&
+			    trx->nm_state.operational != NM_STATE_LOCKED) {
+					send = RF_CMD_ON;
+					break;
+			}
+		}
+	}
+
+	msg = msgb_alloc(10, "RF Query");
+	if (!msg) {
+		LOGP(DINP, LOGL_ERROR, "Failed to allocate response msg.\n");
+		return;
+	}
+
+	msg->l2h = msgb_put(msg, 1);
+	msg->l2h[0] = send;
+
+	if (write_queue_enqueue(&conn->queue, msg) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the answer.\n");
+		msgb_free(msg);
+		return;
+	}
+
+	return;
+}
+
+static int rf_read_cmd(struct bsc_fd *fd)
+{
+	struct bsc_msc_rf_conn *conn = fd->data;
+	char buf[1];
+	int rc;
+
+	rc = read(fd->fd, buf, sizeof(buf));
+	if (rc != sizeof(buf)) {
+		LOGP(DINP, LOGL_ERROR, "Short read %d/%s\n", errno, strerror(errno));
+		bsc_unregister_fd(fd);
+		close(fd->fd);
+		write_queue_clear(&conn->queue);
+		talloc_free(conn);
+		return -1;
+	}
+
+	switch (buf[0]) {
+	case RF_CMD_QUERY:
+		handle_query(conn);
+		break;
+	case RF_CMD_OFF:
+		lock_each_trx(conn->gsm_network, 1);
+		break;
+	case RF_CMD_ON:
+		lock_each_trx(conn->gsm_network, 0);
+		break;
+	default:
+		LOGP(DINP, LOGL_ERROR, "Unknown command %d\n", buf[0]);
+		break;
+	}
+
+	return 0;
+}
+
+static int rf_write_cmd(struct bsc_fd *fd, struct msgb *msg)
+{
+	int rc;
+
+	rc = write(fd->fd, msg->data, msg->len);
+	if (rc != msg->len) {
+		LOGP(DINP, LOGL_ERROR, "Short write %d/%s\n", errno, strerror(errno));
+		return -1;
+	}
+
+	return 0;
+}
+
+static int rf_ctl_accept(struct bsc_fd *bfd, unsigned int what)
+{
+	struct bsc_msc_rf_conn *conn;
+	struct bsc_msc_rf *rf = bfd->data;
+	struct sockaddr_un addr;
+	socklen_t len = sizeof(addr);
+	int fd;
+
+	fd = accept(bfd->fd, (struct sockaddr *) &addr, &len);
+	if (fd < 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to accept. errno: %d/%s\n",
+		     errno, strerror(errno));
+		return -1;
+	}
+
+	conn = talloc_zero(rf, struct bsc_msc_rf_conn);
+	if (!conn) {
+		LOGP(DINP, LOGL_ERROR, "Failed to allocate mem.\n");
+		close(fd);
+		return -1;
+	}
+
+	write_queue_init(&conn->queue, 10);
+	conn->queue.bfd.data = conn;
+	conn->queue.bfd.fd = fd;
+	conn->queue.bfd.when = BSC_FD_READ | BSC_FD_WRITE;
+	conn->queue.read_cb = rf_read_cmd;
+	conn->queue.write_cb = rf_write_cmd;
+	conn->gsm_network = rf->gsm_network;
+
+	if (bsc_register_fd(&conn->queue.bfd) != 0) {
+		close(fd);
+		talloc_free(conn);
+		return -1;
+	}
+
+	return 0;
+}
+
+struct bsc_msc_rf *bsc_msc_rf_create(const char *path, struct gsm_network *net)
+{
+	unsigned int namelen;
+	struct sockaddr_un local;
+	struct bsc_fd *bfd;
+	struct bsc_msc_rf *rf;
+	int rc;
+
+	rf = talloc_zero(NULL, struct bsc_msc_rf);
+	if (!rf) {
+		LOGP(DINP, LOGL_ERROR, "Failed to create bsc_msc_rf.\n");
+		return NULL;
+	}
+
+	bfd = &rf->listen;
+	bfd->fd = socket(AF_UNIX, SOCK_STREAM, 0);
+	if (bfd->fd < 0) {
+		LOGP(DINP, LOGL_ERROR, "Can not create socket. %d/%s\n",
+		     errno, strerror(errno));
+		return NULL;
+	}
+
+	local.sun_family = AF_UNIX;
+	strncpy(local.sun_path, path, sizeof(local.sun_path));
+	local.sun_path[sizeof(local.sun_path) - 1] = '\0';
+	unlink(local.sun_path);
+
+	/* we use the same magic that X11 uses in Xtranssock.c for
+	 * calculating the proper length of the sockaddr */
+#if defined(BSD44SOCKETS) || defined(__UNIXWARE__)
+	local.sun_len = strlen(local.sun_path);
+#endif
+#if defined(BSD44SOCKETS) || defined(SUN_LEN)
+	namelen = SUN_LEN(&local);
+#else
+	namelen = strlen(local.sun_path) +
+		  offsetof(struct sockaddr_un, sun_path);
+#endif
+
+	rc = bind(bfd->fd, (struct sockaddr *) &local, namelen);
+	if (rc != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to bind '%s' errno: %d/%s\n",
+		     local.sun_path, errno, strerror(errno));
+		close(bfd->fd);
+		talloc_free(rf);
+		return NULL;
+	}
+
+	if (listen(bfd->fd, 0) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to listen: %d/%s\n", errno, strerror(errno));
+		close(bfd->fd);
+		talloc_free(rf);
+		return NULL;
+	}
+
+	bfd->when = BSC_FD_READ;
+	bfd->cb = rf_ctl_accept;
+	bfd->data = rf;
+
+	if (bsc_register_fd(bfd) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to register bfd.\n");
+		close(bfd->fd);
+		talloc_free(rf);
+		return NULL;
+	}
+
+	rf->gsm_network = net;
+
+	return rf;
+}
+

openbsc/src/bssap.c

@@ -29,7 +29,7 @@
 #include <openbsc/paging.h>
 #include <openbsc/chan_alloc.h>
 
-#include <osmocore/tlv.h>
+#include <osmocore/gsm0808.h>
 
 #include <sccp/sccp.h>
 
@@ -40,34 +40,11 @@
 #define BSSMAP_MSG_SIZE 512
 #define BSSMAP_MSG_HEADROOM 128
 
+#define LINK_ID_CB 0
 
-static const struct tlv_definition bss_att_tlvdef = {
-	.def = {
-		[GSM0808_IE_IMSI]		    = { TLV_TYPE_TLV },
-		[GSM0808_IE_TMSI]		    = { TLV_TYPE_TLV },
-		[GSM0808_IE_CELL_IDENTIFIER_LIST]   = { TLV_TYPE_TLV },
-		[GSM0808_IE_CHANNEL_NEEDED]	    = { TLV_TYPE_TV },
-		[GSM0808_IE_EMLPP_PRIORITY]	    = { TLV_TYPE_TV },
-		[GSM0808_IE_CHANNEL_TYPE]	    = { TLV_TYPE_TLV },
-		[GSM0808_IE_PRIORITY]		    = { TLV_TYPE_TLV },
-		[GSM0808_IE_CIRCUIT_IDENTITY_CODE]  = { TLV_TYPE_TV },
-		[GSM0808_IE_DOWNLINK_DTX_FLAG]	    = { TLV_TYPE_TV },
-		[GSM0808_IE_INTERFERENCE_BAND_TO_USE] = { TLV_TYPE_TV },
-		[GSM0808_IE_CLASSMARK_INFORMATION_T2] = { TLV_TYPE_TLV },
-		[GSM0808_IE_GROUP_CALL_REFERENCE]   = { TLV_TYPE_TLV },
-		[GSM0808_IE_TALKER_FLAG]	    = { TLV_TYPE_T },
-		[GSM0808_IE_CONFIG_EVO_INDI]	    = { TLV_TYPE_TV },
-		[GSM0808_IE_LSA_ACCESS_CTRL_SUPPR]  = { TLV_TYPE_TV },
-		[GSM0808_IE_SERVICE_HANDOVER]	    = { TLV_TYPE_TV},
-		[GSM0808_IE_ENCRYPTION_INFORMATION] = { TLV_TYPE_TLV },
-		[GSM0808_IE_CIPHER_RESPONSE_MODE]   = { TLV_TYPE_TV },
-	},
-};
+static void bts_queue_send(struct msgb *msg, int link_id);
+static void bssmap_free_secondary(struct bss_sccp_connection_data *data);
 
-const struct tlv_definition *gsm0808_att_tlvdef()
-{
-	return &bss_att_tlvdef;
-}
 
 static u_int16_t get_network_code_for_msc(struct gsm_network *net)
 {
@@ -85,13 +62,13 @@ static u_int16_t get_country_code_for_msc(struct gsm_network *net)
 
 static int bssmap_paging_cb(unsigned int hooknum, unsigned int event, struct msgb *msg, void *data, void *param)
 {
-	DEBUGP(DMSC, "Paging is complete.\n");
+	LOGP(DPAG, LOGL_DEBUG, "Paging is complete.\n");
 	return 0;
 }
 
 static int bssmap_handle_reset_ack(struct gsm_network *net, struct msgb *msg, unsigned int length)
 {
-	DEBUGP(DMSC, "Reset ACK from MSC\n");
+	LOGP(DMSC, LOGL_NOTICE, "Reset ACK from MSC\n");
 
 	return 0;
 }
@@ -109,18 +86,18 @@ static int bssmap_handle_paging(struct gsm_network *net, struct msgb *msg, unsig
 	u_int8_t chan_needed = RSL_CHANNEED_ANY;
 	int paged;
 
-	tlv_parse(&tp, &bss_att_tlvdef, msg->l4h + 1, payload_length - 1, 0, 0);
+	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h + 1, payload_length - 1, 0, 0);
 
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_IMSI)) {
-		DEBUGP(DMSC, "Mandantory IMSI not present.\n");
+		LOGP(DMSC, LOGL_ERROR, "Mandantory IMSI not present.\n");
 		return -1;
 	} else if ((TLVP_VAL(&tp, GSM0808_IE_IMSI)[0] & GSM_MI_TYPE_MASK) != GSM_MI_TYPE_IMSI) {
-		DEBUGP(DMSC, "Wrong content in the IMSI\n");
+		LOGP(DMSC, LOGL_ERROR, "Wrong content in the IMSI\n");
 		return -1;
 	}
 
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST)) {
-		DEBUGP(DMSC, "Mandantory CELL IDENTIFIER LIST not present.\n");
+		LOGP(DMSC, LOGL_ERROR, "Mandantory CELL IDENTIFIER LIST not present.\n");
 		return -1;
 	}
 
@@ -150,7 +127,7 @@ static int bssmap_handle_paging(struct gsm_network *net, struct msgb *msg, unsig
 		unsigned int *_lac = (unsigned int *)&data[1];
 		lac = ntohs(*_lac);
 	} else if (data_length > 1 || (data[0] & 0x0f) != CELL_IDENT_BSS) {
-		DEBUGPC(DMSC, "Unsupported Cell Identifier List: %s\n", hexdump(data, data_length));
+		LOGP(DMSC, LOGL_ERROR, "Unsupported Cell Identifier List: %s\n", hexdump(data, data_length));
 		return -1;
 	}
 
@@ -158,10 +135,10 @@ static int bssmap_handle_paging(struct gsm_network *net, struct msgb *msg, unsig
 		chan_needed = TLVP_VAL(&tp, GSM0808_IE_CHANNEL_NEEDED)[0] & 0x03;
 
 	if (TLVP_PRESENT(&tp, GSM0808_IE_EMLPP_PRIORITY)) {
-		DEBUGP(DMSC, "eMLPP is not handled\n");
+		LOGP(DMSC, LOGL_ERROR, "eMLPP is not handled\n");
 	}
 
-	DEBUGP(DMSC, "Paging request from MSC IMSI: '%s' TMSI: '0x%x/%u' LAC: 0x%x\n", mi_string, tmsi, tmsi, lac);
+	LOGP(DMSC, LOGL_DEBUG, "Paging request from MSC IMSI: '%s' TMSI: '0x%x/%u' LAC: 0x%x\n", mi_string, tmsi, tmsi, lac);
 	subscr = subscr_get_or_create(net, mi_string);
 	if (!subscr)
 		return -1;
@@ -170,7 +147,7 @@ static int bssmap_handle_paging(struct gsm_network *net, struct msgb *msg, unsig
 	subscr->tmsi = tmsi;
 	subscr->lac = lac;
 	paged = paging_request(net, subscr, chan_needed, bssmap_paging_cb, subscr);
-	DEBUGP(DMSC, "Paged IMSI: '%s' TMSI: '0x%x/%u' LAC: 0x%x on #bts: %d\n", mi_string, tmsi, tmsi, lac, paged);
+	LOGP(DPAG, LOGL_DEBUG, "Paged IMSI: '%s' TMSI: '0x%x/%u' LAC: 0x%x on #bts: %d\n", mi_string, tmsi, tmsi, lac, paged);
 
 	subscr_put(subscr);
 	return -1;
@@ -185,22 +162,22 @@ static int bssmap_handle_clear_command(struct sccp_connection *conn,
 	/* TODO: handle the cause of this package */
 
 	if (msg->lchan) {
-		DEBUGP(DMSC, "Releasing all transactions on %p\n", conn);
+		LOGP(DMSC, LOGL_DEBUG, "Releasing all transactions on %p\n", conn);
 		bsc_del_timer(&msg->lchan->msc_data->T10);
 		msg->lchan->msc_data->lchan = NULL;
 
 		/* we might got killed during an assignment */
-		if (msg->lchan->msc_data->secondary_lchan)
-			put_subscr_con(&msg->lchan->msc_data->secondary_lchan->conn, 0);
+		bssmap_free_secondary(msg->lchan->msc_data);
 
 		msg->lchan->msc_data = NULL;
+		msg->lchan->conn.hand_off += 1;
 		put_subscr_con(&msg->lchan->conn, 0);
 	}
 
 	/* send the clear complete message */
-	resp = bssmap_create_clear_complete();
+	resp = gsm0808_create_clear_complete();
 	if (!resp) {
-		DEBUGP(DMSC, "Sending clear complete failed.\n");
+		LOGP(DMSC, LOGL_ERROR, "Sending clear complete failed.\n");
 		return -1;
 	}
 
@@ -227,23 +204,22 @@ static int bssmap_handle_cipher_mode(struct sccp_connection *conn,
 	int reject_cause = -1;
 	int include_imeisv = 1;
 
-	/* HACK: Sending A5/0 to the MS */
 	if (!msg->lchan || !msg->lchan->msc_data) {
-		DEBUGP(DMSC, "No lchan/msc_data in cipher mode command.\n");
+		LOGP(DMSC, LOGL_ERROR, "No lchan/msc_data in cipher mode command.\n");
 		goto reject;
 	}
 
 	if (msg->lchan->msc_data->ciphering_handled) {
-		DEBUGP(DMSC, "Already seen ciphering command. Protocol Error.\n");
+		LOGP(DMSC, LOGL_ERROR, "Already seen ciphering command. Protocol Error.\n");
 		goto reject;
 	}
 
 	msg->lchan->msc_data->ciphering_handled = 1;
 	msg->lchan->msc_data->block_gsm = 1;
 
-	tlv_parse(&tp, &bss_att_tlvdef, msg->l4h + 1, payload_length - 1, 0, 0);
+	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h + 1, payload_length - 1, 0, 0);
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_ENCRYPTION_INFORMATION)) {
-		DEBUGP(DMSC, "IE Encryption Information missing.\n");
+		LOGP(DMSC, LOGL_ERROR, "IE Encryption Information missing.\n");
 		goto reject;
 	}
 
@@ -255,7 +231,7 @@ static int bssmap_handle_cipher_mode(struct sccp_connection *conn,
 	 */
 	len = TLVP_LEN(&tp, GSM0808_IE_ENCRYPTION_INFORMATION);
 	if (len < 1) {
-		DEBUGP(DMSC, "IE Encryption Information is too short.\n");
+		LOGP(DMSC, LOGL_ERROR, "IE Encryption Information is too short.\n");
 		goto reject;
 	}
 
@@ -269,7 +245,7 @@ static int bssmap_handle_cipher_mode(struct sccp_connection *conn,
 		msg->lchan->encr.key_len = len - 1;
 		memcpy(msg->lchan->encr.key, &data[1], len - 1);
 	} else {
-		DEBUGP(DMSC, "Can not select encryption...\n");
+		LOGP(DMSC, LOGL_ERROR, "Can not select encryption...\n");
 		goto reject;
 	}
 
@@ -280,12 +256,12 @@ static int bssmap_handle_cipher_mode(struct sccp_connection *conn,
 	return gsm48_send_rr_ciph_mode(msg->lchan, include_imeisv);
 
 reject:
-	if (msg->lchan->msc_data)
+	if (msg->lchan && msg->lchan->msc_data)
 		msg->lchan->msc_data->block_gsm = 0;
 
 	resp = bssmap_create_cipher_reject(reject_cause);
 	if (!resp) {
-		DEBUGP(DMSC, "Sending the cipher reject failed.\n");
+		LOGP(DMSC, LOGL_ERROR, "Sending the cipher reject failed.\n");
 		return -1;
 	}
 
@@ -293,19 +269,55 @@ reject:
 	return -1;
 }
 
+/*
+ * handle network failures... and free the secondary lchan
+ */
+static void bssmap_free_secondary(struct bss_sccp_connection_data *data)
+{
+	struct gsm_lchan *lchan;
+
+	if (!data || !data->secondary_lchan)
+		return;
+
+	lchan = data->secondary_lchan;
+	if (lchan->msc_data != data) {
+		LOGP(DMSC, LOGL_ERROR, "MSC data does not match on lchan and cb.\n");
+		data->secondary_lchan = NULL;
+	}
+
+	/* give up additional data */
+	lchan->msc_data->secondary_lchan = NULL;
+	if (lchan->msc_data->lchan == lchan)
+		lchan->msc_data->lchan = NULL;
+	lchan->msc_data = NULL;
+
+	/* give up the new channel to not do a SACCH deactivate */
+	if (lchan->conn.subscr)
+		subscr_put(lchan->conn.subscr);
+	lchan->conn.subscr = NULL;
+	lchan->conn.hand_off += 1;
+	put_subscr_con(&lchan->conn, 1);
+}
+
 /*
  * Handle the network configurable T10 parameter
  */
 static void bssmap_t10_fired(void *_conn)
 {
+	struct bss_sccp_connection_data *msc_data;
 	struct sccp_connection *conn = (struct sccp_connection *) _conn;
 	struct msgb *resp;
 
-	DEBUGP(DMSC, "T10 fired, assignment failed: %p\n", conn);
-	resp = bssmap_create_assignment_failure(
+	LOGP(DMSC, LOGL_ERROR, "T10 fired, assignment failed: %p\n", conn);
+
+	/* free the secondary channel if we have one */
+	msc_data = conn->data_ctx;
+	bssmap_free_secondary(msc_data);
+
+	resp = gsm0808_create_assignment_failure(
 		GSM0808_CAUSE_NO_RADIO_RESOURCE_AVAILABLE, NULL);
 	if (!resp) {
-		DEBUGP(DMSC, "Allocation failure: %p\n", conn);
+		LOGP(DMSC, LOGL_ERROR, "Allocation failure: %p\n", conn);
 		return;
 	}
 
@@ -329,7 +341,7 @@ enum gsm0808_permitted_speech audio_support_to_gsm88(struct gsm_audio_support *a
 			return GSM0808_PERM_HR3;
 			break;
 		default:
-			    DEBUGP(DMSC, "Wrong speech mode: %d\n", audio->ver);
+			    LOGP(DMSC, LOGL_ERROR, "Wrong speech mode: %d\n", audio->ver);
 			    return GSM0808_PERM_FR1;
 		}
 	} else {
@@ -344,8 +356,8 @@ enum gsm0808_permitted_speech audio_support_to_gsm88(struct gsm_audio_support *a
 			return GSM0808_PERM_FR3;
 			break;
 		default:
-			    DEBUGP(DMSC, "Wrong speech mode: %d\n", audio->ver);
-			    return GSM0808_PERM_HR1;
+			LOGP(DMSC, LOGL_ERROR, "Wrong speech mode: %d\n", audio->ver);
+			return GSM0808_PERM_HR1;
 		}
 	}
 }
@@ -396,7 +408,7 @@ static int handle_new_assignment(struct msgb *msg, int full_rate, int chan_mode)
 	bts = msg->lchan->ts->trx->bts;
 	chan_type = full_rate ? GSM_LCHAN_TCH_F : GSM_LCHAN_TCH_H;
 
-	new_lchan = lchan_alloc(bts, chan_type);
+	new_lchan = lchan_alloc(bts, chan_type, 0);
 
 	if (!new_lchan) {
 		LOGP(DMSC, LOGL_NOTICE, "No free channel.\n");
@@ -407,7 +419,8 @@ static int handle_new_assignment(struct msgb *msg, int full_rate, int chan_mode)
 	memcpy(&new_lchan->encr, &msg->lchan->encr, sizeof(new_lchan->encr));
 	new_lchan->ms_power = msg->lchan->ms_power;
 	new_lchan->bs_power = msg->lchan->bs_power;
-	new_lchan->conn.subscr = subscr_get(msg->lchan->conn.subscr);
+	if (msg->lchan->conn.subscr)
+		new_lchan->conn.subscr = subscr_get(msg->lchan->conn.subscr);
 
 	/* copy new data to it */
 	use_subscr_con(&new_lchan->conn);
@@ -427,6 +440,7 @@ static int handle_new_assignment(struct msgb *msg, int full_rate, int chan_mode)
 		return -1;
 	}
 
+	rsl_lchan_set_state(new_lchan, LCHAN_S_ACT_REQ);
 	msc_data->secondary_lchan = new_lchan;
 	new_lchan->msc_data = msc_data;
 	return 0;
@@ -439,12 +453,15 @@ static void continue_new_assignment(struct gsm_lchan *new_lchan)
 {
 	if (!new_lchan->msc_data) {
 		LOGP(DMSC, LOGL_ERROR, "No BSS data found.\n");
+		new_lchan->conn.hand_off += 1;
 		put_subscr_con(&new_lchan->conn, 0);
 		return;
 	}
 
 	if (new_lchan->msc_data->secondary_lchan != new_lchan) {
 		LOGP(DMSC, LOGL_ERROR, "This is not the secondary channel?\n");
+		new_lchan->msc_data = NULL;
+		new_lchan->conn.hand_off += 1;
 		put_subscr_con(&new_lchan->conn, 0);
 		return;
 	}
@@ -472,21 +489,21 @@ static int bssmap_handle_assignm_req(struct sccp_connection *conn,
 	int i, supported, port, full_rate = -1;
 
 	if (!msg->lchan || !msg->lchan->msc_data) {
-		DEBUGP(DMSC, "No lchan/msc_data in cipher mode command.\n");
-		goto reject;
+		LOGP(DMSC, LOGL_ERROR, "No lchan/msc_data in cipher mode command.\n");
+		return -1;
 	}
 
 	msc_data = msg->lchan->msc_data;
 	network = msg->lchan->ts->trx->bts->network;
-	tlv_parse(&tp, &bss_att_tlvdef, msg->l4h + 1, length - 1, 0, 0);
+	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h + 1, length - 1, 0, 0);
 
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_CHANNEL_TYPE)) {
-		DEBUGP(DMSC, "Mandantory channel type not present.\n");
+		LOGP(DMSC, LOGL_ERROR, "Mandantory channel type not present.\n");
 		goto reject;
 	}
 
 	if (!TLVP_PRESENT(&tp, GSM0808_IE_CIRCUIT_IDENTITY_CODE)) {
-		DEBUGP(DMSC, "Identity code missing. Audio routing will not work.\n");
+		LOGP(DMSC, LOGL_ERROR, "Identity code missing. Audio routing will not work.\n");
 		goto reject;
 	}
 
@@ -500,7 +517,7 @@ static int bssmap_handle_assignm_req(struct sccp_connection *conn,
 	 * multi-slot, limiting the channel coding, speech...
 	 */
 	if (TLVP_LEN(&tp, GSM0808_IE_CHANNEL_TYPE) < 3) {
-		DEBUGP(DMSC, "ChannelType len !=3 not supported: %d\n",
+		LOGP(DMSC, LOGL_ERROR, "ChannelType len !=3 not supported: %d\n",
 			TLVP_LEN(&tp, GSM0808_IE_CHANNEL_TYPE));
 		goto reject;
 	}
@@ -512,12 +529,12 @@ static int bssmap_handle_assignm_req(struct sccp_connection *conn,
 
 	data = (u_int8_t *) TLVP_VAL(&tp, GSM0808_IE_CHANNEL_TYPE);
 	if ((data[0] & 0xf) != 0x1) {
-		DEBUGP(DMSC, "ChannelType != speech: %d\n", data[0]);
+		LOGP(DMSC, LOGL_ERROR, "ChannelType != speech: %d\n", data[0]);
 		goto reject;
 	}
 
 	if (data[1] != GSM0808_SPEECH_FULL_PREF && data[1] != GSM0808_SPEECH_HALF_PREF) {
-		DEBUGP(DMSC, "ChannelType full not allowed: %d\n", data[1]);
+		LOGP(DMSC, LOGL_ERROR, "ChannelType full not allowed: %d\n", data[1]);
 		goto reject;
 	}
 
@@ -546,7 +563,7 @@ static int bssmap_handle_assignm_req(struct sccp_connection *conn,
 	}
 
 	if (chan_mode == GSM48_CMODE_SIGN) {
-		DEBUGP(DMSC, "No supported audio type found.\n");
+		LOGP(DMSC, LOGL_ERROR, "No supported audio type found.\n");
 		goto reject;
 	}
 
@@ -567,7 +584,7 @@ static int bssmap_handle_assignm_req(struct sccp_connection *conn,
 		else
 			goto reject;
 	} else {
-		DEBUGP(DMSC, "Sending ChanModify for speech on: sccp: %p mode: 0x%x on port %d %d/0x%x port: %u\n",
+		LOGP(DMSC, LOGL_ERROR, "Sending ChanModify for speech on: sccp: %p mode: 0x%x on port %d %d/0x%x port: %u\n",
 			conn, chan_mode, port, multiplex, timeslot, msc_data->rtp_port);
 
 		if (chan_mode == GSM48_CMODE_SPEECH_AMR) {
@@ -590,7 +607,7 @@ int bssmap_rcvmsg_udt(struct gsm_network *net, struct msgb *msg, unsigned int le
 	int ret = 0;
 
 	if (length < 1) {
-		DEBUGP(DMSC, "Not enough room: %d\n", length);
+		LOGP(DMSC, LOGL_ERROR, "Not enough room: %d\n", length);
 		return -1;
 	}
 
@@ -611,7 +628,7 @@ int bssmap_rcvmsg_dt1(struct sccp_connection *conn, struct msgb *msg, unsigned i
 	int ret = 0;
 
 	if (length < 1) {
-		DEBUGP(DMSC, "Not enough room: %d\n", length);
+		LOGP(DMSC, LOGL_ERROR, "Not enough room: %d\n", length);
 		return -1;
 	}
 
@@ -626,7 +643,7 @@ int bssmap_rcvmsg_dt1(struct sccp_connection *conn, struct msgb *msg, unsigned i
 		ret = bssmap_handle_assignm_req(conn, msg, length);
 		break;
 	default:
-		DEBUGP(DMSC, "Unimplemented msg type: %d\n", msg->l4h[0]);
+		LOGP(DMSC, LOGL_DEBUG, "Unimplemented msg type: %d\n", msg->l4h[0]);
 		break;
 	}
 
@@ -641,29 +658,29 @@ int dtap_rcvmsg(struct gsm_lchan *lchan, struct msgb *msg, unsigned int length)
 	u_int8_t link_id;
 
 	if (!lchan) {
-		DEBUGP(DMSC, "No lchan available\n");
+		LOGP(DMSC, LOGL_ERROR, "No lchan available\n");
 		return -1;
 	}
 
 	header = (struct dtap_header *) msg->l3h;
 	if (sizeof(*header) >= length) {
-		DEBUGP(DMSC, "The DTAP header does not fit. Wanted: %u got: %u\n", sizeof(*header), length);
-                DEBUGP(DMSC, "hex: %s\n", hexdump(msg->l3h, length));
+		LOGP(DMSC, LOGL_ERROR, "The DTAP header does not fit. Wanted: %u got: %u\n", sizeof(*header), length);
+                LOGP(DMSC, LOGL_ERROR, "hex: %s\n", hexdump(msg->l3h, length));
                 return -1;
 	}
 
 	if (header->length > length - sizeof(*header)) {
-		DEBUGP(DMSC, "The DTAP l4 information does not fit: header: %u length: %u\n", header->length, length);
-                DEBUGP(DMSC, "hex: %s\n", hexdump(msg->l3h, length));
+		LOGP(DMSC, LOGL_ERROR, "The DTAP l4 information does not fit: header: %u length: %u\n", header->length, length);
+                LOGP(DMSC, LOGL_ERROR, "hex: %s\n", hexdump(msg->l3h, length));
 		return -1;
 	}
 
-	DEBUGP(DMSC, "DTAP message: SAPI: %u CHAN: %u\n", header->link_id & 0x07, header->link_id & 0xC0);
+	LOGP(DMSC, LOGL_DEBUG, "DTAP message: SAPI: %u CHAN: %u\n", header->link_id & 0x07, header->link_id & 0xC0);
 
 	/* forward the data */
 	gsm48 = gsm48_msgb_alloc();
 	if (!gsm48) {
-		DEBUGP(DMSC, "Allocation of the message failed.\n");
+		LOGP(DMSC, LOGL_ERROR, "Allocation of the message failed.\n");
 		return -1;
 	}
 
@@ -752,36 +769,6 @@ struct msgb *bssmap_create_layer3(struct msgb *msg_l3)
 	return msg;
 }
 
-struct msgb *bssmap_create_reset(void)
-{
-	struct msgb *msg = msgb_alloc(30, "bssmap: reset");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 6);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 0x04;
-	msg->l3h[2] = 0x30;
-	msg->l3h[3] = 0x04;
-	msg->l3h[4] = 0x01;
-	msg->l3h[5] = 0x20;
-	return msg;
-}
-
-struct msgb *bssmap_create_clear_complete(void)
-{
-	struct msgb *msg = msgb_alloc(30, "bssmap: clear complete");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 3);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 1;
-	msg->l3h[2] = BSS_MAP_MSG_CLEAR_COMPLETE;
-
-	return msg;
-}
-
 struct msgb *bssmap_create_cipher_complete(struct msgb *layer3)
 {
 	struct msgb *msg = msgb_alloc_headroom(BSSMAP_MSG_SIZE, BSSMAP_MSG_HEADROOM,
@@ -884,12 +871,14 @@ static u_int8_t chan_mode_to_speech(struct gsm_lchan *lchan)
 	case GSM48_CMODE_DATA_6k0:
 	case GSM48_CMODE_DATA_3k6:
 	default:
-		DEBUGP(DMSC, "Using non speech mode: %d\n", mode);
+		LOGP(DMSC, LOGL_ERROR, "Using non speech mode: %d\n", mode);
 		return 0;
 		break;
 	}
 
-	if (lchan->type == GSM_LCHAN_TCH_H)
+	/* assume to always do AMR HR on any TCH type */
+	if (lchan->type == GSM_LCHAN_TCH_H ||
+	    lchan->tch_mode == GSM48_CMODE_SPEECH_AMR)
 		mode |= 0x4;
 
         return mode;
@@ -937,7 +926,7 @@ static u_int8_t lchan_to_chosen_channel(struct gsm_lchan *lchan)
 		channel = 0x9;
 		break;
 	case GSM_LCHAN_UNKNOWN:
-		DEBUGP(DMSC, "Unknown lchan type: %p\n", lchan);
+		LOGP(DMSC, LOGL_ERROR, "Unknown lchan type: %p\n", lchan);
 		break;
 	}
 
@@ -992,36 +981,6 @@ struct msgb *bssmap_create_assignment_completed(struct gsm_lchan *lchan, u_int8_
 	return msg;
 }
 
-struct msgb *bssmap_create_assignment_failure(u_int8_t cause, u_int8_t *rr_cause)
-{
-	u_int8_t *data;
-	struct msgb *msg = msgb_alloc(35, "bssmap: ass fail");
-	if (!msg)
-		return NULL;
-
-	msg->l3h = msgb_put(msg, 6);
-	msg->l3h[0] = BSSAP_MSG_BSS_MANAGEMENT;
-	msg->l3h[1] = 0xff;
-	msg->l3h[2] = BSS_MAP_MSG_ASSIGMENT_FAILURE;
-	msg->l3h[3] = GSM0808_IE_CAUSE;
-	msg->l3h[4] = 1;
-	msg->l3h[5] = cause;
-
-	/* RR cause 3.2.2.22 */
-	if (rr_cause) {
-		data = msgb_put(msg, 2);
-		data[0] = GSM0808_IE_RR_CAUSE;
-		data[1] = *rr_cause;
-	}
-
-	/* Circuit pool 3.22.45 */
-	/* Circuit pool list 3.2.2.46 */
-
-	/* update the size */
-	msg->l3h[1] = msgb_l3len(msg) - 2;
-	return msg;
-}
-
 struct msgb *dtap_create_msg(struct msgb *msg_l3, u_int8_t link_id)
 {
 	struct dtap_header *header;
@@ -1065,8 +1024,14 @@ static int bssap_handle_lchan_signal(unsigned int subsys, unsigned int signal,
 		switch (signal) {
 		case S_LCHAN_UNEXPECTED_RELEASE:
 			/* handle this through the T10 timeout */
-			if (lchan->msc_data->lchan != lchan)
+			if (lchan->msc_data->lchan != lchan) {
+				if (lchan->msc_data->secondary_lchan == lchan) {
+					LOGP(DMSC, LOGL_NOTICE, "Setting secondary to NULL.\n");
+					lchan->msc_data->secondary_lchan = NULL;
+					lchan->msc_data = NULL;
+				}
 				return 0;
+			}
 
 			bsc_del_timer(&lchan->msc_data->T10);
 			conn = lchan->msc_data->sccp;
@@ -1075,7 +1040,7 @@ static int bssap_handle_lchan_signal(unsigned int subsys, unsigned int signal,
 
 			msg = msgb_alloc(30, "sccp: clear request");
 			if (!msg) {
-				DEBUGP(DMSC, "Failed to allocate clear request.\n");
+				LOGP(DMSC, LOGL_ERROR, "Failed to allocate clear request.\n");
 				return 0;
 			}
 
@@ -1088,7 +1053,7 @@ static int bssap_handle_lchan_signal(unsigned int subsys, unsigned int signal,
 			msg->l3h[4] = 1;
 			msg->l3h[5] = GSM0808_CAUSE_RADIO_INTERFACE_FAILURE;
 
-			DEBUGP(DMSC, "Sending clear request on unexpected channel release.\n");
+			LOGP(DMSC, LOGL_NOTICE, "Sending clear request on unexpected channel release.\n");
 			bsc_queue_connection_write(conn, msg);
 			break;
 		case S_LCHAN_ACTIVATE_ACK:
@@ -1111,17 +1076,17 @@ void bsc_queue_connection_write(struct sccp_connection *conn, struct msgb *msg)
 	data = (struct bss_sccp_connection_data *)conn->data_ctx;
 
 	if (conn->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGP(DMSC, "Connection closing, dropping packet on: %p\n", conn);
+		LOGP(DMSC, LOGL_ERROR, "Connection closing, dropping packet on: %p\n", conn);
 		msgb_free(msg);
 	} else if (conn->connection_state == SCCP_CONNECTION_STATE_ESTABLISHED
 		   && data->sccp_queue_size == 0) {
 		sccp_connection_write(conn, msg);
 		msgb_free(msg);
 	} else if (data->sccp_queue_size > 10) {
-		DEBUGP(DMSC, "Dropping packet on %p due queue overflow\n", conn);
+		LOGP(DMSC, LOGL_ERROR, "Dropping packet on %p due queue overflow\n", conn);
 		msgb_free(msg);
 	} else {
-		DEBUGP(DMSC, "Queuing packet on %p. Queue size: %d\n", conn, data->sccp_queue_size);
+		LOGP(DMSC, LOGL_DEBUG, "Queuing packet on %p. Queue size: %d\n", conn, data->sccp_queue_size);
 		++data->sccp_queue_size;
 		msgb_enqueue(&data->sccp_queue, msg);
 	}
@@ -1166,13 +1131,13 @@ static void rll_ind_cb(struct gsm_lchan *lchan, u_int8_t link_id,
 	struct bss_sccp_connection_data *data = lchan->msc_data;
 
 	if (!data || !data->sccp) {
-		DEBUGP(DMSC, "Time-out/Establish after sccp release? Ind: %d lchan: %p\n",
+		LOGP(DMSC, LOGL_ERROR, "Time-out/Establish after sccp release? Ind: %d lchan: %p\n",
 		       rllr_ind, lchan);
 		return;
 	}
 
 	if (memcmp(&data->sccp->source_local_reference, &ref, sizeof(ref)) != 0) {
-		DEBUGP(DMSC, "Wrong SCCP connection. Not handling RLL callback: %u %u\n",
+		LOGP(DMSC, LOGL_ERROR, "Wrong SCCP connection. Not handling RLL callback: %u %u\n",
 			sccp_src_ref_to_int(&ref),
 			sccp_src_ref_to_int(&data->sccp->source_local_reference));
 		return;
@@ -1192,7 +1157,7 @@ static void rll_ind_cb(struct gsm_lchan *lchan, u_int8_t link_id,
 		bts_free_queued(data);
 		sapi_reject = bssmap_create_sapi_reject(link_id);
 		if (!sapi_reject){
-			DEBUGP(DMSC, "Failed to create SAPI reject\n");
+			LOGP(DMSC, LOGL_ERROR, "Failed to create SAPI reject\n");
 			return;
 		}
 
@@ -1203,15 +1168,23 @@ static void rll_ind_cb(struct gsm_lchan *lchan, u_int8_t link_id,
 }
 
 /* decide if we need to queue because of SAPI != 0 */
-void bts_queue_send(struct msgb *msg, int link_id)
+static void bts_queue_send(struct msgb *msg, int link_id)
 {
-	struct bss_sccp_connection_data *data = msg->lchan->msc_data;
+
+	struct bss_sccp_connection_data *data;
+
+	if (!msg->lchan || !msg->lchan->msc_data) {
+		LOGP(DMSC, LOGL_ERROR, "BAD: Wrongly configured lchan: %p\n", msg->lchan);
+		msgb_free(msg);
+	}
+
+	data = msg->lchan->msc_data;
 
 	if (!data->block_gsm && data->gsm_queue_size == 0) {
 		if (msg->lchan->sapis[link_id & 0x7] != LCHAN_SAPI_UNUSED) {
 			rsl_data_request(msg, link_id);
 		} else {
-			msg->smsh = (unsigned char*) link_id;
+			msg->cb[LINK_ID_CB] = link_id;
 			msgb_enqueue(&data->gsm_queue, msg);
 			++data->gsm_queue_size;
 
@@ -1221,12 +1194,13 @@ void bts_queue_send(struct msgb *msg, int link_id)
 				      (void *)sccp_src_ref_to_int(&data->sccp->source_local_reference));
 		}
 	} else if (data->gsm_queue_size == 10) {
-		DEBUGP(DMSC, "Queue full on %p. Dropping GSM0408.\n", data->sccp);
+		LOGP(DMSC, LOGL_ERROR, "Queue full on %p. Dropping GSM0408.\n", data->sccp);
+		msgb_free(msg);
 	} else {
-		DEBUGP(DMSC, "Queueing GSM0408 message on %p. Queue size: %d\n",
+		LOGP(DMSC, LOGL_DEBUG, "Queueing GSM0408 message on %p. Queue size: %d\n",
 		       data->sccp, data->gsm_queue_size + 1);
 
-		msg->smsh = (unsigned char*) link_id;
+		msg->cb[LINK_ID_CB] = link_id;
 		msgb_enqueue(&data->gsm_queue, msg);
 		++data->gsm_queue_size;
 	}
@@ -1252,7 +1226,7 @@ void bts_send_queued(struct bss_sccp_connection_data *data)
 	while (!llist_empty(&data->gsm_queue)) {
 		/* this is not allowed to fail */
 		msg = msgb_dequeue(&data->gsm_queue);
-		rsl_data_request(msg, (int) msg->smsh);
+		rsl_data_request(msg, msg->cb[LINK_ID_CB]);
 	}
 
 	data->gsm_queue_size = 0;
@@ -1274,7 +1248,7 @@ void bts_unblock_queue(struct bss_sccp_connection_data *data)
 	/* now queue them again to send RSL establish and such */
 	while (!llist_empty(&head)) {
 		msg = msgb_dequeue(&head);
-		bts_queue_send(msg, (int) msg->smsh);
+		bts_queue_send(msg, msg->cb[LINK_ID_CB]);
 	}
 }
 
@@ -1283,9 +1257,10 @@ void gsm0808_send_assignment_failure(struct gsm_lchan *lchan, u_int8_t cause, u_
 	struct msgb *resp;
 
 	bsc_del_timer(&lchan->msc_data->T10);
-	resp = bssmap_create_assignment_failure(cause, rr_value);
+	bssmap_free_secondary(lchan->msc_data);
+	resp = gsm0808_create_assignment_failure(cause, rr_value);
 	if (!resp) {
-		DEBUGP(DMSC, "Allocation failure: %p\n", lchan_get_sccp(lchan));
+		LOGP(DMSC, LOGL_ERROR, "Allocation failure: %p\n", lchan_get_sccp(lchan));
 		return;
 	}
 
@@ -1299,7 +1274,7 @@ void gsm0808_send_assignment_compl(struct gsm_lchan *lchan, u_int8_t rr_cause)
 	bsc_del_timer(&lchan->msc_data->T10);
 	resp = bssmap_create_assignment_completed(lchan, rr_cause);
 	if (!resp) {
-		DEBUGP(DMSC, "Creating MSC response failed: %p\n", lchan_get_sccp(lchan));
+		LOGP(DMSC, LOGL_ERROR, "Creating MSC response failed: %p\n", lchan_get_sccp(lchan));
 		return;
 	}
 

openbsc/src/chan_alloc.c

@@ -25,6 +25,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
+#include <time.h>
 
 #include <openbsc/gsm_data.h>
 #include <openbsc/chan_alloc.h>
@@ -223,7 +224,8 @@ _lc_find_bts(struct gsm_bts *bts, enum gsm_phys_chan_config pchan)
 }
 
 /* Allocate a logical channel */
-struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type)
+struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type,
+			      int allow_bigger)
 {
 	struct gsm_lchan *lchan = NULL;
 	enum gsm_phys_chan_config first, second;
@@ -241,6 +243,19 @@ struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type)
 		lchan = _lc_find_bts(bts, first);
 		if (lchan == NULL)
 			lchan = _lc_find_bts(bts, second);
+
+		/* allow to assign bigger channels */
+		if (allow_bigger) {
+			if (lchan == NULL) {
+				lchan = _lc_find_bts(bts, GSM_PCHAN_TCH_H);
+				type = GSM_LCHAN_TCH_H;
+			}
+
+			if (lchan == NULL) {
+				lchan = _lc_find_bts(bts, GSM_PCHAN_TCH_F);
+				type = GSM_LCHAN_TCH_F;
+			}
+		}
 		break;
 	case GSM_LCHAN_TCH_F:
 		lchan = _lc_find_bts(bts, GSM_PCHAN_TCH_F);
@@ -273,6 +288,9 @@ struct gsm_lchan *lchan_alloc(struct gsm_bts *bts, enum gsm_chan_t type)
 		memset(&lchan->conn, 0, sizeof(lchan->conn));
 		lchan->conn.lchan = lchan;
 		lchan->conn.bts = lchan->ts->trx->bts;
+
+		/* set the alloc time */
+		gettimeofday(&lchan->alloc_time, NULL);
 	} else {
 		struct challoc_signal_data sig;
 		sig.bts = bts;
@@ -322,19 +340,56 @@ void lchan_free(struct gsm_lchan *lchan)
 	 * channel using it */
 }
 
-/* Consider releasing the channel now */
-int _lchan_release(struct gsm_lchan *lchan, u_int8_t release_reason)
+/*
+ * There was an error with the TRX and we need to forget
+ * any state so that a lchan can be allocated again after
+ * the trx is fully usable.
+ */
+void lchan_reset(struct gsm_lchan *lchan)
 {
-	if (lchan->conn.use_count > 0) {
-		DEBUGP(DRLL, "BUG: _lchan_release called without zero use_count.\n");
+	bsc_del_timer(&lchan->T3101);
+	bsc_del_timer(&lchan->T3111);
+	bsc_del_timer(&lchan->error_timer);
+
+	lchan->type = GSM_LCHAN_NONE;
+	lchan->state = LCHAN_S_NONE;
+}
+
+static int _lchan_release_next_sapi(struct gsm_lchan *lchan)
+{
+	int sapi;
+
+	for (sapi = 1; sapi < ARRAY_SIZE(lchan->sapis); ++sapi) {
+		u_int8_t link_id;
+		if (lchan->sapis[sapi] == LCHAN_SAPI_UNUSED)
+			continue;
+
+		link_id = sapi;
+		if (lchan->type == GSM_LCHAN_TCH_F || lchan->type == GSM_LCHAN_TCH_H)
+			link_id |= 0x40;
+		rsl_release_request(lchan, link_id, lchan->release_reason);
 		return 0;
 	}
 
+	return 1;
+}
+
+static void _lchan_handle_release(struct gsm_lchan *lchan)
+{
+	/* Ask for SAPI != 0 to be freed first and stop if we need to wait */
+	if (_lchan_release_next_sapi(lchan) == 0)
+		return;
+
 	/* Assume we have GSM04.08 running and send a release */
 	if (lchan->conn.subscr) {
 		++lchan->conn.use_count;
 		gsm48_send_rr_release(lchan);
 		--lchan->conn.use_count;
+
+		/* avoid reentrancy */
+		subscr_put(lchan->conn.subscr);
+		lchan->conn.subscr = NULL;
+		return;
 	}
 
 	/* spoofed? message */
@@ -342,8 +397,43 @@ int _lchan_release(struct gsm_lchan *lchan, u_int8_t release_reason)
 		LOGP(DRLL, LOGL_ERROR, "Channel count is negative: %d\n",
 			lchan->conn.use_count);
 
-	DEBUGP(DRLL, "%s Recycling Channel\n", gsm_lchan_name(lchan));
-	rsl_release_request(lchan, 0, release_reason);
+	rsl_release_request(lchan, 0, lchan->release_reason);
+	rsl_lchan_set_state(lchan, LCHAN_S_REL_REQ);
+}
+
+/* called from abis rsl */
+int rsl_lchan_rll_release(struct gsm_lchan *lchan, u_int8_t link_id)
+{
+	if (lchan->state != LCHAN_S_REL_REQ)
+		return -1;
+
+	if ((link_id & 0x7) != 0)
+		_lchan_handle_release(lchan);
+	return 0;
+}
+
+
+/*
+ * Start the channel release procedure now. We will start by shutting
+ * down SAPI!=0, then we will deactivate the SACCH and finish by releasing
+ * the last SAPI at which point the RSL code will send the channel release
+ * for us. We should guard the whole shutdown by T3109 or similiar and then
+ * update the fixme inside gsm_04_08_utils.c
+ * When we request to release the RLL and we don't get an answer within T200
+ * the BTS will send us an Error indication which we will handle by closing
+ * the channel and be done.
+ */
+int _lchan_release(struct gsm_lchan *lchan, u_int8_t release_reason)
+{
+	if (lchan->conn.use_count > 0) {
+		LOGP(DRLL, LOGL_ERROR, "BUG: _lchan_release called without zero use_count.\n");
+		return 0;
+	}
+
+	LOGP(DRLL, LOGL_NOTICE, "%s Recycling Channel.\n", gsm_lchan_name(lchan));
+	rsl_lchan_set_state(lchan, LCHAN_S_REL_REQ);
+	lchan->release_reason = release_reason;
+	_lchan_handle_release(lchan);
 	return 1;
 }
 

openbsc/src/e1_input.c

@@ -303,6 +303,10 @@ int e1inp_ts_config(struct e1inp_ts *ts, struct e1inp_line *line,
 
 	switch (type) {
 	case E1INP_TS_TYPE_SIGN:
+		if (line->driver)
+			ts->sign.delay = line->driver->default_delay;
+		else
+			ts->sign.delay = 100000;
 		INIT_LLIST_HEAD(&ts->sign.sign_links);
 		break;
 	case E1INP_TS_TYPE_TRAU:
@@ -420,7 +424,17 @@ e1inp_sign_link_create(struct e1inp_ts *ts, enum e1inp_sign_type type,
 
 void e1inp_sign_link_destroy(struct e1inp_sign_link *link)
 {
+	struct msgb *msg;
+
 	llist_del(&link->list);
+	while (!llist_empty(&link->tx_list)) {
+		msg = msgb_dequeue(&link->tx_list);
+		msgb_free(msg);
+	}
+
+	if (link->ts->type == E1INP_TS_TYPE_SIGN)
+		bsc_del_timer(&link->ts->sign.tx_timer);
+
 	talloc_free(link);
 }
 

openbsc/src/gsm_04_08.c

@@ -175,24 +175,24 @@ int gsm0408_loc_upd_rej(struct gsm_lchan *lchan, u_int8_t cause)
 {
 	struct gsm_subscriber_connection *conn;
 	struct gsm_bts *bts = lchan->ts->trx->bts;
-	struct msgb *msg = gsm48_msgb_alloc();
-	struct gsm48_hdr *gh;
+	struct msgb *msg;
+
+	counter_inc(bts->network->stats.loc_upd_resp.reject);
+
+	msg = gsm48_create_loc_upd_rej(cause);
+	if (!msg) {
+		LOGP(DMM, LOGL_ERROR, "Failed to create msg for LOCATION UPDATING REJECT.\n");
+		return -1;
+	}
 	
 	msg->lchan = lchan;
 	conn = &lchan->conn;
 
-	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
-	gh->proto_discr = GSM48_PDISC_MM;
-	gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT;
-	gh->data[0] = cause;
-
 	LOGP(DMM, LOGL_INFO, "Subscriber %s: LOCATION UPDATING REJECT "
 	     "LAC=%u BTS=%u\n", conn->subscr ?
 	     			subscr_name(conn->subscr) : "unknown",
 	     lchan->ts->trx->bts->location_area_code, lchan->ts->trx->bts->nr);
 
-	counter_inc(bts->network->stats.loc_upd_resp.reject);
-	
 	return gsm48_sendmsg(msg, NULL);
 }
 
@@ -574,19 +574,17 @@ static int gsm48_tx_mm_serv_ack(struct gsm_lchan *lchan)
 static int gsm48_tx_mm_serv_rej(struct gsm_subscriber_connection *conn,
 				enum gsm48_reject_value value)
 {
-	struct msgb *msg = gsm48_msgb_alloc();
-	struct gsm48_hdr *gh;
+	struct msgb *msg;
 
-	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	msg = gsm48_create_mm_serv_rej(value);
+	if (!msg) {
+		LOGP(DMM, LOGL_ERROR, "Failed to allocate CM Service Reject.\n");
+		return -1;
+	}
 
+	DEBUGP(DMM, "-> CM SERVICE Reject cause: %d\n", value);
 	msg->lchan = conn->lchan;
 	use_subscr_con(conn);
-
-	gh->proto_discr = GSM48_PDISC_MM;
-	gh->msg_type = GSM48_MT_MM_CM_SERV_REJ;
-	gh->data[0] = value;
-	DEBUGP(DMM, "-> CM SERVICE Reject cause: %d\n", value);
-
 	return gsm48_sendmsg(msg, NULL);
 }
 
@@ -609,7 +607,7 @@ static int gsm48_rx_mm_serv_req(struct msgb *msg)
 	struct gsm48_hdr *gh = msgb_l3(msg);
 	struct gsm48_service_request *req =
 			(struct gsm48_service_request *)gh->data;
-	/* unfortunately in Phase1 the classmar2 length is variable */
+	/* unfortunately in Phase1 the classmark2 length is variable */
 	u_int8_t classmark2_len = gh->data[1];
 	u_int8_t *classmark2 = gh->data+2;
 	u_int8_t mi_len = *(classmark2 + classmark2_len);
@@ -779,13 +777,16 @@ static int gsm48_rx_rr_pag_resp(struct msgb *msg)
 {
 	struct gsm_bts *bts = msg->lchan->ts->trx->bts;
 	struct gsm48_hdr *gh = msgb_l3(msg);
+	struct gsm48_pag_resp *resp;
 	u_int8_t *classmark2_lv = gh->data + 1;
 	u_int8_t mi_type;
 	char mi_string[GSM48_MI_SIZE];
 	struct gsm_subscriber *subscr = NULL;
 	int rc = 0;
 
-	gsm48_paging_extract_mi(msg, mi_string, &mi_type);
+	resp = (struct gsm48_pag_resp *) &gh->data[0];
+	gsm48_paging_extract_mi(resp, msgb_l3len(msg) - sizeof(*gh),
+				mi_string, &mi_type);
 	DEBUGP(DRR, "PAGING RESPONSE: mi_type=0x%02x MI(%s)\n",
 		mi_type, mi_string);
 

openbsc/src/gsm_04_08_utils.c

@@ -285,16 +285,30 @@ int send_siemens_mrpci(struct gsm_lchan *lchan,
 	return rsl_siemens_mrpci(lchan, &mrpci);
 }
 
-int gsm48_paging_extract_mi(struct msgb *msg, char *mi_string, u_int8_t *mi_type)
+int gsm48_extract_mi(uint8_t *classmark2_lv, int length, char *mi_string, uint8_t *mi_type)
 {
-	struct gsm48_hdr *gh = msgb_l3(msg);
-	u_int8_t *classmark2_lv = gh->data + 1;
-	u_int8_t *mi_lv = gh->data + 2 + *classmark2_lv;
-	*mi_type = mi_lv[1] & GSM_MI_TYPE_MASK;
+	/* Check the size for the classmark */
+	if (length < 1 + *classmark2_lv)
+		return -1;
 
+	u_int8_t *mi_lv = classmark2_lv + *classmark2_lv + 1;
+	if (length < 2 + *classmark2_lv + mi_lv[0])
+		return -2;
+
+	*mi_type = mi_lv[1] & GSM_MI_TYPE_MASK;
 	return gsm48_mi_to_string(mi_string, GSM48_MI_SIZE, mi_lv+1, *mi_lv);
 }
 
+int gsm48_paging_extract_mi(struct gsm48_pag_resp *resp, int length,
+			    char *mi_string, u_int8_t *mi_type)
+{
+	static const uint32_t classmark_offset =
+		offsetof(struct gsm48_pag_resp, classmark2);
+	u_int8_t *classmark2_lv = (uint8_t *) &resp->classmark2;
+	return gsm48_extract_mi(classmark2_lv, length - classmark_offset,
+				mi_string, mi_type);
+}
+
 int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr)
 {
 	struct gsm_bts *bts = msg->lchan->ts->trx->bts;
@@ -321,7 +335,7 @@ int gsm48_handle_paging_resp(struct msgb *msg, struct gsm_subscriber *subscr)
 	sig_data.bts	= msg->lchan->ts->trx->bts;
 	sig_data.lchan	= msg->lchan;
 
-	bts->network->stats.paging.completed++;
+	counter_inc(bts->network->stats.paging.completed);
 
 	dispatch_signal(SS_PAGING, S_PAGING_SUCCEEDED, &sig_data);
 
@@ -615,3 +629,36 @@ int gsm48_parse_meas_rep(struct gsm_meas_rep *rep, struct msgb *msg)
 
 	return 0;
 }
+
+struct msgb *gsm48_create_mm_serv_rej(enum gsm48_reject_value value)
+{
+	struct msgb *msg;
+	struct gsm48_hdr *gh;
+
+	msg = gsm48_msgb_alloc();
+	if (!msg)
+		return NULL;
+
+	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	gh->proto_discr = GSM48_PDISC_MM;
+	gh->msg_type = GSM48_MT_MM_CM_SERV_REJ;
+	gh->data[0] = value;
+
+	return msg;
+}
+
+struct msgb *gsm48_create_loc_upd_rej(uint8_t cause)
+{
+	struct gsm48_hdr *gh;
+	struct msgb *msg;
+
+	msg = gsm48_msgb_alloc();
+	if (!msg)
+		return NULL;
+
+	gh = (struct gsm48_hdr *) msgb_put(msg, sizeof(*gh) + 1);
+	gh->proto_discr = GSM48_PDISC_MM;
+	gh->msg_type = GSM48_MT_MM_LOC_UPD_REJECT;
+	gh->data[0] = cause;
+	return msg;
+}

openbsc/src/gsm_04_11.c

@@ -675,7 +675,7 @@ static int gsm411_rx_rp_ud(struct msgb *msg, struct gsm_trans *trans,
 				     GSM411_RP_CAUSE_INV_MAND_INF);
 		return -EIO;
 	}
-	msg->smsh = tpdu;
+	msg->l4h = tpdu;
 
 	DEBUGP(DSMS, "DST(%u,%s)\n", dst_len, hexdump(dst, dst_len));
 

openbsc/src/gsm_04_80.c

@@ -257,7 +257,6 @@ int gsm0480_send_ussd_response(const struct msgb *in_msg, const char *response_t
 	if (((strlen(response_text) * 7) % 8) != 0)
 		response_len += 1;
 
-	msg->bts_link = in_msg->bts_link;
 	msg->lchan = in_msg->lchan;
 
 	/* First put the payload text into the message */
@@ -304,7 +303,6 @@ int gsm0480_send_ussd_reject(const struct msgb *in_msg,
 	struct msgb *msg = gsm48_msgb_alloc();
 	struct gsm48_hdr *gh;
 
-	msg->bts_link = in_msg->bts_link;
 	msg->lchan = in_msg->lchan;
 
 	/* First insert the problem code */

openbsc/src/gsm_data.c

@@ -88,6 +88,7 @@ static const struct value_string lchan_s_names[] = {
 	{ LCHAN_S_ACTIVE,	"ACTIVE" },
 	{ LCHAN_S_INACTIVE,	"INACTIVE" },
 	{ LCHAN_S_REL_REQ,	"RELEASE REQUESTED" },
+	{ LCHAN_S_REL_ERR,	"RELEASE DUE ERROR" },
 	{ 0,			NULL }
 };
 
@@ -171,6 +172,10 @@ struct gsm_bts_trx *gsm_bts_trx_alloc(struct gsm_bts *bts)
 	return trx;
 }
 
+static const uint8_t bts_nse_timer_default[] = { 3, 3, 3, 3, 3, 3, 10 };
+static const uint8_t bts_cell_timer_default[] =
+				{ 3, 3, 3, 3, 3, 10, 3, 10, 3, 10, 3 };
+
 struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 			      u_int8_t tsc, u_int8_t bsic)
 {
@@ -212,6 +217,10 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 		bts->gprs.nsvc[i].bts = bts;
 		bts->gprs.nsvc[i].id = i;
 	}
+	memcpy(&bts->gprs.nse.timer, bts_nse_timer_default,
+		sizeof(bts->gprs.nse.timer));
+	memcpy(&bts->gprs.cell.timer, bts_cell_timer_default,
+		sizeof(bts->gprs.cell.timer));
 
 	/* create our primary TRX */
 	bts->c0 = gsm_bts_trx_alloc(bts);
@@ -221,6 +230,10 @@ struct gsm_bts *gsm_bts_alloc(struct gsm_network *net, enum gsm_bts_type type,
 	}
 	bts->c0->ts[0].pchan = GSM_PCHAN_CCCH_SDCCH4;
 
+	bts->paging.free_chans_need = -1;
+	bts->rach_b_thresh = -1;
+	bts->rach_ldavg_slots = -1;
+
 	llist_add_tail(&bts->list, &net->bts_list);
 
 	return bts;
@@ -280,6 +293,10 @@ struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_c
 	net->stats.call.dialled = counter_alloc("net.call.dialled");
 	net->stats.call.alerted = counter_alloc("net.call.alerted");
 	net->stats.call.connected = counter_alloc("net.call.connected");
+	net->stats.chan.rf_fail = counter_alloc("net.chan.rf_fail");
+	net->stats.chan.rll_err = counter_alloc("net.chan.rll_err");
+	net->stats.bts.oml_fail = counter_alloc("net.bts.oml_fail");
+	net->stats.bts.rsl_fail = counter_alloc("net.bts.rsl_fail");
 
 	net->mncc_recv = mncc_recv;
 
@@ -289,6 +306,11 @@ struct gsm_network *gsm_network_init(u_int16_t country_code, u_int16_t network_c
 	net->core_network_code = -1;
 	net->rtp_base_port = 4000;
 
+	net->msc_ip = talloc_strdup(net, "127.0.0.1");
+	net->msc_port = 5000;
+	net->ping_timeout = 20;
+	net->pong_timeout = 5;
+
 	return net;
 }
 
@@ -442,33 +464,6 @@ const char *gsm_auth_policy_name(enum gsm_auth_policy policy)
 	return get_value_string(auth_policy_names, policy);
 }
 
-/* this should not be here but in gsm_04_08... but that creates
-   in turn a dependency nightmare (abis_nm depending on 04_08, ...) */
-static int gsm48_construct_ra(u_int8_t *buf, const struct gprs_ra_id *raid)
-{
-	u_int16_t mcc = raid->mcc;
-	u_int16_t mnc = raid->mnc;
-
-	buf[0] = ((mcc / 100) % 10) | (((mcc / 10) % 10) << 4);
-	buf[1] = (mcc % 10);
-
-	/* I wonder who came up with the stupidity of encoding the MNC
-	 * differently depending on how many digits its decimal number has! */
-	if (mnc < 100) {
-		buf[1] |= 0xf0;
-		buf[2] = ((mnc / 10) % 10) | ((mnc % 10) << 4);
-	} else {
-		buf[1] |= (mnc % 10) << 4;
-		buf[2] = ((mnc / 100) % 10) | (((mcc / 10) % 10) << 4);
-	}
-
-	*(u_int16_t *)(buf+3) = htons(raid->lac);
-
-	buf[5] = raid->rac;
-
-	return 6;
-}
-
 void gprs_ra_id_by_bts(struct gprs_ra_id *raid, struct gsm_bts *bts)
 {
 	raid->mcc = bts->network->country_code;
@@ -504,6 +499,23 @@ const char *rrlp_mode_name(enum rrlp_mode mode)
 	return get_value_string(rrlp_mode_names, mode);
 }
 
+static const struct value_string bts_gprs_mode_names[] = {
+	{ BTS_GPRS_NONE,	"none" },
+	{ BTS_GPRS_GPRS,	"gprs" },
+	{ BTS_GPRS_EGPRS,	"egprs" },
+	{ 0,			NULL }
+};
+
+enum bts_gprs_mode bts_gprs_mode_parse(const char *arg)
+{
+	return get_string_value(bts_gprs_mode_names, arg);
+}
+
+const char *bts_gprs_mode_name(enum bts_gprs_mode mode)
+{
+	return get_value_string(bts_gprs_mode_names, mode);
+}
+
 struct gsm_meas_rep *lchan_next_meas_rep(struct gsm_lchan *lchan)
 {
 	struct gsm_meas_rep *meas_rep;

openbsc/src/handover_logic.c

@@ -99,7 +99,7 @@ int bsc_handover_start(struct gsm_lchan *old_lchan, struct gsm_bts *bts)
 
 	counter_inc(bts->network->stats.handover.attempted);
 
-	new_lchan = lchan_alloc(bts, old_lchan->type);
+	new_lchan = lchan_alloc(bts, old_lchan->type, 0);
 	if (!new_lchan) {
 		LOGP(DHO, LOGL_NOTICE, "No free channel\n");
 		counter_inc(bts->network->stats.handover.no_channel);
@@ -134,6 +134,7 @@ int bsc_handover_start(struct gsm_lchan *old_lchan, struct gsm_bts *bts)
 		return rc;
 	}
 
+	rsl_lchan_set_state(new_lchan, LCHAN_S_ACT_REQ);
 	llist_add(&ho->list, &bsc_handovers);
 	/* we continue in the SS_LCHAN handler / ho_chan_activ_ack */
 
@@ -229,7 +230,7 @@ static int ho_gsm48_ho_compl(struct gsm_lchan *new_lchan)
 	/* update lchan pointer of transaction */
 	trans_lchan_change(&ho->old_lchan->conn, &new_lchan->conn);
 
-	ho->old_lchan->state = LCHAN_S_INACTIVE;
+	rsl_lchan_set_state(ho->old_lchan, LCHAN_S_INACTIVE);
 
 	/* do something to re-route the actual speech frames ! */
 

openbsc/src/input/ipaccess.c

@@ -1,6 +1,8 @@
 /* OpenBSC Abis input driver for ip.access */
 
 /* (C) 2009 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Holger Hans Peter Freyther
+ * (C) 2010 by On-Waves
  *
  * All Rights Reserved
  *
@@ -234,6 +236,8 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 		}
 		DEBUGP(DINP, "Identified BTS %u/%u/%u\n", site_id, bts_id, trx_id);
 		if (bfd->priv_nr == PRIV_OML) {
+			/* drop any old oml connection */
+			ipaccess_drop_oml(bts);
 			bts->oml_link = e1inp_sign_link_create(&line->ts[PRIV_OML - 1],
 						  E1INP_SIGN_OML, bts->c0,
 						  bts->oml_tei, 0);
@@ -241,7 +245,18 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 			struct e1inp_ts *e1i_ts;
 			struct bsc_fd *newbfd;
 			struct gsm_bts_trx *trx = gsm_bts_trx_num(bts, trx_id);
-			
+
+			/* drop any old rsl connection */
+			ipaccess_drop_rsl(trx);
+
+			if (!bts->oml_link) {
+				bsc_unregister_fd(bfd);
+				close(bfd->fd);
+				bfd->fd = -1;
+				talloc_free(bfd);
+				return 0;
+			}
+
 			bfd->data = line = bts->oml_link->ts->line;
 			e1i_ts = &line->ts[PRIV_RSL + trx_id - 1];
 			newbfd = &e1i_ts->driver.ipaccess.fd;
@@ -250,20 +265,15 @@ static int ipaccess_rcvmsg(struct e1inp_line *line, struct msgb *msg,
 			trx->rsl_link = e1inp_sign_link_create(e1i_ts,
 							E1INP_SIGN_RSL, trx,
 							trx->rsl_tei, 0);
-
-			if (newbfd->fd >= 0) {
-				LOGP(DINP, LOGL_ERROR, "BTS is still registered. Closing old connection.\n");
-				bsc_unregister_fd(newbfd);
-				close(newbfd->fd);
-				newbfd->fd = -1;
-			}
+			trx->rsl_link->ts->sign.delay = 0;
 
 			/* get rid of our old temporary bfd */
 			memcpy(newbfd, bfd, sizeof(*newbfd));
 			newbfd->priv_nr = PRIV_RSL + trx_id;
 			bsc_unregister_fd(bfd);
-			bsc_register_fd(newbfd);
+			bfd->fd = -1;
 			talloc_free(bfd);
+			bsc_register_fd(newbfd);
 		}
 		break;
 	}
@@ -328,6 +338,103 @@ struct msgb *ipaccess_read_msg(struct bsc_fd *bfd, int *error)
 	return msg;
 }
 
+int ipaccess_drop_oml(struct gsm_bts *bts)
+{
+	struct gsm_bts_trx *trx;
+	struct e1inp_ts *ts;
+	struct e1inp_line *line;
+	struct bsc_fd *bfd;
+
+	if (!bts || !bts->oml_link)
+		return -1;
+
+	/* send OML down */
+	ts = bts->oml_link->ts;
+	line = ts->line;
+	e1inp_event(ts, EVT_E1_TEI_DN, bts->oml_link->tei, bts->oml_link->sapi);
+
+	bfd = &ts->driver.ipaccess.fd;
+	bsc_unregister_fd(bfd);
+	close(bfd->fd);
+	bfd->fd = -1;
+
+	/* clean up OML and RSL */
+	e1inp_sign_link_destroy(bts->oml_link);
+	bts->oml_link = NULL;
+	bts->ip_access.flags = 0;
+
+	/* drop all RSL connections too */
+	llist_for_each_entry(trx, &bts->trx_list, list)
+		ipaccess_drop_rsl(trx);
+
+	/* kill the E1 line now... as we have no one left to use it */
+	talloc_free(line);
+
+	return -1;
+}
+
+static int ipaccess_drop(struct e1inp_ts *ts, struct bsc_fd *bfd)
+{
+	struct e1inp_sign_link *link;
+	int bts_nr;
+
+	if (!ts) {
+		/*
+		 * If we don't have a TS this means that this is a RSL
+		 * connection but we are not past the authentication
+		 * handling yet. So we can safely delete this bfd and
+		 * wait for a reconnect.
+		 */
+		bsc_unregister_fd(bfd);
+		close(bfd->fd);
+		bfd->fd = -1;
+		talloc_free(bfd);
+		return -1;
+	}
+
+	/* attempt to find a signalling link */
+	if (ts->type == E1INP_TS_TYPE_SIGN) {
+		llist_for_each_entry(link, &ts->sign.sign_links, list) {
+			bts_nr = link->trx->bts->bts_nr;
+			/* we have issues just reconnecting RLS so we drop OML */
+			ipaccess_drop_oml(link->trx->bts);
+			return bts_nr;
+		}
+	}
+
+	/* error case */
+	LOGP(DINP, LOGL_ERROR, "Failed to find a signalling link for ts: %p\n", ts);
+	bsc_unregister_fd(bfd);
+	close(bfd->fd);
+	bfd->fd = -1;
+	return -1;
+}
+
+int ipaccess_drop_rsl(struct gsm_bts_trx *trx)
+{
+	struct bsc_fd *bfd;
+	struct e1inp_ts *ts;
+
+	if (!trx || !trx->rsl_link)
+		return -1;
+
+	/* send RSL down */
+	ts = trx->rsl_link->ts;
+	e1inp_event(ts, EVT_E1_TEI_DN, trx->rsl_link->tei, trx->rsl_link->sapi);
+
+	/* close the socket */
+	bfd = &ts->driver.ipaccess.fd;
+	bsc_unregister_fd(bfd);
+	close(bfd->fd);
+	bfd->fd = -1;
+
+	/* destroy */
+	e1inp_sign_link_destroy(trx->rsl_link);
+	trx->rsl_link = NULL;
+
+	return -1;
+}
+
 static int handle_ts1_read(struct bsc_fd *bfd)
 {
 	struct e1inp_line *line = bfd->data;
@@ -341,18 +448,12 @@ static int handle_ts1_read(struct bsc_fd *bfd)
 	msg = ipaccess_read_msg(bfd, &error);
 	if (!msg) {
 		if (error == 0) {
-			link = e1inp_lookup_sign_link(e1i_ts, IPAC_PROTO_OML, 0);
-			if (link) {
-				link->trx->bts->ip_access.flags = 0;
+			int ret = ipaccess_drop(e1i_ts, bfd);
+			if (ret >= 0)
 				LOGP(DINP, LOGL_NOTICE, "BTS %u disappeared, dead socket\n",
-					link->trx->bts->nr);
-			} else
+					ret);
+			else
 				LOGP(DINP, LOGL_NOTICE, "unknown BTS disappeared, dead socket\n");
-			e1inp_event(e1i_ts, EVT_E1_TEI_DN, 0, IPAC_PROTO_RSL);
-			e1inp_event(e1i_ts, EVT_E1_TEI_DN, 0, IPAC_PROTO_OML);
-			bsc_unregister_fd(bfd);
-			close(bfd->fd);
-			bfd->fd = -1;
 		}
 		return error;
 	}
@@ -362,13 +463,8 @@ static int handle_ts1_read(struct bsc_fd *bfd)
 	hh = (struct ipaccess_head *) msg->data;
 	if (hh->proto == IPAC_PROTO_IPACCESS) {
 		ret = ipaccess_rcvmsg(line, msg, bfd);
-		if (ret < 0) {
-			e1inp_event(e1i_ts, EVT_E1_TEI_DN, 0, IPAC_PROTO_RSL);
-			e1inp_event(e1i_ts, EVT_E1_TEI_DN, 0, IPAC_PROTO_OML);
-			bsc_unregister_fd(bfd);
-			close(bfd->fd);
-			bfd->fd = -1;
-		}
+		if (ret < 0)
+			ipaccess_drop(e1i_ts, bfd);
 		msgb_free(msg);
 		return ret;
 	}
@@ -475,7 +571,9 @@ static int handle_ts1_write(struct bsc_fd *bfd)
 	/* set tx delay timer for next event */
 	e1i_ts->sign.tx_timer.cb = timeout_ts1_write;
 	e1i_ts->sign.tx_timer.data = e1i_ts;
-	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, 100);
+
+	/* Reducing this might break the nanoBTS 900 init. */
+	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, e1i_ts->sign.delay);
 
 	return ret;
 }
@@ -509,6 +607,7 @@ static int ipaccess_fd_cb(struct bsc_fd *bfd, unsigned int what)
 struct e1inp_driver ipaccess_driver = {
 	.name = "ip.access",
 	.want_write = ts_want_write,
+	.default_delay = 100000,
 };
 
 /* callback of the OML listening filedescriptor */

openbsc/src/input/misdn.c

@@ -235,7 +235,7 @@ static int handle_ts1_write(struct bsc_fd *bfd)
 	/* set tx delay timer for next event */
 	e1i_ts->sign.tx_timer.cb = timeout_ts1_write;
 	e1i_ts->sign.tx_timer.data = e1i_ts;
-	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, 50000);
+	bsc_schedule_timer(&e1i_ts->sign.tx_timer, 0, e1i_ts->sign.delay);
 
 	return ret;
 }
@@ -375,6 +375,7 @@ static int activate_bchan(struct e1inp_line *line, int ts, int act)
 struct e1inp_driver misdn_driver = {
 	.name = "mISDNuser",
 	.want_write = ts_want_write,
+	.default_delay = 50000,
 };
 
 static int mi_e1_setup(struct e1inp_line *line, int release_l2)

openbsc/src/ipaccess/ipaccess-config.c

@@ -1,8 +1,8 @@
 /* ip.access nanoBTS configuration tool */
 
 /* (C) 2009 by Harald Welte <laforge@gnumonks.org>
- * (C) 2009 by Holger Hans Peter Freyther
- * (C) 2009 by On Waves
+ * (C) 2009,2010 by Holger Hans Peter Freyther
+ * (C) 2009,2010 by On Waves
  * All Rights Reserved
  *
  * This program is free software; you can redistribute it and/or modify
@@ -59,6 +59,7 @@ static int sw_load_state = 0;
 static int oml_state = 0;
 static int dump_files = 0;
 static char *firmware_analysis = NULL;
+static int found_trx = 0;
 
 struct sw_load {
 	u_int8_t file_id[255];
@@ -91,23 +92,23 @@ static int ipacc_msg_nack(u_int8_t mt)
 	return 0;
 }
 
-static int ipacc_msg_ack(u_int8_t mt, struct gsm_bts *bts)
+static void check_restart_or_exit(struct gsm_bts_trx *trx)
+{
+	if (restart) {
+		abis_nm_ipaccess_restart(trx);
+	} else {
+		exit(0);
+	}
+}
+
+static int ipacc_msg_ack(u_int8_t mt, struct gsm_bts_trx *trx)
 {
 	if (sw_load_state == 1) {
 		fprintf(stderr, "The new software is activaed.\n");
-
-		if (restart) {
-			abis_nm_ipaccess_restart(bts);
-		} else {
-			exit(0);
-		}
+		check_restart_or_exit(trx);
 	} else if (oml_state == 1) {
 		fprintf(stderr, "Set the primary OML IP.\n");
-		if (restart) {
-			abis_nm_ipaccess_restart(bts);
-		} else {
-			exit(0);
-		}
+		check_restart_or_exit(trx);
 	}
 
 	return 0;
@@ -202,7 +203,7 @@ static int nm_sig_cb(unsigned int subsys, unsigned int signal,
 		return ipacc_msg_nack(ipacc_data->msg_type);
 	case S_NM_IPACC_ACK:
 		ipacc_data = signal_data;
-		return ipacc_msg_ack(ipacc_data->msg_type, ipacc_data->bts);
+		return ipacc_msg_ack(ipacc_data->msg_type, ipacc_data->trx);
 	case S_NM_TEST_REP:
 		return test_rep(signal_data);
 	case S_NM_IPACC_RESTART_ACK:
@@ -227,12 +228,12 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 		       void *data, void *param)
 {
 	struct msgb *msg;
-	struct gsm_bts *bts;
+	struct gsm_bts_trx *trx;
 
 	if (hook != GSM_HOOK_NM_SWLOAD)
 		return 0;
 
-	bts = (struct gsm_bts *) data;
+	trx = (struct gsm_bts_trx *) data;
 
 	switch (event) {
 	case NM_MT_LOAD_INIT_ACK:
@@ -271,7 +272,7 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 		msg->l2h[1] = msgb_l3len(msg) >> 8;
 		msg->l2h[2] = msgb_l3len(msg) & 0xff;
 		printf("Foo l2h: %p l3h: %p... length l2: %u  l3: %u\n", msg->l2h, msg->l3h, msgb_l2len(msg), msgb_l3len(msg));
-		abis_nm_ipaccess_set_nvattr(bts->c0, msg->l2h, msgb_l2len(msg));
+		abis_nm_ipaccess_set_nvattr(trx, msg->l2h, msgb_l2len(msg));
 		msgb_free(msg);
 		break;
 	case NM_MT_LOAD_END_NACK:
@@ -285,7 +286,7 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 	case NM_MT_ACTIVATE_SW_ACK:
 		break;
 	case NM_MT_LOAD_SEG_ACK:
-		percent = abis_nm_software_load_status(bts);
+		percent = abis_nm_software_load_status(trx->bts);
 		if (percent > percent_old)
 			printf("Software Download Progress: %d%%\n", percent);
 		percent_old = percent;
@@ -298,13 +299,13 @@ static int swload_cbfn(unsigned int hook, unsigned int event, struct msgb *_msg,
 	return 0;
 }
 
-static void bootstrap_om(struct gsm_bts *bts)
+static void bootstrap_om(struct gsm_bts_trx *trx)
 {
 	int len;
 	static u_int8_t buf[1024];
 	u_int8_t *cur = buf;
 
-	printf("OML link established\n");
+	printf("OML link established using TRX %d\n", trx->nr);
 
 	if (unit_id) {
 		len = strlen(unit_id);
@@ -316,7 +317,7 @@ static void bootstrap_om(struct gsm_bts *bts)
 		memcpy(buf+3, unit_id, len);
 		buf[3+len] = 0;
 		printf("setting Unit ID to '%s'\n", unit_id);
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len+1);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len+1);
 	}
 	if (prim_oml_ip) {
 		struct in_addr ia;
@@ -340,7 +341,7 @@ static void bootstrap_om(struct gsm_bts *bts)
 		*cur++ = 0;
 		printf("setting primary OML link IP to '%s'\n", inet_ntoa(ia));
 		oml_state = 1;
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len);
 	}
 	if (nv_mask) {
 		len = 4;
@@ -354,12 +355,12 @@ static void bootstrap_om(struct gsm_bts *bts)
 		*cur++ = nv_mask >> 8;
 		printf("setting NV Flags/Mask to 0x%04x/0x%04x\n",
 			nv_flags, nv_mask);
-		abis_nm_ipaccess_set_nvattr(bts->c0, buf, 3+len);
+		abis_nm_ipaccess_set_nvattr(trx, buf, 3+len);
 	}
 
 	if (restart && !prim_oml_ip && !software) {
 		printf("restarting BTS\n");
-		abis_nm_ipaccess_restart(bts);
+		abis_nm_ipaccess_restart(trx);
 	}
 
 }
@@ -370,7 +371,6 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 	case EVT_E1_TEI_UP:
 		switch (type) {
 		case E1INP_SIGN_OML:
-			bootstrap_om(trx->bts);
 			break;
 		case E1INP_SIGN_RSL:
 			/* FIXME */
@@ -389,22 +389,29 @@ void input_event(int event, enum e1inp_sign_type type, struct gsm_bts_trx *trx)
 }
 
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_inst)
 {
-	if (evt == EVT_STATECHG_OPER &&
+	if (obj_class == NM_OC_BASEB_TRANSC) {
+		if (!found_trx && obj_inst->trx_nr != 0xff) {
+			struct gsm_bts_trx *trx = container_of(obj, struct gsm_bts_trx, bb_transc);
+			bootstrap_om(trx);
+			found_trx = 1;
+		}
+	} else if (evt == EVT_STATECHG_OPER &&
 	    obj_class == NM_OC_RADIO_CARRIER &&
 	    new_state->availability == 3) {
 		struct gsm_bts_trx *trx = obj;
 
 		if (net_listen_testnr) {
 			u_int8_t phys_config[] = { 0x02, 0x0a, 0x00, 0x01, 0x02 };
-			abis_nm_perform_test(trx->bts, 2, 0, 0, 0xff,
+			abis_nm_perform_test(trx->bts, 2, 0, trx->nr, 0xff,
 					     net_listen_testnr, 1,
 					     phys_config, sizeof(phys_config));
 		} else if (software) {
 			int rc;
 			printf("Attempting software upload with '%s'\n", software);
-			rc = abis_nm_software_load(trx->bts, software, 19, 0, swload_cbfn, trx->bts);
+			rc = abis_nm_software_load(trx->bts, trx->nr, software, 19, 0, swload_cbfn, trx);
 			if (rc < 0) {
 				fprintf(stderr, "Failed to start software load\n");
 				exit(-3);
@@ -639,6 +646,7 @@ int main(int argc, char **argv)
 			{ "software", 1, 0, 'd' },
 			{ "firmware", 1, 0, 'f' },
 			{ "write-firmware", 0, 0, 'w' },
+			{ 0, 0, 0, 0 },
 		};
 
 		c = getopt_long(argc, argv, "u:o:rn:l:hs:d:f:w", long_options,
@@ -724,6 +732,8 @@ int main(int argc, char **argv)
 		exit(1);
 	}
 	
+	bts->oml_link->ts->sign.delay = 10;
+	bts->c0->rsl_link->ts->sign.delay = 10;
 	while (1) {
 		rc = bsc_select_main(0);
 		if (rc < 0)

openbsc/src/mgcp/mgcp_main.c

@@ -128,6 +128,15 @@ static int mgcp_rsip_cb(struct mgcp_config *cfg)
 	return 0;
 }
 
+static int mgcp_change_cb(struct mgcp_config *cfg, int endpoint, int state, int local_rtp)
+{
+	if (state != MGCP_ENDP_MDCX)
+		return 0;
+
+	mgcp_send_dummy(&cfg->endpoints[endpoint]);
+	return 0;
+}
+
 static int read_call_agent(struct bsc_fd *fd, unsigned int what)
 {
 	struct sockaddr_in addr;
@@ -200,6 +209,7 @@ int main(int argc, char** argv)
 
 	/* set some callbacks */
 	cfg->reset_cb = mgcp_rsip_cb;
+	cfg->change_cb = mgcp_change_cb;
 
         /* we need to bind a socket */
         if (rc == 0) {

openbsc/src/mgcp/mgcp_network.c

@@ -23,14 +23,15 @@
  */
 
 #include <string.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <endian.h>
+#include <errno.h>
 
 #include <sys/socket.h>
 #include <arpa/inet.h>
 
 #include <osmocore/msgb.h>
-#include <osmocore/talloc.h>
 #include <osmocore/select.h>
 
 #include <openbsc/debug.h>
@@ -72,6 +73,8 @@ enum {
 	PROTO_RTCP,
 };
 
+#define DUMMY_LOAD 0x23
+
 
 static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
 {
@@ -83,6 +86,14 @@ static int udp_send(int fd, struct in_addr *addr, int port, char *buf, int len)
 	return sendto(fd, buf, len, 0, (struct sockaddr *)&out, sizeof(out));
 }
 
+int mgcp_send_dummy(struct mgcp_endpoint *endp)
+{
+	static char buf[] = { DUMMY_LOAD };
+
+	return udp_send(endp->local_rtp.fd, &endp->remote,
+			endp->net_rtp, buf, 1);
+}
+
 static void patch_payload(int payload, char *data, int len)
 {
 	struct rtp_hdr *rtp_hdr;
@@ -122,8 +133,8 @@ static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
 	rc = recvfrom(fd->fd, &buf, sizeof(buf), 0,
 			    (struct sockaddr *) &addr, &slen);
 	if (rc < 0) {
-		LOGP(DMGCP, LOGL_ERROR, "Failed to receive message on: 0x%x\n",
-			ENDPOINT_NUMBER(endp));
+		LOGP(DMGCP, LOGL_ERROR, "Failed to receive message on: 0x%x errno: %d/%s\n",
+			ENDPOINT_NUMBER(endp), errno, strerror(errno));
 		return -1;
 	}
 
@@ -142,7 +153,7 @@ static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
 	 */
 	#warning "Slight spec violation. With connection mode recvonly we should attempt to forward."
 	dest = memcmp(&addr.sin_addr, &endp->remote, sizeof(addr.sin_addr)) == 0 &&
-                    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
+		    (endp->net_rtp == addr.sin_port || endp->net_rtcp == addr.sin_port)
 			? DEST_BTS : DEST_NETWORK;
 	proto = fd == &endp->local_rtp ? PROTO_RTP : PROTO_RTCP;
 
@@ -159,22 +170,39 @@ static int rtp_data_cb(struct bsc_fd *fd, unsigned int what)
 			}
 
 			endp->bts = addr.sin_addr;
-			LOGP(DMGCP, LOGL_NOTICE, "Found BTS for endpoint: 0x%x on port: %d/%d\n",
-				ENDPOINT_NUMBER(endp), ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp));
+			LOGP(DMGCP, LOGL_NOTICE, "Found BTS for endpoint: 0x%x on port: %d/%d of %s\n",
+				ENDPOINT_NUMBER(endp), ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp),
+				inet_ntoa(addr.sin_addr));
+
 		}
 	}
 
-	/* dispatch */
+	/* throw away the dummy message */
+	if (rc == 1 && buf[0] == DUMMY_LOAD) {
+		LOGP(DMGCP, LOGL_NOTICE, "Filtered dummy on 0x%x\n",
+			ENDPOINT_NUMBER(endp));
+		return 0;
+	}
+
+	/* do this before the loop handling */
+	if (dest == DEST_NETWORK)
+		++endp->in_bts;
+	else
+		++endp->in_remote;
+
+	/* For loop toggle the destination and then dispatch. */
 	if (cfg->audio_loop)
 		dest = !dest;
 
 	if (dest == DEST_NETWORK) {
-		patch_payload(endp->net_payload_type, buf, rc);
+		if (proto == PROTO_RTP)
+			patch_payload(endp->net_payload_type, buf, rc);
 		return udp_send(fd->fd, &endp->remote,
 			     proto == PROTO_RTP ? endp->net_rtp : endp->net_rtcp,
 			     buf, rc);
 	} else {
-		patch_payload(endp->bts_payload_type, buf, rc);
+		if (proto == PROTO_RTP)
+			patch_payload(endp->bts_payload_type, buf, rc);
 		return udp_send(fd->fd, &endp->bts,
 			     proto == PROTO_RTP ? endp->bts_rtp : endp->bts_rtcp,
 			     buf, rc);
@@ -205,6 +233,14 @@ static int create_bind(const char *source_addr, struct bsc_fd *fd, int port)
 	return 0;
 }
 
+static int set_ip_tos(int fd, int tos)
+{
+	int ret;
+	ret = setsockopt(fd, IPPROTO_IP, IP_TOS,
+			 &tos, sizeof(tos));
+	return ret != 0;
+}
+
 static int bind_rtp(struct mgcp_endpoint *endp)
 {
 	struct mgcp_config *cfg = endp->cfg;
@@ -221,6 +257,9 @@ static int bind_rtp(struct mgcp_endpoint *endp)
 		goto cleanup1;
 	}
 
+	set_ip_tos(endp->local_rtp.fd, cfg->endp_tos);
+	set_ip_tos(endp->local_rtcp.fd, cfg->endp_tos);
+
 	endp->local_rtp.cb = rtp_data_cb;
 	endp->local_rtp.data = endp;
 	endp->local_rtp.when = BSC_FD_READ;

openbsc/src/mgcp/mgcp_protocol.c

@@ -135,7 +135,7 @@ static struct msgb *mgcp_msgb_alloc(void)
 	struct msgb *msg;
 	msg = msgb_alloc_headroom(4096, 128, "MGCP msg");
 	if (!msg)
-	    LOGP(DMGCP, LOGL_ERROR, "Failed to msgb for MGCP data.\n");
+		LOGP(DMGCP, LOGL_ERROR, "Failed to msgb for MGCP data.\n");
 
 	return msg;
 }
@@ -386,8 +386,15 @@ static struct msgb *handle_create_con(struct mgcp_config *cfg, struct msgb *msg)
 		return create_response(500, "CRCX", trans_id);
 
 	if (endp->ci != CI_UNUSED) {
-		LOGP(DMGCP, LOGL_ERROR, "Endpoint is already used. 0x%x\n", ENDPOINT_NUMBER(endp));
-		return create_response(500, "CRCX", trans_id);
+		if (cfg->force_realloc) {
+			LOGP(DMGCP, LOGL_NOTICE, "Endpoint 0x%x already allocated. Forcing realloc.\n",
+			    ENDPOINT_NUMBER(endp));
+			mgcp_free_endp(endp);
+		} else {
+			LOGP(DMGCP, LOGL_ERROR, "Endpoint is already used. 0x%x\n",
+			     ENDPOINT_NUMBER(endp));
+			return create_response(500, "CRCX", trans_id);
+		}
 	}
 
 	/* parse CallID C: and LocalParameters L: */
@@ -479,6 +486,7 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
+	int silent = 0;
 
 	found = mgcp_analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
@@ -511,6 +519,9 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		    goto error3;
 		}
 		break;
+	case 'Z':
+		silent = strcmp("noanswer", (const char *)&msg->l3h[line_start + 3]) == 0;
+		break;
 	case '\0':
 		/* SDP file begins */
 		break;
@@ -556,6 +567,8 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		case MGCP_POLICY_REJECT:
 			LOGP(DMGCP, LOGL_NOTICE, "MDCX rejected by policy on 0x%x\n",
 			     ENDPOINT_NUMBER(endp));
+			if (silent)
+				goto out_silent;
 			return create_response(500, "MDCX", trans_id);
 			break;
 		case MGCP_POLICY_DEFER:
@@ -573,6 +586,9 @@ static struct msgb *handle_modify_con(struct mgcp_config *cfg, struct msgb *msg)
 		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), ntohs(endp->net_rtp));
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_MDCX, endp->rtp_port);
+	if (silent)
+		goto out_silent;
+
 	return create_response_with_sdp(endp, "MDCX", trans_id);
 
 error:
@@ -583,6 +599,10 @@ error:
 
 error3:
 	return create_response(error_code, "MDCX", trans_id);
+
+
+out_silent:
+	return NULL;
 }
 
 static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
@@ -592,6 +612,7 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 	const char *trans_id;
 	struct mgcp_endpoint *endp;
 	int error_code = 500;
+	int silent = 0;
 
 	found = mgcp_analyze_header(cfg, msg, data_ptrs, ARRAY_SIZE(data_ptrs), &trans_id, &endp);
 	if (found != 0)
@@ -613,6 +634,9 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 		if (verify_ci(endp, (const char *)&msg->l3h[line_start + 3]) != 0)
 			goto error3;
 		break;
+	case 'Z':
+		silent = strcmp("noanswer", (const char *)&msg->l3h[line_start + 3]) == 0;
+		break;
 	}
 	default:
 		LOGP(DMGCP, LOGL_NOTICE, "Unhandled option: '%c'/%d on 0x%x\n",
@@ -628,6 +652,8 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 		case MGCP_POLICY_REJECT:
 			LOGP(DMGCP, LOGL_NOTICE, "DLCX rejected by policy on 0x%x\n",
 			     ENDPOINT_NUMBER(endp));
+			if (silent)
+				goto out_silent;
 			return create_response(500, "DLCX", trans_id);
 			break;
 		case MGCP_POLICY_DEFER:
@@ -641,10 +667,14 @@ static struct msgb *handle_delete_con(struct mgcp_config *cfg, struct msgb *msg)
 	}
 
 	/* free the connection */
+	LOGP(DMGCP, LOGL_NOTICE, "Deleted endpoint on: 0x%x Server: %s:%u\n",
+		ENDPOINT_NUMBER(endp), inet_ntoa(endp->remote), ntohs(endp->net_rtp));
 	mgcp_free_endp(endp);
 	if (cfg->change_cb)
 		cfg->change_cb(cfg, ENDPOINT_NUMBER(endp), MGCP_ENDP_DLCX, endp->rtp_port);
 
+	if (silent)
+		goto out_silent;
 	return create_response(250, "DLCX", trans_id);
 
 error:
@@ -655,6 +685,9 @@ error:
 
 error3:
 	return create_response(error_code, "DLCX", trans_id);
+
+out_silent:
+	return NULL;
 }
 
 static struct msgb *handle_rsip(struct mgcp_config *cfg, struct msgb *msg)
@@ -728,6 +761,7 @@ void mgcp_free_endp(struct mgcp_endpoint *endp)
 
 	endp->net_rtp = endp->net_rtcp = endp->bts_rtp = endp->bts_rtcp = 0;
 	endp->net_payload_type = endp->bts_payload_type = -1;
+	endp->in_bts = endp->in_remote = 0;
 	memset(&endp->remote, 0, sizeof(endp->remote));
 	memset(&endp->bts, 0, sizeof(endp->bts));
 }

openbsc/src/mgcp/mgcp_vty.c

@@ -33,6 +33,8 @@
 #include <vty/command.h>
 #include <vty/vty.h>
 
+#include <string.h>
+
 static struct mgcp_config *g_cfg = NULL;
 
 /*
@@ -48,23 +50,26 @@ static int config_write_mgcp(struct vty *vty)
 {
 	vty_out(vty, "mgcp%s", VTY_NEWLINE);
 	if (g_cfg->local_ip)
-		vty_out(vty, " local ip %s%s", g_cfg->local_ip, VTY_NEWLINE);
-	if (g_cfg->bts_ip)
+		vty_out(vty, "  local ip %s%s", g_cfg->local_ip, VTY_NEWLINE);
+	if (g_cfg->bts_ip && strlen(g_cfg->bts_ip) != 0)
 		vty_out(vty, "  bts ip %s%s", g_cfg->bts_ip, VTY_NEWLINE);
 	vty_out(vty, "  bind ip %s%s", g_cfg->source_addr, VTY_NEWLINE);
 	vty_out(vty, "  bind port %u%s", g_cfg->source_port, VTY_NEWLINE);
 	vty_out(vty, "  bind early %u%s", !!g_cfg->early_bind, VTY_NEWLINE);
 	vty_out(vty, "  rtp base %u%s", g_cfg->rtp_base_port, VTY_NEWLINE);
-	vty_out(vty, "  sdp audio payload number %u%s", g_cfg->audio_payload, VTY_NEWLINE);
-	vty_out(vty, "  sdp audio payload name %s%s", g_cfg->audio_name, VTY_NEWLINE);
+	vty_out(vty, "  rtp ip-tos %d%s", g_cfg->endp_tos, VTY_NEWLINE);
+	if (g_cfg->audio_payload != -1)
+		vty_out(vty, "  sdp audio payload number %d%s", g_cfg->audio_payload, VTY_NEWLINE);
+	if (g_cfg->audio_name)
+		vty_out(vty, "  sdp audio payload name %s%s", g_cfg->audio_name, VTY_NEWLINE);
 	vty_out(vty, "  loop %u%s", !!g_cfg->audio_loop, VTY_NEWLINE);
-	vty_out(vty, "  endpoints %u%s", g_cfg->number_endpoints, VTY_NEWLINE);
+	vty_out(vty, "  number endpoints %u%s", g_cfg->number_endpoints - 1, VTY_NEWLINE);
 	if (g_cfg->forward_ip)
-		vty_out(vty, " forward audio ip %s%s", g_cfg->forward_ip, VTY_NEWLINE);
+		vty_out(vty, "  forward audio ip %s%s", g_cfg->forward_ip, VTY_NEWLINE);
 	if (g_cfg->forward_port != 0)
-		vty_out(vty, " forward audio port %d%s", g_cfg->forward_port, VTY_NEWLINE);
+		vty_out(vty, "  forward audio port %d%s", g_cfg->forward_port, VTY_NEWLINE);
 	if (g_cfg->call_agent_addr)
-		vty_out(vty, " call agent ip %s%s", g_cfg->call_agent_addr, VTY_NEWLINE);
+		vty_out(vty, "  call agent ip %s%s", g_cfg->call_agent_addr, VTY_NEWLINE);
 
 	return CMD_SUCCESS;
 }
@@ -77,11 +82,12 @@ DEFUN(show_mcgp, show_mgcp_cmd, "show mgcp",
 	vty_out(vty, "MGCP is up and running with %u endpoints:%s", g_cfg->number_endpoints - 1, VTY_NEWLINE);
 	for (i = 1; i < g_cfg->number_endpoints; ++i) {
 		struct mgcp_endpoint *endp = &g_cfg->endpoints[i];
-		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u on %s%s",
+		vty_out(vty, " Endpoint 0x%.2x: CI: %d net: %u/%u bts: %u/%u on %s traffic received bts: %u  remote: %u%s",
 			i, endp->ci,
 			ntohs(endp->net_rtp), ntohs(endp->net_rtcp),
 			ntohs(endp->bts_rtp), ntohs(endp->bts_rtcp),
-			inet_ntoa(endp->bts), VTY_NEWLINE);
+			inet_ntoa(endp->bts), endp->in_bts, endp->in_remote,
+			VTY_NEWLINE);
 	}
 
 	return CMD_SUCCESS;
@@ -98,7 +104,7 @@ DEFUN(cfg_mgcp,
 
 DEFUN(cfg_mgcp_local_ip,
       cfg_mgcp_local_ip_cmd,
-      "local ip IP",
+      "local ip A.B.C.D",
       "Set the IP to be used in SDP records")
 {
 	if (g_cfg->local_ip)
@@ -109,7 +115,7 @@ DEFUN(cfg_mgcp_local_ip,
 
 DEFUN(cfg_mgcp_bts_ip,
       cfg_mgcp_bts_ip_cmd,
-      "bts ip IP",
+      "bts ip A.B.C.D",
       "Set the IP of the BTS for RTP forwarding")
 {
 	if (g_cfg->bts_ip)
@@ -121,7 +127,7 @@ DEFUN(cfg_mgcp_bts_ip,
 
 DEFUN(cfg_mgcp_bind_ip,
       cfg_mgcp_bind_ip_cmd,
-      "bind ip IP",
+      "bind ip A.B.C.D",
       "Bind the MGCP to this local addr")
 {
 	if (g_cfg->source_addr)
@@ -136,11 +142,6 @@ DEFUN(cfg_mgcp_bind_port,
       "Bind the MGCP to this port")
 {
 	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong bind port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->source_port = port;
 	return CMD_SUCCESS;
 }
@@ -151,11 +152,6 @@ DEFUN(cfg_mgcp_bind_early,
       "Bind all RTP ports early")
 {
 	unsigned int bind = atoi(argv[0]);
-	if (bind != 0 && bind != 1) {
-		vty_out(vty, "%% param must be 0 or 1.%s", VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->early_bind = bind == 1;
 	return CMD_SUCCESS;
 }
@@ -166,26 +162,26 @@ DEFUN(cfg_mgcp_rtp_base_port,
       "Base port to use")
 {
 	unsigned int port = atoi(argv[0]);
-	if (port > 65534) {
-		vty_out(vty, "%% wrong base port '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->rtp_base_port = port;
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_mgcp_rtp_ip_tos,
+      cfg_mgcp_rtp_ip_tos_cmd,
+      "rtp ip-tos <0-255>",
+      "Set the IP_TOS socket attribute on the RTP/RTCP sockets.\n" "The TOS value.")
+{
+	int tos = atoi(argv[0]);
+	g_cfg->endp_tos = tos;
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_mgcp_sdp_payload_number,
       cfg_mgcp_sdp_payload_number_cmd,
       "sdp audio payload number <1-255>",
       "Set the audio codec to use")
 {
 	unsigned int payload = atoi(argv[0]);
-	if (payload > 255) {
-		vty_out(vty, "%% wrong payload number '%s'%s", argv[0], VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	g_cfg->audio_payload = payload;
 	return CMD_SUCCESS;
 }
@@ -222,7 +218,7 @@ DEFUN(cfg_mgcp_number_endp,
 
 DEFUN(cfg_mgcp_forward_ip,
       cfg_mgcp_forward_ip_cmd,
-      "forward audio ip IP",
+      "forward audio ip A.B.C.D",
       "Forward packets from and to the IP. This disables most of the MGCP feature.")
 {
 	if (g_cfg->forward_ip)
@@ -264,6 +260,7 @@ int mgcp_vty_init(void)
 	install_element(MGCP_NODE, &cfg_mgcp_bind_port_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_bind_early_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_rtp_base_port_cmd);
+	install_element(MGCP_NODE, &cfg_mgcp_rtp_ip_tos_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_number_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_sdp_payload_name_cmd);
 	install_element(MGCP_NODE, &cfg_mgcp_loop_cmd);
@@ -301,8 +298,8 @@ int mgcp_parse_config(const char *config_file, struct mgcp_config *cfg)
 
 	/*
 	 * This application supports two modes.
-         *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
-         *    2.) plain forwarding of RTP packets on the endpoints.
+	 *    1.) a true MGCP gateway with support for AUEP, CRCX, MDCX, DLCX
+	 *    2.) plain forwarding of RTP packets on the endpoints.
 	 * both modes are mutual exclusive
 	 */
 	if (g_cfg->forward_ip) {

openbsc/src/nat/bsc_mgcp_utils.c

@@ -26,7 +26,10 @@
 #include <openbsc/mgcp.h>
 #include <openbsc/mgcp_internal.h>
 
+#include <sccp/sccp.h>
+
 #include <osmocore/talloc.h>
+#include <osmocore/gsm0808.h>
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -36,10 +39,12 @@
 
 int bsc_mgcp_assign(struct sccp_connections *con, struct msgb *msg)
 {
+	struct sccp_connections *mcon;
 	struct tlv_parsed tp;
 	u_int16_t cic;
 	u_int8_t timeslot;
 	u_int8_t multiplex;
+	int combined;
 
 	if (!msg->l3h) {
 		LOGP(DNAT, LOGL_ERROR, "Assignment message should have l3h pointer.\n");
@@ -61,18 +66,27 @@ int bsc_mgcp_assign(struct sccp_connections *con, struct msgb *msg)
 	timeslot = cic & 0x1f;
 	multiplex = (cic & ~0x1f) >> 5;
 
-	con->msc_timeslot = (32 * multiplex) + timeslot;
+
+	combined = (32 * multiplex) + timeslot;
+
+	/* find stale connections using that endpoint */
+	llist_for_each_entry(mcon, &con->bsc->nat->sccp_connections, list_entry) {
+		if (mcon->msc_timeslot == combined) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Timeslot %d was assigned to 0x%x and now 0x%x\n",
+			     combined,
+			     sccp_src_ref_to_int(&mcon->patched_ref),
+			     sccp_src_ref_to_int(&con->patched_ref));
+			bsc_mgcp_dlcx(mcon);
+		}
+	}
+
+	con->msc_timeslot = combined;
 	con->bsc_timeslot = con->msc_timeslot;
 	return 0;
 }
 
-void bsc_mgcp_clear(struct sccp_connections *con)
-{
-	con->msc_timeslot = -1;
-	con->bsc_timeslot = -1;
-}
-
-void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
+static void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
 {
 	if (nat->bsc_endpoints[i].transaction_id) {
 		talloc_free(nat->bsc_endpoints[i].transaction_id);
@@ -80,19 +94,78 @@ void bsc_mgcp_free_endpoint(struct bsc_nat *nat, int i)
 	}
 
 	nat->bsc_endpoints[i].bsc = NULL;
-	mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
 }
 
 void bsc_mgcp_free_endpoints(struct bsc_nat *nat)
 {
 	int i;
 
-	for (i = 1; i < nat->mgcp_cfg->number_endpoints; ++i)
+	for (i = 1; i < nat->mgcp_cfg->number_endpoints; ++i){
 		bsc_mgcp_free_endpoint(nat, i);
+		mgcp_free_endp(&nat->mgcp_cfg->endpoints[i]);
+	}
 }
 
-struct bsc_connection *bsc_mgcp_find_con(struct bsc_nat *nat, int endpoint)
+/* send a MDCX where we do not want a response */
+static void bsc_mgcp_send_mdcx(struct bsc_connection *bsc, struct mgcp_endpoint *endp)
 {
+	char buf[2096];
+	int len;
+
+	len = snprintf(buf, sizeof(buf),
+		       "MDCX 23 %x@mgw MGCP 1.0\r\n"
+		       "Z: noanswer\r\n"
+		       "\r\n"
+		       "c=IN IP4 %s\r\n"
+		       "m=audio %d RTP/AVP 255\r\n",
+		       ENDPOINT_NUMBER(endp),
+		       bsc->nat->mgcp_cfg->source_addr,
+		       endp->rtp_port);
+	if (len < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "snprintf for DLCX failed.\n");
+		return;
+	}
+}
+
+static void bsc_mgcp_send_dlcx(struct bsc_connection *bsc, int endpoint)
+{
+	char buf[2096];
+	int len;
+
+	len = snprintf(buf, sizeof(buf),
+		       "DLCX 23 %x@mgw MGCP 1.0\r\n"
+		       "Z: noanswer\r\n", endpoint);
+	if (len < 0) {
+		LOGP(DMGCP, LOGL_ERROR, "snprintf for DLCX failed.\n");
+		return;
+	}
+
+	bsc_write_mgcp(bsc, (u_int8_t *) buf, len);
+}
+
+void bsc_mgcp_init(struct sccp_connections *con)
+{
+	con->msc_timeslot = -1;
+	con->bsc_timeslot = -1;
+	con->crcx = 0;
+}
+
+void bsc_mgcp_dlcx(struct sccp_connections *con)
+{
+	/* send a DLCX down the stream */
+	if (con->bsc_timeslot != -1 && con->crcx) {
+		int endp = mgcp_timeslot_to_endpoint(0, con->msc_timeslot);
+		bsc_mgcp_send_dlcx(con->bsc, endp);
+		bsc_mgcp_free_endpoint(con->bsc->nat, endp);
+	}
+
+	bsc_mgcp_init(con);
+}
+
+
+struct sccp_connections *bsc_mgcp_find_con(struct bsc_nat *nat, int endpoint)
+{
+	struct sccp_connections *con = NULL;
 	struct sccp_connections *sccp;
 
 	llist_for_each_entry(sccp, &nat->sccp_connections, list_entry) {
@@ -101,9 +174,12 @@ struct bsc_connection *bsc_mgcp_find_con(struct bsc_nat *nat, int endpoint)
 		if (mgcp_timeslot_to_endpoint(0, sccp->msc_timeslot) != endpoint)
 			continue;
 
-		return sccp->bsc;
+		con = sccp;
 	}
 
+	if (con)
+		return con;
+
 	LOGP(DMGCP, LOGL_ERROR, "Failed to find the connection.\n");
 	return NULL;
 }
@@ -112,7 +188,7 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 {
 	struct bsc_nat *nat;
 	struct bsc_endpoint *bsc_endp;
-	struct bsc_connection *bsc_con;
+	struct sccp_connections *sccp;
 	struct mgcp_endpoint *mgcp_endp;
 	struct msgb *bsc_msg;
 
@@ -120,10 +196,18 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 	bsc_endp = &nat->bsc_endpoints[endpoint];
 	mgcp_endp = &nat->mgcp_cfg->endpoints[endpoint];
 
-	bsc_con = bsc_mgcp_find_con(nat, endpoint);
+	if (bsc_endp->transaction_id) {
+		LOGP(DMGCP, LOGL_ERROR, "Endpoint 0x%x had pending transaction: '%s'\n",
+		     endpoint, bsc_endp->transaction_id);
+		talloc_free(bsc_endp->transaction_id);
+		bsc_endp->transaction_id = NULL;
+	}
+	bsc_endp->bsc = NULL;
 
-	if (!bsc_con) {
-		LOGP(DMGCP, LOGL_ERROR, "Did not find BSC for a new connection on 0x%x for %d\n", endpoint, state);
+	sccp = bsc_mgcp_find_con(nat, endpoint);
+
+	if (!sccp) {
+		LOGP(DMGCP, LOGL_ERROR, "Did not find BSC for change on endpoint: 0x%x state: %d\n", endpoint, state);
 
 		switch (state) {
 		case MGCP_ENDP_CRCX:
@@ -142,28 +226,6 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 		}
 	}
 
-	if (bsc_endp->transaction_id) {
-		LOGP(DMGCP, LOGL_ERROR, "One transaction with id '%s' on 0x%x\n",
-		     bsc_endp->transaction_id, endpoint);
-		talloc_free(bsc_endp->transaction_id);
-	}
-
-	bsc_endp->transaction_id = talloc_strdup(nat, transaction_id);
-	bsc_endp->bsc = bsc_con;
-	bsc_endp->pending_delete = state == MGCP_ENDP_DLCX;
-
-	/* we need to update some bits */
-	if (state == MGCP_ENDP_CRCX) {
-		struct sockaddr_in sock;
-		socklen_t len = sizeof(sock);
-		if (getpeername(bsc_con->write_queue.bfd.fd, (struct sockaddr *) &sock, &len) != 0) {
-			LOGP(DMGCP, LOGL_ERROR, "Can not get the peername...%d/%s\n",
-			      errno, strerror(errno));
-		} else {
-			mgcp_endp->bts = sock.sin_addr;
-		}
-	}
-
 	/* we need to generate a new and patched message */
 	bsc_msg = bsc_mgcp_rewrite((char *) nat->mgcp_msg, nat->mgcp_length,
 				   nat->mgcp_cfg->source_addr, mgcp_endp->rtp_port);
@@ -172,8 +234,35 @@ int bsc_mgcp_policy_cb(struct mgcp_config *cfg, int endpoint, int state, const c
 		return MGCP_POLICY_CONT;
 	}
 
-	bsc_write_mgcp_msg(bsc_con, bsc_msg);
-	return MGCP_POLICY_DEFER;
+
+	bsc_endp->transaction_id = talloc_strdup(nat, transaction_id);
+	bsc_endp->bsc = sccp->bsc;
+
+	/* we need to update some bits */
+	if (state == MGCP_ENDP_CRCX) {
+		struct sockaddr_in sock;
+		socklen_t len = sizeof(sock);
+		if (getpeername(sccp->bsc->write_queue.bfd.fd, (struct sockaddr *) &sock, &len) != 0) {
+			LOGP(DMGCP, LOGL_ERROR, "Can not get the peername...%d/%s\n",
+			      errno, strerror(errno));
+		} else {
+			mgcp_endp->bts = sock.sin_addr;
+		}
+
+		/* send the message and a fake MDCX for force sending of a dummy packet */
+		sccp->crcx = 1;
+		bsc_write(sccp->bsc, bsc_msg, NAT_IPAC_PROTO_MGCP);
+		bsc_mgcp_send_mdcx(sccp->bsc, mgcp_endp);
+		return MGCP_POLICY_DEFER;
+	} else if (state == MGCP_ENDP_DLCX) {
+		/* we will free the endpoint now and send a DLCX to the BSC */
+		msgb_free(bsc_msg);
+		bsc_mgcp_dlcx(sccp);
+		return MGCP_POLICY_CONT;
+	} else {
+		bsc_write(sccp->bsc, bsc_msg, NAT_IPAC_PROTO_MGCP);
+		return MGCP_POLICY_DEFER;
+	}
 }
 
 /*
@@ -223,21 +312,20 @@ void bsc_mgcp_forward(struct bsc_connection *bsc, struct msgb *msg)
 		return;
 	}
 
+	endp->ci = bsc_mgcp_extract_ci((const char *) msg->l2h);
+
 	/* free some stuff */
 	talloc_free(bsc_endp->transaction_id);
 	bsc_endp->transaction_id = NULL;
 
-	/* make it point to our endpoint */
-	endp->ci = bsc_mgcp_extract_ci((const char *) msg->l2h);
+	/*
+	 * rewrite the information. In case the endpoint was deleted
+	 * there should be nothing for us to rewrite so putting endp->rtp_port
+	 * with the value of 0 should be no problem.
+	 */
 	output = bsc_mgcp_rewrite((char * ) msg->l2h, msgb_l2len(msg),
 				  bsc->nat->mgcp_cfg->source_addr, endp->rtp_port);
 
-	if (bsc_endp->pending_delete) {
-		mgcp_free_endp(endp);
-		bsc_endp->bsc = NULL;
-		bsc_endp->pending_delete = 0;
-	}
-
 	if (!output) {
 		LOGP(DMGCP, LOGL_ERROR, "Failed to rewrite MGCP msg.\n");
 		return;
@@ -385,7 +473,7 @@ static int mgcp_do_write(struct bsc_fd *bfd, struct msgb *msg)
 	return rc;
 }
 
-int bsc_mgcp_init(struct bsc_nat *nat)
+int bsc_mgcp_nat_init(struct bsc_nat *nat)
 {
 	int on;
 	struct sockaddr_in addr;
@@ -447,6 +535,8 @@ int bsc_mgcp_init(struct bsc_nat *nat)
 	nat->mgcp_cfg->audio_payload = -1;
 	nat->mgcp_cfg->data = nat;
 	nat->mgcp_cfg->policy_cb = bsc_mgcp_policy_cb;
+	nat->mgcp_cfg->force_realloc = 1;
+	nat->mgcp_cfg->bts_ip = "";
 	nat->bsc_endpoints = talloc_zero_array(nat,
 					       struct bsc_endpoint,
 					       nat->mgcp_cfg->number_endpoints + 1);
@@ -463,11 +553,7 @@ void bsc_mgcp_clear_endpoints_for(struct bsc_connection *bsc)
 		if (bsc_endp->bsc != bsc)
 			continue;
 
-		bsc_endp->bsc = NULL;
-		bsc_endp->pending_delete = 0;
-		if (bsc_endp->transaction_id)
-			talloc_free(bsc_endp->transaction_id);
-		bsc_endp->transaction_id = NULL;
+		bsc_mgcp_free_endpoint(bsc->nat, i);
 		mgcp_free_endp(&bsc->nat->mgcp_cfg->endpoints[i]);
 	}
 }

openbsc/src/nat/bsc_nat.c

@@ -23,6 +23,7 @@
  */
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <arpa/inet.h>
 
 #include <errno.h>
@@ -44,22 +45,26 @@
 #include <openbsc/telnet_interface.h>
 
 #include <osmocore/talloc.h>
+#include <osmocore/gsm0808.h>
 
 #include <vty/vty.h>
 
 #include <sccp/sccp.h>
 
+#define SCCP_CLOSE_TIME 20
+#define SCCP_CLOSE_TIME_TIMEOUT 19
+
 struct log_target *stderr_target;
 static const char *config_file = "bsc-nat.cfg";
-static char *msc_address = "127.0.0.1";
 static struct in_addr local_addr;
-static struct bsc_msc_connection *msc_con;
 static struct bsc_fd bsc_listen;
+static const char *msc_ip = NULL;
+static struct timer_list sccp_close;
 
 
 static struct bsc_nat *nat;
-static void bsc_write(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length);
-static void remove_bsc_connection(struct bsc_connection *connection);
+static void bsc_send_data(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length, int);
+static void msc_send_reset(struct bsc_msc_connection *con);
 
 struct bsc_config *bsc_config_num(struct bsc_nat *nat, int num)
 {
@@ -76,7 +81,8 @@ struct bsc_config *bsc_config_num(struct bsc_nat *nat, int num)
  * below are stubs we need to link
  */
 int nm_state_event(enum nm_evt evt, u_int8_t obj_class, void *obj,
-		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state)
+		   struct gsm_nm_state *old_state, struct gsm_nm_state *new_state,
+		   struct abis_om_obj_inst *obj_ins)
 {
 	return -1;
 }
@@ -89,31 +95,90 @@ int gsm0408_rcvmsg(struct msgb *msg, u_int8_t link_id)
 	return -1;
 }
 
+static void queue_for_msc(struct bsc_msc_connection *con, struct msgb *msg)
+{
+	if (write_queue_enqueue(&nat->msc_con->write_queue, msg) != 0) {
+		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
+		msgb_free(msg);
+	}
+}
+
 static void send_reset_ack(struct bsc_connection *bsc)
 {
 	static const u_int8_t gsm_reset_ack[] = {
-		0x00, 0x13, 0xfd,
 		0x09, 0x00, 0x03, 0x07, 0x0b, 0x04, 0x43, 0x01,
 		0x00, 0xfe, 0x04, 0x43, 0x5c, 0x00, 0xfe, 0x03,
 		0x00, 0x01, 0x31,
 	};
 
-	bsc_write(bsc, gsm_reset_ack, sizeof(gsm_reset_ack));
+	bsc_send_data(bsc, gsm_reset_ack, sizeof(gsm_reset_ack), IPAC_PROTO_SCCP);
+}
+
+static void send_ping(struct bsc_connection *bsc)
+{
+	static const u_int8_t id_ping[] = {
+		IPAC_MSGT_PING,
+	};
+
+	bsc_send_data(bsc, id_ping, sizeof(id_ping), IPAC_PROTO_IPACCESS);
+}
+
+static void send_pong(struct bsc_connection *bsc)
+{
+	static const u_int8_t id_pong[] = {
+		IPAC_MSGT_PONG,
+	};
+
+	bsc_send_data(bsc, id_pong, sizeof(id_pong), IPAC_PROTO_IPACCESS);
+}
+
+static void bsc_pong_timeout(void *_bsc)
+{
+	struct bsc_connection *bsc = _bsc;
+
+	LOGP(DNAT, LOGL_ERROR, "BSC Nr: %d PONG timeout.\n", bsc->cfg->nr);
+	bsc_close_connection(bsc);
+}
+
+static void bsc_ping_timeout(void *_bsc)
+{
+	struct bsc_connection *bsc = _bsc;
+
+	if (bsc->nat->ping_timeout < 0)
+		return;
+
+	send_ping(bsc);
+
+	/* send another ping in 20 seconds */
+	bsc_schedule_timer(&bsc->ping_timeout, bsc->nat->ping_timeout, 0);
+
+	/* also start a pong timer */
+	bsc_schedule_timer(&bsc->pong_timeout, bsc->nat->pong_timeout, 0);
+}
+
+static void start_ping_pong(struct bsc_connection *bsc)
+{
+	bsc->pong_timeout.data = bsc;
+	bsc->pong_timeout.cb = bsc_pong_timeout;
+	bsc->ping_timeout.data = bsc;
+	bsc->ping_timeout.cb = bsc_ping_timeout;
+
+	bsc_ping_timeout(bsc);
 }
 
 static void send_id_ack(struct bsc_connection *bsc)
 {
 	static const u_int8_t id_ack[] = {
-		0, 1, IPAC_PROTO_IPACCESS, IPAC_MSGT_ID_ACK
+		IPAC_MSGT_ID_ACK
 	};
 
-	bsc_write(bsc, id_ack, sizeof(id_ack));
+	bsc_send_data(bsc, id_ack, sizeof(id_ack), IPAC_PROTO_IPACCESS);
 }
 
 static void send_id_req(struct bsc_connection *bsc)
 {
 	static const u_int8_t id_req[] = {
-		0, 17, IPAC_PROTO_IPACCESS, IPAC_MSGT_ID_GET,
+		IPAC_MSGT_ID_GET,
 		0x01, IPAC_IDTAG_UNIT,
 		0x01, IPAC_IDTAG_MACADDR,
 		0x01, IPAC_IDTAG_LOCATION1,
@@ -124,7 +189,7 @@ static void send_id_req(struct bsc_connection *bsc)
 		0x01, IPAC_IDTAG_SERNR,
 	};
 
-	bsc_write(bsc, id_req, sizeof(id_req));
+	bsc_send_data(bsc, id_req, sizeof(id_req), IPAC_PROTO_IPACCESS);
 }
 
 static void nat_send_rlsd(struct sccp_connections *conn)
@@ -147,10 +212,30 @@ static void nat_send_rlsd(struct sccp_connections *conn)
 
 	ipaccess_prepend_header(msg, IPAC_PROTO_SCCP);
 
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
-		msgb_free(msg);
+	queue_for_msc(nat->msc_con, msg);
+}
+
+static void nat_send_rlc(struct sccp_source_reference *src,
+			 struct sccp_source_reference *dst)
+{
+	struct sccp_connection_release_complete *rlc;
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(4096, 128, "rlc");
+	if (!msg) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to allocate clear command.\n");
+		return;
 	}
+
+	msg->l2h = msgb_put(msg, sizeof(*rlc));
+	rlc = (struct sccp_connection_release_complete *) msg->l2h;
+	rlc->type = SCCP_MSG_TYPE_RLC;
+	rlc->destination_local_reference = *dst;
+	rlc->source_local_reference = *src;
+
+	ipaccess_prepend_header(msg, IPAC_PROTO_SCCP);
+
+	queue_for_msc(nat->msc_con, msg);
 }
 
 static void send_mgcp_reset(struct bsc_connection *bsc)
@@ -169,43 +254,130 @@ static void send_mgcp_reset(struct bsc_connection *bsc)
  */
 static void initialize_msc_if_needed()
 {
-	static int init = 0;
-	init = 1;
+	if (nat->first_contact)
+		return;
 
-	/* do we need to send a GSM 08.08 message here? */
+	nat->first_contact = 1;
+	msc_send_reset(nat->msc_con);
+}
+
+static void send_id_get_response()
+{
+	struct msgb *msg = bsc_msc_id_get_resp(nat->token);
+	if (!msg)
+		return;
+
+	ipaccess_prepend_header(msg, IPAC_PROTO_IPACCESS);
+	queue_for_msc(nat->msc_con, msg);
 }
 
 /*
  * Currently we are lacking refcounting so we need to copy each message.
  */
-static void bsc_write(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length)
+static void bsc_send_data(struct bsc_connection *bsc, const u_int8_t *data, unsigned int length, int proto)
 {
 	struct msgb *msg;
 
-	if (length > 4096) {
+	if (length > 4096 - 128) {
 		LOGP(DINP, LOGL_ERROR, "Can not send message of that size.\n");
 		return;
 	}
 
-	msg = msgb_alloc(4096, "to-bsc");
+	msg = msgb_alloc_headroom(4096, 128, "to-bsc");
 	if (!msg) {
 		LOGP(DINP, LOGL_ERROR, "Failed to allocate memory for BSC msg.\n");
 		return;
 	}
 
-	msgb_put(msg, length);
+	msg->l2h = msgb_put(msg, length);
 	memcpy(msg->data, data, length);
-	if (write_queue_enqueue(&bsc->write_queue, msg) != 0) {
-		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
-		msgb_free(msg);
-	}
+
+	bsc_write(bsc, msg, proto);
 }
 
+static void bsc_send_con_refuse(struct bsc_connection *bsc,
+				struct bsc_nat_parsed *parsed, int con_type)
+{
+	struct msgb *payload;
+	struct msgb *refuse;
+
+	if (con_type == NAT_CON_TYPE_LU)
+		payload = gsm48_create_loc_upd_rej(GSM48_REJECT_PLMN_NOT_ALLOWED);
+	else if (con_type == NAT_CON_TYPE_CM_SERV_REQ)
+		payload = gsm48_create_mm_serv_rej(GSM48_REJECT_PLMN_NOT_ALLOWED);
+
+	/*
+	 * Some BSCs do not handle the payload inside a SCCP CREF msg
+	 * so we will need to:
+	 * 1.) Allocate a local connection and mark it as local..
+	 * 2.) queue data for downstream.. and the RLC should delete everything
+	 */
+	if (payload) {
+		struct msgb *cc, *udt, *rlsd;
+		struct sccp_connections *con;
+		con = create_sccp_src_ref(bsc, parsed);
+		if (!con)
+			goto send_refuse;
+
+		/* declare it local and assign a unique remote_ref */
+		con->con_type = NAT_CON_TYPE_LOCAL_REJECT;
+		con->con_local = 1;
+		con->has_remote_ref = 1;
+		con->remote_ref = con->patched_ref;
+
+		/* 1. create a confirmation */
+		cc = sccp_create_cc(&con->remote_ref, &con->real_ref);
+		if (!cc)
+			goto send_refuse;
+
+		/* 2. create the DT1 */
+		gsm0808_prepend_dtap_header(payload, 0);
+		udt = sccp_create_dt1(&con->real_ref, payload->data, payload->len);
+		if (!udt) {
+			msgb_free(cc);
+			goto send_refuse;
+		}
+
+		/* 3. send a RLSD */
+		rlsd = sccp_create_rlsd(&con->remote_ref, &con->real_ref,
+					SCCP_RELEASE_CAUSE_END_USER_ORIGINATED);
+		if (!rlsd) {
+			msgb_free(cc);
+			msgb_free(udt);
+			goto send_refuse;
+		}
+
+		bsc_write(bsc, cc, IPAC_PROTO_SCCP);
+		bsc_write(bsc, udt, IPAC_PROTO_SCCP);
+		bsc_write(bsc, rlsd, IPAC_PROTO_SCCP);
+		msgb_free(payload);
+		return;
+	}
+
+
+send_refuse:
+	if (payload)
+		msgb_free(payload);
+
+	refuse = sccp_create_refuse(parsed->src_local_ref,
+				    SCCP_REFUSAL_SCCP_FAILURE, NULL, 0);
+	if (!refuse) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "Creating refuse msg failed for SCCP 0x%x on BSC Nr: %d.\n",
+		      sccp_src_ref_to_int(parsed->src_local_ref), bsc->cfg->nr);
+		return;
+	}
+
+	bsc_write(bsc, refuse, IPAC_PROTO_SCCP);
+}
+
+
 static int forward_sccp_to_bts(struct msgb *msg)
 {
 	struct sccp_connections *con;
 	struct bsc_connection *bsc;
 	struct bsc_nat_parsed *parsed;
+	int proto;
 
 	/* filter, drop, patch the message? */
 	parsed = bsc_nat_parse(msg);
@@ -217,8 +389,10 @@ static int forward_sccp_to_bts(struct msgb *msg)
 	if (bsc_nat_filter_ipa(DIR_BSC, msg, parsed))
 		goto exit;
 
+	proto = parsed->ipa_proto;
+
 	/* Route and modify the SCCP packet */
-	if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
+	if (proto == IPAC_PROTO_SCCP) {
 		switch (parsed->sccp_type) {
 		case SCCP_MSG_TYPE_UDT:
 			/* forward UDT messages to every BSC */
@@ -230,7 +404,10 @@ static int forward_sccp_to_bts(struct msgb *msg)
 		case SCCP_MSG_TYPE_IT:
 			con = patch_sccp_src_ref_to_bsc(msg, parsed, nat);
 			if (parsed->gsm_type == BSS_MAP_MSG_ASSIGMENT_RQST) {
+				counter_inc(nat->stats.sccp.calls);
+
 				if (con) {
+					counter_inc(con->bsc->cfg->stats.sccp.calls);
 					if (bsc_mgcp_assign(con, msg) != 0)
 						LOGP(DNAT, LOGL_ERROR, "Failed to assign...\n");
 				} else
@@ -252,8 +429,12 @@ static int forward_sccp_to_bts(struct msgb *msg)
 			goto exit;
 		}
 
-		if (!con)
-			LOGP(DNAT, LOGL_ERROR, "Unknown connection for msg type: 0x%x.\n", parsed->sccp_type);
+		if (!con && parsed->sccp_type == SCCP_MSG_TYPE_RLSD) {
+			LOGP(DNAT, LOGL_NOTICE, "Sending fake RLC on RLSD message to network.\n");
+			/* Exchange src/dest for the reply */
+			nat_send_rlc(parsed->dest_local_ref, parsed->src_local_ref);
+		} else if (!con)
+			LOGP(DNAT, LOGL_ERROR, "Unknown connection for msg type: 0x%x from the MSC.\n", parsed->sccp_type);
 	}
 
 	talloc_free(parsed);
@@ -264,7 +445,7 @@ static int forward_sccp_to_bts(struct msgb *msg)
 		return -1;
 	}
 
-	bsc_write(con->bsc, msg->data, msg->len);
+	bsc_send_data(con->bsc, msg->l2h, msgb_l2len(msg), proto);
 	return 0;
 
 send_to_all:
@@ -274,11 +455,15 @@ send_to_all:
 	 * message and then send it to the authenticated messages...
 	 */
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP && parsed->gsm_type == BSS_MAP_MSG_PAGING) {
-		bsc = bsc_nat_find_bsc(nat, msg);
-		if (bsc)
-			bsc_write(bsc, msg->data, msg->len);
+		int lac;
+		bsc = bsc_nat_find_bsc(nat, msg, &lac);
+		if (bsc && bsc->cfg->forbid_paging)
+			LOGP(DNAT, LOGL_DEBUG, "Paging forbidden for BTS: %d\n", bsc->cfg->nr);
+		else if (bsc)
+			bsc_send_data(bsc, msg->l2h, msgb_l2len(msg), parsed->ipa_proto);
 		else
-			LOGP(DNAT, LOGL_ERROR, "Could not determine BSC for paging.\n");
+			LOGP(DNAT, LOGL_ERROR, "Could not determine BSC for paging on lac: %d/0x%x\n",
+			     lac, lac);
 
 		goto exit;
 	}
@@ -287,7 +472,7 @@ send_to_all:
 		if (!bsc->authenticated)
 			continue;
 
-		bsc_write(bsc, msg->data, msg->len);
+		bsc_send_data(bsc, msg->l2h, msgb_l2len(msg), parsed->ipa_proto);
 	}
 
 exit:
@@ -299,14 +484,42 @@ static void msc_connection_was_lost(struct bsc_msc_connection *con)
 {
 	struct bsc_connection *bsc, *tmp;
 
+	counter_inc(nat->stats.msc.reconn);
+
 	LOGP(DMSC, LOGL_ERROR, "Closing all connections downstream.\n");
 	llist_for_each_entry_safe(bsc, tmp, &nat->bsc_connections, list_entry)
-		remove_bsc_connection(bsc);
+		bsc_close_connection(bsc);
 
+	nat->first_contact = 0;
 	bsc_mgcp_free_endpoints(nat);
 	bsc_msc_schedule_connect(con);
 }
 
+static void msc_send_reset(struct bsc_msc_connection *msc_con)
+{
+	static const u_int8_t reset[] = {
+		0x00, 0x12, 0xfd,
+		0x09, 0x00, 0x03, 0x05, 0x07, 0x02, 0x42, 0xfe,
+		0x02, 0x42, 0xfe, 0x06, 0x00, 0x04, 0x30, 0x04,
+		0x01, 0x20
+	};
+
+	struct msgb *msg;
+
+	msg = msgb_alloc_headroom(4096, 128, "08.08 reset");
+	if (!msg) {
+		LOGP(DMSC, LOGL_ERROR, "Failed to allocate reset msg.\n");
+		return;
+	}
+
+	msg->l2h = msgb_put(msg, sizeof(reset));
+	memcpy(msg->l2h, reset, msgb_l2len(msg));
+
+	queue_for_msc(nat->msc_con, msg);
+
+	LOGP(DMSC, LOGL_NOTICE, "Scheduled GSM0808 reset msg for the MSC.\n");
+}
+
 static int ipaccess_msc_read_cb(struct bsc_fd *bfd)
 {
 	int error;
@@ -314,13 +527,12 @@ static int ipaccess_msc_read_cb(struct bsc_fd *bfd)
 	struct ipaccess_head *hh;
 
 	if (!msg) {
-		if (error == 0) {
+		if (error == 0)
 			LOGP(DNAT, LOGL_FATAL, "The connection the MSC was lost, exiting\n");
-			bsc_msc_lost(msc_con);
-			return -1;
-		}
+		else
+			LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
 
-		LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
+		bsc_msc_lost(nat->msc_con);
 		return -1;
 	}
 
@@ -331,9 +543,12 @@ static int ipaccess_msc_read_cb(struct bsc_fd *bfd)
 	ipaccess_rcvmsg_base(msg, bfd);
 
 	/* initialize the networking. This includes sending a GSM08.08 message */
-	if (hh->proto == IPAC_PROTO_IPACCESS && msg->l2h[0] == IPAC_MSGT_ID_ACK)
-		initialize_msc_if_needed();
-	else if (hh->proto == IPAC_PROTO_SCCP)
+	if (hh->proto == IPAC_PROTO_IPACCESS) {
+		if (msg->l2h[0] == IPAC_MSGT_ID_ACK)
+			initialize_msc_if_needed();
+		else if (msg->l2h[0] == IPAC_MSGT_ID_GET)
+			send_id_get_response();
+	} else if (hh->proto == IPAC_PROTO_SCCP)
 		forward_sccp_to_bts(msg);
 
 	msgb_free(msg);
@@ -364,38 +579,47 @@ static int ipaccess_msc_write_cb(struct bsc_fd *bfd, struct msgb *msg)
  * remove it from the patching of SCCP header lists
  * as well. Maybe in the future even close connection..
  */
-static void remove_bsc_connection(struct bsc_connection *connection)
+void bsc_close_connection(struct bsc_connection *connection)
 {
 	struct sccp_connections *sccp_patch, *tmp;
-	bsc_unregister_fd(&connection->write_queue.bfd);
-	close(connection->write_queue.bfd.fd);
-	write_queue_clear(&connection->write_queue);
-	llist_del(&connection->list_entry);
 
 	/* stop the timeout timer */
 	bsc_del_timer(&connection->id_timeout);
+	bsc_del_timer(&connection->ping_timeout);
+	bsc_del_timer(&connection->pong_timeout);
 
 	/* remove all SCCP connections */
 	llist_for_each_entry_safe(sccp_patch, tmp, &nat->sccp_connections, list_entry) {
 		if (sccp_patch->bsc != connection)
 			continue;
 
-		nat_send_rlsd(sccp_patch);
+		if (sccp_patch->has_remote_ref)
+			nat_send_rlsd(sccp_patch);
 		sccp_connection_destroy(sccp_patch);
 	}
 
 	/* close endpoints allocated by this BSC */
 	bsc_mgcp_clear_endpoints_for(connection);
 
+	bsc_unregister_fd(&connection->write_queue.bfd);
+	close(connection->write_queue.bfd.fd);
+	write_queue_clear(&connection->write_queue);
+	llist_del(&connection->list_entry);
+
 	talloc_free(connection);
 }
 
 static void ipaccess_close_bsc(void *data)
 {
+	struct sockaddr_in sock;
+	socklen_t len = sizeof(sock);
 	struct bsc_connection *conn = data;
 
-	LOGP(DNAT, LOGL_ERROR, "BSC didn't respond to identity request. Closing.\n");
-	remove_bsc_connection(conn);
+
+	getpeername(conn->write_queue.bfd.fd, (struct sockaddr *) &sock, &len);
+	LOGP(DNAT, LOGL_ERROR, "BSC on %s didn't respond to identity request. Closing.\n",
+	     inet_ntoa(sock.sin_addr));
+	bsc_close_connection(conn);
 }
 
 static void ipaccess_auth_bsc(struct tlv_parsed *tvp, struct bsc_connection *bsc)
@@ -403,20 +627,35 @@ static void ipaccess_auth_bsc(struct tlv_parsed *tvp, struct bsc_connection *bsc
 	struct bsc_config *conf;
 	const char* token = (const char *) TLVP_VAL(tvp, IPAC_IDTAG_UNITNAME);
 
+	if (bsc->cfg) {
+		LOGP(DNAT, LOGL_ERROR, "Reauth on fd %d bsc nr %d\n",
+		     bsc->write_queue.bfd.fd, bsc->cfg->nr);
+		return;
+	}
+
 	llist_for_each_entry(conf, &bsc->nat->bsc_configs, entry) {
 		if (strcmp(conf->token, token) == 0) {
+			counter_inc(conf->stats.net.reconn);
 			bsc->authenticated = 1;
 			bsc->cfg = conf;
 			bsc_del_timer(&bsc->id_timeout);
-			LOGP(DNAT, LOGL_NOTICE, "Authenticated bsc nr: %d lac: %d\n", conf->nr, conf->lac);
-			break;
+			LOGP(DNAT, LOGL_NOTICE, "Authenticated bsc nr: %d lac: %d on fd %d\n",
+			     conf->nr, conf->lac, bsc->write_queue.bfd.fd);
+			start_ping_pong(bsc);
+			return;
 		}
 	}
+
+	LOGP(DNAT, LOGL_ERROR, "No bsc found for token %s on fd: %d.\n", token,
+	     bsc->write_queue.bfd.fd);
 }
 
 static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 {
-	struct sccp_connections *con;
+	int con_found = 0;
+	int con_filter = 0;
+	struct bsc_connection *con_bsc = NULL;
+	int con_type;
 	struct bsc_nat_parsed *parsed;
 
 	/* Parse and filter messages */
@@ -444,21 +683,37 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 
 	/* modify the SCCP entries */
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
+		struct sccp_connections *con;
 		switch (parsed->sccp_type) {
 		case SCCP_MSG_TYPE_CR:
-			if (create_sccp_src_ref(bsc, msg, parsed) != 0)
+			if (bsc_nat_filter_sccp_cr(bsc, msg, parsed, &con_type) != 0)
+				goto exit3;
+			if (!create_sccp_src_ref(bsc, parsed))
 				goto exit2;
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			con->con_type = con_type;
+			con_found = 1;
+			con_bsc = con->bsc;
 			break;
 		case SCCP_MSG_TYPE_RLSD:
 		case SCCP_MSG_TYPE_CREF:
 		case SCCP_MSG_TYPE_DT1:
 		case SCCP_MSG_TYPE_CC:
 		case SCCP_MSG_TYPE_IT:
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			if (con) {
+				con_found = 1;
+				con_bsc = con->bsc;
+				con_filter = con->con_local;
+			}
 			break;
 		case SCCP_MSG_TYPE_RLC:
-			con = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+			con = patch_sccp_src_ref_to_msc(msg, parsed, bsc);
+			if (con) {
+				con_found = 1;
+				con_bsc = con->bsc;
+				con_filter = con->con_local;
+			}
 			remove_sccp_src_ref(bsc, msg, parsed);
 			break;
 		case SCCP_MSG_TYPE_UDT:
@@ -479,16 +734,18 @@ static int forward_sccp_to_msc(struct bsc_connection *bsc, struct msgb *msg)
 		goto exit2;
 	}
 
-	if (con && con->bsc != bsc) {
-		LOGP(DNAT, LOGL_ERROR, "Found the wrong entry.\n");
+	if (con_found && con_bsc != bsc) {
+		LOGP(DNAT, LOGL_ERROR, "The connection belongs to a different BTS: input: %d con: %d\n",
+		     bsc->cfg->nr, con_bsc->cfg->nr);
 		goto exit2;
 	}
 
+	/* do not forward messages to the MSC */
+	if (con_filter)
+		goto exit2;
+
 	/* send the non-filtered but maybe modified msg */
-	if (write_queue_enqueue(&msc_con->write_queue, msg) != 0) {
-		LOGP(DNAT, LOGL_ERROR, "Can not queue message for the MSC.\n");
-		msgb_free(msg);
-	}
+	queue_for_msc(nat->msc_con, msg);
 	talloc_free(parsed);
 	return 0;
 
@@ -515,6 +772,13 @@ exit2:
 	talloc_free(parsed);
 	msgb_free(msg);
 	return -1;
+
+exit3:
+	/* send a SCCP Connection Refused */
+	bsc_send_con_refuse(bsc, parsed, con_type);
+	talloc_free(parsed);
+	msgb_free(msg);
+	return -1;
 }
 
 static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
@@ -522,14 +786,19 @@ static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
 	int error;
 	struct bsc_connection *bsc = bfd->data;
 	struct msgb *msg = ipaccess_read_msg(bfd, &error);
+	struct ipaccess_head *hh;
 
 	if (!msg) {
-		if (error == 0) {
-			LOGP(DNAT, LOGL_ERROR,	"The connection to the BSC was lost. Cleaning it\n");
-			remove_bsc_connection(bsc);
-		} else {
-			LOGP(DNAT, LOGL_ERROR, "Failed to parse ip access message: %d\n", error);
-		}
+		if (error == 0)
+			LOGP(DNAT, LOGL_ERROR,
+			     "The connection to the BSC Nr: %d was lost. Cleaning it\n",
+			     bsc->cfg ? bsc->cfg->nr : -1);
+		else
+			LOGP(DNAT, LOGL_ERROR,
+			     "Stream error on BSC Nr: %d. Failed to parse ip access message: %d\n",
+			     bsc->cfg ? bsc->cfg->nr : -1, error);
+
+		bsc_close_connection(bsc);
 		return -1;
 	}
 
@@ -537,6 +806,21 @@ static int ipaccess_bsc_read_cb(struct bsc_fd *bfd)
 	LOGP(DNAT, LOGL_DEBUG, "MSG from BSC: %s proto: %d\n", hexdump(msg->data, msg->len), msg->l2h[0]);
 
 	/* Handle messages from the BSC */
+	hh = (struct ipaccess_head *) msg->data;
+
+	/* stop the pong timeout */
+	if (hh->proto == IPAC_PROTO_IPACCESS) {
+		if (msg->l2h[0] == IPAC_MSGT_PONG) {
+			bsc_del_timer(&bsc->pong_timeout);
+			msgb_free(msg);
+			return 0;
+		} else if (msg->l2h[0] == IPAC_MSGT_PING) {
+			send_pong(bsc);
+			msgb_free(msg);
+			return 0;
+		}
+	}
+
 	/* FIXME: Currently no PONG is sent to the BSC */
 	/* FIXME: Currently no ID ACK is sent to the BSC */
 	forward_sccp_to_msc(bsc, msg);
@@ -558,28 +842,41 @@ static int ipaccess_bsc_write_cb(struct bsc_fd *bfd, struct msgb *msg)
 static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 {
 	struct bsc_connection *bsc;
-	int ret;
+	int fd, rc, on;
 	struct sockaddr_in sa;
 	socklen_t sa_len = sizeof(sa);
 
 	if (!(what & BSC_FD_READ))
 		return 0;
 
-	ret = accept(bfd->fd, (struct sockaddr *) &sa, &sa_len);
-	if (ret < 0) {
+	fd = accept(bfd->fd, (struct sockaddr *) &sa, &sa_len);
+	if (fd < 0) {
 		perror("accept");
-		return ret;
+		return fd;
 	}
 
+	/* count the reconnect */
+	counter_inc(nat->stats.bsc.reconn);
+
 	/*
 	 * if we are not connected to a msc... just close the socket
 	 */
-	if (!msc_con->is_connected) {
+	if (!nat->msc_con->is_connected) {
 		LOGP(DNAT, LOGL_NOTICE, "Disconnecting BSC due lack of MSC connection.\n");
-		close(ret);
+		close(fd);
 		return 0;
 	}
 
+	on = 1;
+	rc = setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+	if (rc != 0)
+                LOGP(DNAT, LOGL_ERROR, "Failed to set TCP_NODELAY: %s\n", strerror(errno));
+
+	rc = setsockopt(fd, IPPROTO_IP, IP_TOS,
+			&nat->bsc_ip_tos, sizeof(nat->bsc_ip_tos));
+	if (rc != 0)
+		LOGP(DNAT, LOGL_ERROR, "Failed to set IP_TOS: %s\n", strerror(errno));
+
 	/* todo... do something with the connection */
 	/* todo... use GNUtls to see if we want to trust this as a BTS */
 
@@ -589,24 +886,24 @@ static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 	bsc = bsc_connection_alloc(nat);
 	if (!bsc) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to allocate BSC struct.\n");
-		close(ret);
+		close(fd);
 		return -1;
 	}
 
-	write_queue_init(&bsc->write_queue, 100);
 	bsc->write_queue.bfd.data = bsc;
-	bsc->write_queue.bfd.fd = ret;
+	bsc->write_queue.bfd.fd = fd;
 	bsc->write_queue.read_cb = ipaccess_bsc_read_cb;
 	bsc->write_queue.write_cb = ipaccess_bsc_write_cb;
 	bsc->write_queue.bfd.when = BSC_FD_READ;
 	if (bsc_register_fd(&bsc->write_queue.bfd) < 0) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to register BSC fd.\n");
-		close(ret);
+		close(fd);
 		talloc_free(bsc);
 		return -2;
 	}
 
-	LOGP(DNAT, LOGL_NOTICE, "Registered new BSC\n");
+	LOGP(DNAT, LOGL_NOTICE, "BSC connection on %d with IP: %s\n",
+		fd, inet_ntoa(sa.sin_addr));
 	llist_add(&bsc->list_entry, &nat->bsc_connections);
 	send_id_ack(bsc);
 	send_id_req(bsc);
@@ -617,7 +914,7 @@ static int ipaccess_listen_bsc_cb(struct bsc_fd *bfd, unsigned int what)
 	 */
 	bsc->id_timeout.data = bsc;
 	bsc->id_timeout.cb = ipaccess_close_bsc;
-	bsc_schedule_timer(&bsc->id_timeout, 2, 0);
+	bsc_schedule_timer(&bsc->id_timeout, nat->auth_timeout, 0);
 	return 0;
 }
 
@@ -712,7 +1009,7 @@ static void handle_options(int argc, char** argv)
 			log_set_print_timestamp(stderr_target, 1);
 			break;
 		case 'm':
-			msc_address = strdup(optarg);
+			msc_ip = optarg;
 			break;
 		case 'l':
 			inet_aton(optarg, &local_addr);
@@ -738,17 +1035,47 @@ static void signal_handler(int signal)
 	}
 }
 
+static void sccp_close_unconfirmed(void *_data)
+{
+	struct sccp_connections *conn, *tmp1;
+	struct timespec now;
+	clock_gettime(CLOCK_MONOTONIC, &now);
+
+	llist_for_each_entry_safe(conn, tmp1, &nat->sccp_connections, list_entry) {
+		if (conn->has_remote_ref)
+			continue;
+
+		int diff = (now.tv_sec - conn->creation_time.tv_sec) / 60;
+		if (diff < SCCP_CLOSE_TIME_TIMEOUT)
+			continue;
+
+		LOGP(DNAT, LOGL_ERROR, "SCCP connection 0x%x/0x%x was never confirmed.\n",
+		     sccp_src_ref_to_int(&conn->real_ref),
+		     sccp_src_ref_to_int(&conn->patched_ref));
+		sccp_connection_destroy(conn);
+	}
+
+	bsc_schedule_timer(&sccp_close, SCCP_CLOSE_TIME, 0);
+}
+
+extern void *tall_msgb_ctx;
+extern void *tall_ctr_ctx;
+static void talloc_init_ctx()
+{
+	tall_bsc_ctx = talloc_named_const(NULL, 0, "nat");
+	tall_msgb_ctx = talloc_named_const(tall_bsc_ctx, 0, "msgb");
+	tall_ctr_ctx = talloc_named_const(tall_bsc_ctx, 0, "counter");
+}
+
 int main(int argc, char** argv)
 {
+	talloc_init_ctx();
 	log_init(&log_info);
+
 	stderr_target = log_target_create_stderr();
 	log_add_target(stderr_target);
 	log_set_all_filter(stderr_target, 1);
 
-	/* parse options */
-	local_addr.s_addr = INADDR_ANY;
-	handle_options(argc, argv);
-
 	nat = bsc_nat_alloc();
 	if (!nat) {
 		fprintf(stderr, "Failed to allocate the BSC nat.\n");
@@ -756,6 +1083,14 @@ int main(int argc, char** argv)
 	}
 
 	nat->mgcp_cfg = talloc_zero(nat, struct mgcp_config);
+	if (!nat->mgcp_cfg) {
+		fprintf(stderr, "Failed to allocate MGCP cfg.\n");
+		return -5;
+	}
+
+	/* parse options */
+	local_addr.s_addr = INADDR_ANY;
+	handle_options(argc, argv);
 
 	/* init vty and parse */
 	bsc_nat_vty_init(nat);
@@ -765,26 +1100,30 @@ int main(int argc, char** argv)
 		return -3;
 	}
 
+	/* over rule the VTY config */
+	if (msc_ip)
+		bsc_nat_set_msc_ip(nat, msc_ip);
+
 	/* seed the PRNG */
 	srand(time(NULL));
 
 	/*
 	 * Setup the MGCP code..
 	 */
-	if (bsc_mgcp_init(nat) != 0)
+	if (bsc_mgcp_nat_init(nat) != 0)
 		return -4;
 
 	/* connect to the MSC */
-	msc_con = bsc_msc_create(msc_address, 5000);
-	if (!msc_con) {
+	nat->msc_con = bsc_msc_create(nat->msc_ip, nat->msc_port, 0);
+	if (!nat->msc_con) {
 		fprintf(stderr, "Creating a bsc_msc_connection failed.\n");
 		exit(1);
 	}
 
-	msc_con->connection_loss = msc_connection_was_lost;
-	msc_con->write_queue.read_cb = ipaccess_msc_read_cb;
-	msc_con->write_queue.write_cb = ipaccess_msc_write_cb;;
-	bsc_msc_connect(msc_con);
+	nat->msc_con->connection_loss = msc_connection_was_lost;
+	nat->msc_con->write_queue.read_cb = ipaccess_msc_read_cb;
+	nat->msc_con->write_queue.write_cb = ipaccess_msc_write_cb;;
+	bsc_msc_connect(nat->msc_con);
 
 	/* wait for the BSC */
 	if (listen_for_bsc(&bsc_listen, &local_addr, 5000) < 0) {
@@ -796,6 +1135,11 @@ int main(int argc, char** argv)
 	signal(SIGUSR1, &signal_handler);
 	signal(SIGPIPE, SIG_IGN);
 
+	/* recycle timer */
+	sccp_close.cb = sccp_close_unconfirmed;
+	sccp_close.data = NULL;
+	bsc_schedule_timer(&sccp_close, SCCP_CLOSE_TIME, 0);
+
 	while (1) {
 		bsc_select_main(0);
 	}

openbsc/src/nat/bsc_nat_utils.c

@@ -30,6 +30,7 @@
 
 #include <osmocore/linuxlist.h>
 #include <osmocore/talloc.h>
+#include <osmocore/gsm0808.h>
 
 #include <sccp/sccp.h>
 
@@ -45,9 +46,28 @@ struct bsc_nat *bsc_nat_alloc(void)
 	INIT_LLIST_HEAD(&nat->sccp_connections);
 	INIT_LLIST_HEAD(&nat->bsc_connections);
 	INIT_LLIST_HEAD(&nat->bsc_configs);
+	INIT_LLIST_HEAD(&nat->access_lists);
+
+	nat->stats.sccp.conn = counter_alloc("nat.sccp.conn");
+	nat->stats.sccp.calls = counter_alloc("nat.sccp.calls");
+	nat->stats.bsc.reconn = counter_alloc("nat.bsc.conn");
+	nat->stats.bsc.auth_fail = counter_alloc("nat.bsc.auth_fail");
+	nat->stats.msc.reconn = counter_alloc("nat.msc.conn");
+	nat->msc_ip = talloc_strdup(nat, "127.0.0.1");
+	nat->msc_port = 5000;
+	nat->auth_timeout = 2;
+	nat->ping_timeout = 20;
+	nat->pong_timeout = 5;
 	return nat;
 }
 
+void bsc_nat_set_msc_ip(struct bsc_nat *nat, const char *ip)
+{
+	if (nat->msc_ip)
+		talloc_free(nat->msc_ip);
+	nat->msc_ip = talloc_strdup(nat, ip);
+}
+
 struct bsc_connection *bsc_connection_alloc(struct bsc_nat *nat)
 {
 	struct bsc_connection *con = talloc_zero(nat, struct bsc_connection);
@@ -55,6 +75,7 @@ struct bsc_connection *bsc_connection_alloc(struct bsc_nat *nat)
 		return NULL;
 
 	con->nat = nat;
+	write_queue_init(&con->write_queue, 100);
 	return con;
 }
 
@@ -69,9 +90,13 @@ struct bsc_config *bsc_config_alloc(struct bsc_nat *nat, const char *token, unsi
 	conf->nr = nat->num_bsc;
 	conf->nat = nat;
 
-	llist_add(&conf->entry, &nat->bsc_configs);
+	llist_add_tail(&conf->entry, &nat->bsc_configs);
 	++nat->num_bsc;
 
+	conf->stats.sccp.conn = counter_alloc("nat.bsc.sccp.conn");
+	conf->stats.sccp.calls = counter_alloc("nat.bsc.sccp.calls");
+	conf->stats.net.reconn = counter_alloc("nat.bsc.net.reconnects");
+
 	return conf;
 }
 
@@ -80,12 +105,12 @@ void sccp_connection_destroy(struct sccp_connections *conn)
 	LOGP(DNAT, LOGL_DEBUG, "Destroy 0x%x <-> 0x%x mapping for con %p\n",
 	     sccp_src_ref_to_int(&conn->real_ref),
 	     sccp_src_ref_to_int(&conn->patched_ref), conn->bsc);
-	bsc_mgcp_clear(conn);
+	bsc_mgcp_dlcx(conn);
 	llist_del(&conn->list_entry);
 	talloc_free(conn);
 }
 
-struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg)
+struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg, int *lac_out)
 {
 	struct bsc_connection *bsc;
 	int data_length;
@@ -93,6 +118,8 @@ struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg)
 	struct tlv_parsed tp;
 	int i = 0;
 
+	*lac_out = -1;
+
 	if (!msg->l3h || msgb_l3len(msg) < 3) {
 		LOGP(DNAT, LOGL_ERROR, "Paging message is too short.\n");
 		return NULL;
@@ -106,7 +133,11 @@ struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg)
 
 	data_length = TLVP_LEN(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST);
 	data = TLVP_VAL(&tp, GSM0808_IE_CELL_IDENTIFIER_LIST);
-	if (data[0] !=  CELL_IDENT_LAC) {
+
+	/* No need to try a different BSS */
+	if (data[0] == CELL_IDENT_BSS) {
+		return NULL;	
+	} else if (data[0] != CELL_IDENT_LAC) {
 		LOGP(DNAT, LOGL_ERROR, "Unhandled cell ident discrminator: %d\n", data[0]);
 		return NULL;
 	}
@@ -114,6 +145,7 @@ struct bsc_connection *bsc_nat_find_bsc(struct bsc_nat *nat, struct msgb *msg)
 	/* Currently we only handle one BSC */
 	for (i = 1; i < data_length - 1; i += 2) {
 		unsigned int _lac = ntohs(*(unsigned int *) &data[i]);
+		*lac_out = _lac;
 		llist_for_each_entry(bsc, &nat->bsc_connections, list_entry) {
 			if (!bsc->cfg)
 				continue;
@@ -146,13 +178,13 @@ int bsc_write_mgcp(struct bsc_connection *bsc, const u_int8_t *data, unsigned in
 	msg->l3h = msgb_put(msg, length);
 	memcpy(msg->l3h, data, length);
 
-        return bsc_write_mgcp_msg(bsc, msg);
+        return bsc_write(bsc, msg, NAT_IPAC_PROTO_MGCP);
 }
 
-int bsc_write_mgcp_msg(struct bsc_connection *bsc, struct msgb *msg)
+int bsc_write(struct bsc_connection *bsc, struct msgb *msg, int proto)
 {
 	/* prepend the header */
-	ipaccess_prepend_header(msg, NAT_IPAC_PROTO_MGCP);
+	ipaccess_prepend_header(msg, proto);
 
 	if (write_queue_enqueue(&bsc->write_queue, msg) != 0) {
 		LOGP(DINP, LOGL_ERROR, "Failed to enqueue the write.\n");
@@ -163,3 +195,297 @@ int bsc_write_mgcp_msg(struct bsc_connection *bsc, struct msgb *msg)
 	return 0;
 }
 
+static int lst_check_allow(struct bsc_nat_acc_lst *lst, const char *mi_string)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (!entry->imsi_allow)
+			continue;
+		if (regexec(&entry->imsi_allow_re, mi_string, 0, NULL, 0) == 0)
+			return 0;
+	}
+
+	return 1;
+}
+
+static int lst_check_deny(struct bsc_nat_acc_lst *lst, const char *mi_string)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (!entry->imsi_deny)
+			continue;
+		if (regexec(&entry->imsi_deny_re, mi_string, 0, NULL, 0) == 0)
+			return 0;
+	}
+
+	return 1;
+}
+
+/* apply white/black list */
+static int auth_imsi(struct bsc_connection *bsc, const char *mi_string)
+{
+	/*
+	 * Now apply blacklist/whitelist of the BSC and the NAT.
+	 * 1.) Reject if the IMSI is not allowed at the BSC
+	 * 2.) Allow directly if the IMSI is allowed at the BSC
+	 * 3.) Reject if the IMSI not allowed at the global level.
+	 * 4.) Allow directly if the IMSI is allowed at the global level
+	 */
+	struct bsc_nat_acc_lst *nat_lst = NULL;
+	struct bsc_nat_acc_lst *bsc_lst = NULL;
+
+	bsc_lst = bsc_nat_acc_lst_find(bsc->nat, bsc->cfg->acc_lst_name);
+	nat_lst = bsc_nat_acc_lst_find(bsc->nat, bsc->nat->acc_lst_name);
+
+
+	if (bsc_lst) {
+		/* 1. BSC deny */
+		if (lst_check_deny(bsc_lst, mi_string) == 0) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Filtering %s by imsi_deny on bsc nr: %d.\n", mi_string, bsc->cfg->nr);
+			return -2;
+		}
+
+		/* 2. BSC allow */
+		if (lst_check_allow(bsc_lst, mi_string) == 0)
+			return 0;
+	}
+
+	/* 3. NAT deny */
+	if (nat_lst) {
+		if (lst_check_deny(nat_lst, mi_string) == 0) {
+			LOGP(DNAT, LOGL_ERROR,
+			     "Filtering %s by nat imsi_deny on bsc nr: %d.\n", mi_string, bsc->cfg->nr);
+			return -3;
+		}
+	}
+
+	return 0;
+}
+
+static int _cr_check_loc_upd(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	u_int8_t mi_type;
+	struct gsm48_loc_upd_req *lu;
+	char mi_string[GSM48_MI_SIZE];
+
+	if (length < sizeof(*lu)) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "LU does not fit. Length is %d \n", length);
+		return -1;
+	}
+
+	lu = (struct gsm48_loc_upd_req *) data;
+	mi_type = lu->mi[0] & GSM_MI_TYPE_MASK;
+
+	/*
+	 * We can only deal with the IMSI. This will fail for a phone that
+	 * will send the TMSI of a previous network to us.
+	 */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	gsm48_mi_to_string(mi_string, sizeof(mi_string), lu->mi, lu->mi_len);
+	return auth_imsi(bsc, mi_string);
+}
+
+static int _cr_check_cm_serv_req(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	static const uint32_t classmark_offset =
+				offsetof(struct gsm48_service_request, classmark);
+
+	char mi_string[GSM48_MI_SIZE];
+	uint8_t mi_type;
+	int rc;
+	struct gsm48_service_request *req;
+
+	/* unfortunately in Phase1 the classmark2 length is variable */
+
+	if (length < sizeof(*req)) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "CM Serv Req does not fit. Length is %d\n", length);
+		return -1;
+	}
+
+	req = (struct gsm48_service_request *) data;
+	rc = gsm48_extract_mi((uint8_t *) &req->classmark,
+			      length - classmark_offset, mi_string, &mi_type);
+	if (rc < 0) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to parse the classmark2/mi. error: %d\n", rc);
+		return -1;
+	}
+
+	/* we have to let the TMSI or such pass */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	return auth_imsi(bsc, mi_string);
+}
+
+static int _cr_check_pag_resp(struct bsc_connection *bsc, uint8_t *data, unsigned int length)
+{
+	struct gsm48_pag_resp *resp;
+	char mi_string[GSM48_MI_SIZE];
+	u_int8_t mi_type;
+
+	if (length < sizeof(*resp)) {
+		LOGP(DNAT, LOGL_ERROR, "PAG RESP does not fit. Length was %d.\n", length);
+		return -1;
+	}
+
+	resp = (struct gsm48_pag_resp *) data;
+	if (gsm48_paging_extract_mi(resp, length, mi_string, &mi_type) < 0) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to extract the MI.\n");
+		return -1;
+	}
+
+	/* we need to let it pass for now */
+	if (mi_type != GSM_MI_TYPE_IMSI)
+		return 0;
+
+	return auth_imsi(bsc, mi_string);
+}
+
+/* Filter out CR data... */
+int bsc_nat_filter_sccp_cr(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed, int *con_type)
+{
+	struct tlv_parsed tp;
+	struct gsm48_hdr *hdr48;
+	int hdr48_len;
+	int len;
+
+	*con_type = NAT_CON_TYPE_NONE;
+
+	if (parsed->gsm_type != BSS_MAP_MSG_COMPLETE_LAYER_3) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "Rejecting CR message due wrong GSM Type %d\n", parsed->gsm_type);
+		return -1;
+	}
+
+	/* the parsed has had some basic l3 length check */
+	len = msg->l3h[1];
+	if (msgb_l3len(msg) - 3 < len) {
+		LOGP(DNAT, LOGL_ERROR,
+		     "The CR Data has not enough space...\n");
+		return -1;
+	}
+
+	msg->l4h = &msg->l3h[3];
+	len -= 1;
+
+	tlv_parse(&tp, gsm0808_att_tlvdef(), msg->l4h, len, 0, 0);
+
+	if (!TLVP_PRESENT(&tp, GSM0808_IE_LAYER_3_INFORMATION)) {
+		LOGP(DNAT, LOGL_ERROR, "CR Data does not contain layer3 information.\n");
+		return -1;
+	}
+
+	hdr48_len = TLVP_LEN(&tp, GSM0808_IE_LAYER_3_INFORMATION);
+
+	if (hdr48_len < sizeof(*hdr48)) {
+		LOGP(DNAT, LOGL_ERROR, "GSM48 header does not fit.\n");
+		return -1;
+	}
+
+	hdr48 = (struct gsm48_hdr *) TLVP_VAL(&tp, GSM0808_IE_LAYER_3_INFORMATION);
+
+	if (hdr48->proto_discr == GSM48_PDISC_MM &&
+	    hdr48->msg_type == GSM48_MT_MM_LOC_UPD_REQUEST) {
+		*con_type = NAT_CON_TYPE_LU;
+		return _cr_check_loc_upd(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else if (hdr48->proto_discr == GSM48_PDISC_MM &&
+		  hdr48->msg_type == GSM48_MT_MM_CM_SERV_REQ) {
+		*con_type = NAT_CON_TYPE_CM_SERV_REQ;
+		return _cr_check_cm_serv_req(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else if (hdr48->proto_discr == GSM48_PDISC_RR &&
+		   hdr48->msg_type == GSM48_MT_RR_PAG_RESP) {
+		*con_type = NAT_CON_TYPE_PAG_RESP;
+		return _cr_check_pag_resp(bsc, &hdr48->data[0], hdr48_len - sizeof(*hdr48));
+	} else {
+		/* We only want to filter the above, let other things pass */
+		*con_type = NAT_CON_TYPE_OTHER;
+		return 0;
+	}
+}
+
+void bsc_parse_reg(void *ctx, regex_t *reg, char **imsi, int argc, const char **argv)
+{
+	if (*imsi) {
+		talloc_free(*imsi);
+		*imsi = NULL;
+	}
+	regfree(reg);
+
+	if (argc > 0) {
+		*imsi = talloc_strdup(ctx, argv[0]);
+		regcomp(reg, argv[0], 0);
+	}
+}
+
+static const char *con_types [] = {
+	[NAT_CON_TYPE_NONE] = "n/a",
+	[NAT_CON_TYPE_LU] = "Location Update",
+	[NAT_CON_TYPE_CM_SERV_REQ] = "CM Serv Req",
+	[NAT_CON_TYPE_PAG_RESP] = "Paging Response",
+	[NAT_CON_TYPE_LOCAL_REJECT] = "Local Reject",
+	[NAT_CON_TYPE_OTHER] = "Other",
+};
+
+const char *bsc_con_type_to_string(int type)
+{
+	return con_types[type];
+}
+
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_find(struct bsc_nat *nat, const char *name)
+{
+	struct bsc_nat_acc_lst *lst;
+
+	if (!name)
+		return NULL;
+
+	llist_for_each_entry(lst, &nat->access_lists, list)
+		if (strcmp(lst->name, name) == 0)
+			return lst;
+
+	return NULL;
+}
+
+struct bsc_nat_acc_lst *bsc_nat_acc_lst_get(struct bsc_nat *nat, const char *name)
+{
+	struct bsc_nat_acc_lst *lst;
+
+	lst = bsc_nat_acc_lst_find(nat, name);
+	if (lst)
+		return lst;
+
+	lst = talloc_zero(nat, struct bsc_nat_acc_lst);
+	if (!lst) {
+		LOGP(DNAT, LOGL_ERROR, "Failed to allocate access list");
+		return NULL;
+	}
+
+	INIT_LLIST_HEAD(&lst->fltr_list);
+	lst->name = talloc_strdup(lst, name);
+	llist_add_tail(&lst->list, &nat->access_lists);
+	return lst;
+}
+
+void bsc_nat_acc_lst_delete(struct bsc_nat_acc_lst *lst)
+{
+	llist_del(&lst->list);
+	talloc_free(lst);
+}
+
+struct bsc_nat_acc_lst_entry *bsc_nat_acc_lst_entry_create(struct bsc_nat_acc_lst *lst)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	entry = talloc_zero(lst, struct bsc_nat_acc_lst_entry);
+	if (!entry)
+		return NULL;
+
+	llist_add_tail(&entry->list, &lst->fltr_list);
+	return entry;
+}

openbsc/src/nat/bsc_nat_vty.c

@@ -24,6 +24,7 @@
 #include <vty/vty.h>
 
 #include <openbsc/bsc_nat.h>
+#include <openbsc/bsc_msc.h>
 #include <openbsc/gsm_04_08.h>
 #include <openbsc/mgcp.h>
 #include <openbsc/vty.h>
@@ -48,9 +49,40 @@ static struct cmd_node bsc_node = {
 	1,
 };
 
+static void write_acc_lst(struct vty *vty, struct bsc_nat_acc_lst *lst)
+{
+	struct bsc_nat_acc_lst_entry *entry;
+
+	llist_for_each_entry(entry, &lst->fltr_list, list) {
+		if (entry->imsi_allow)
+			vty_out(vty, " access-list %s imsi-allow %s%s",
+				lst->name, entry->imsi_allow, VTY_NEWLINE);
+		if (entry->imsi_deny)
+			vty_out(vty, " access-list %s imsi-deny %s%s",
+				lst->name, entry->imsi_deny, VTY_NEWLINE);
+	}
+}
+
 static int config_write_nat(struct vty *vty)
 {
+	struct bsc_nat_acc_lst *lst;
+
 	vty_out(vty, "nat%s", VTY_NEWLINE);
+	vty_out(vty, " msc ip %s%s", _nat->msc_ip, VTY_NEWLINE);
+	vty_out(vty, " msc port %d%s", _nat->msc_port, VTY_NEWLINE);
+	vty_out(vty, " timeout auth %d%s", _nat->auth_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout ping %d%s", _nat->ping_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout pong %d%s", _nat->pong_timeout, VTY_NEWLINE);
+	if (_nat->token)
+		vty_out(vty, " token %s%s", _nat->token, VTY_NEWLINE);
+	vty_out(vty, " ip-tos %d%s", _nat->bsc_ip_tos, VTY_NEWLINE);
+	if (_nat->acc_lst_name)
+		vty_out(vty, " access-list-name %s%s", _nat->acc_lst_name, VTY_NEWLINE);
+
+	llist_for_each_entry(lst, &_nat->access_lists, list) {
+		write_acc_lst(vty, lst);
+	}
+
 	return CMD_SUCCESS;
 }
 
@@ -58,7 +90,12 @@ static void config_write_bsc_single(struct vty *vty, struct bsc_config *bsc)
 {
 	vty_out(vty, " bsc %u%s", bsc->nr, VTY_NEWLINE);
 	vty_out(vty, "  token %s%s", bsc->token, VTY_NEWLINE);
-	vty_out(vty, "  lac %u%s", bsc->lac, VTY_NEWLINE);
+	vty_out(vty, "  location_area_code %u%s", bsc->lac, VTY_NEWLINE);
+	vty_out(vty, "  paging forbidden %d%s", bsc->forbid_paging, VTY_NEWLINE);
+	if (bsc->description)
+		vty_out(vty, "  description %s%s", bsc->description, VTY_NEWLINE);
+	if (bsc->acc_lst_name)
+		vty_out(vty, "  access-list-name %s%s", bsc->acc_lst_name, VTY_NEWLINE);
 }
 
 static int config_write_bsc(struct vty *vty)
@@ -71,32 +108,42 @@ static int config_write_bsc(struct vty *vty)
 }
 
 
-DEFUN(show_sccp, show_sccp_cmd, "show connections sccp",
+DEFUN(show_sccp, show_sccp_cmd, "show sccp connections",
       SHOW_STR "Display information about current SCCP connections")
 {
 	struct sccp_connections *con;
+	vty_out(vty, "Listing all opening SCCP connections%s", VTY_NEWLINE);
+
 	llist_for_each_entry(con, &_nat->sccp_connections, list_entry) {
-		vty_out(vty, "SCCP for BSC: Nr: %d lac: %d BSC ref: 0x%x Local ref: 0x%x MSC/BSC mux: 0x%x/0x%x%s",
+		vty_out(vty, "For BSC Nr: %d lac: %d; BSC ref: 0x%x; MUX ref: 0x%x; Network has ref: %d ref: 0x%x MSC/BSC mux: 0x%x/0x%x type: %s%s",
 			con->bsc->cfg ? con->bsc->cfg->nr : -1,
 			con->bsc->cfg ? con->bsc->cfg->lac : -1,
 			sccp_src_ref_to_int(&con->real_ref),
 			sccp_src_ref_to_int(&con->patched_ref),
+			con->has_remote_ref,
+			sccp_src_ref_to_int(&con->remote_ref),
 			con->msc_timeslot, con->bsc_timeslot,
+			bsc_con_type_to_string(con->con_type),
 			VTY_NEWLINE);
 	}
 
 	return CMD_SUCCESS;
 }
 
-DEFUN(show_bsc, show_bsc_cmd, "show connections bsc",
+DEFUN(show_bsc, show_bsc_cmd, "show bsc connections",
       SHOW_STR "Display information about current BSCs")
 {
 	struct bsc_connection *con;
+	struct sockaddr_in sock;
+	socklen_t len = sizeof(sock);
+
 	llist_for_each_entry(con, &_nat->bsc_connections, list_entry) {
-		vty_out(vty, "BSC lac: %d, %d auth: %d fd: %d%s",
+		getpeername(con->write_queue.bfd.fd, (struct sockaddr *) &sock, &len);
+		vty_out(vty, "BSC nr: %d lac: %d auth: %d fd: %d peername: %s%s",
 			con->cfg ? con->cfg->nr : -1,
 			con->cfg ? con->cfg->lac : -1,
-			con->authenticated, con->write_queue.bfd.fd, VTY_NEWLINE);
+			con->authenticated, con->write_queue.bfd.fd,
+			inet_ntoa(sock.sin_addr), VTY_NEWLINE);
 	}
 
 	return CMD_SUCCESS;
@@ -109,11 +156,92 @@ DEFUN(show_bsc_cfg, show_bsc_cfg_cmd, "show bsc config",
 	llist_for_each_entry(conf, &_nat->bsc_configs, entry) {
 		vty_out(vty, "BSC token: '%s' lac: %u nr: %u%s",
 			conf->token, conf->lac, conf->nr, VTY_NEWLINE);
+		if (conf->acc_lst_name)
+			vty_out(vty, " access-list: %s%s",
+				conf->acc_lst_name, VTY_NEWLINE);
+		vty_out(vty, " paging forbidden: %d%s",
+			conf->forbid_paging, VTY_NEWLINE);
+		if (conf->description)
+			vty_out(vty, " description: %s%s", conf->description, VTY_NEWLINE);
+		else
+			vty_out(vty, " No description.%s", VTY_NEWLINE);
+
 	}
 
 	return CMD_SUCCESS;
 }
 
+DEFUN(show_stats,
+      show_stats_cmd,
+      "show statistics [NR]",
+	SHOW_STR "Display network statistics")
+{
+	struct bsc_config *conf;
+
+	int nr = -1;
+
+	if (argc == 1)
+		nr = atoi(argv[0]);
+
+	vty_out(vty, "NAT statistics%s", VTY_NEWLINE);
+	vty_out(vty, " SCCP Connections %lu total, %lu calls%s",
+		counter_get(_nat->stats.sccp.conn),
+		counter_get(_nat->stats.sccp.calls), VTY_NEWLINE);
+	vty_out(vty, " MSC Connections %lu%s",
+		counter_get(_nat->stats.msc.reconn), VTY_NEWLINE);
+	vty_out(vty, " BSC Connections %lu total, %lu auth failed.%s",
+		counter_get(_nat->stats.bsc.reconn),
+		counter_get(_nat->stats.bsc.auth_fail), VTY_NEWLINE);
+
+	llist_for_each_entry(conf, &_nat->bsc_configs, entry) {
+		if (argc == 1 && nr != conf->nr)
+			continue;
+
+		vty_out(vty, " BSC lac: %d nr: %d%s",
+			conf->lac, conf->nr, VTY_NEWLINE);
+		vty_out(vty, "   SCCP Connnections %lu total, %lu calls%s",
+			counter_get(conf->stats.sccp.conn),
+			counter_get(conf->stats.sccp.calls), VTY_NEWLINE);
+		vty_out(vty, "   BSC Connections %lu total%s",
+			counter_get(conf->stats.net.reconn), VTY_NEWLINE);
+	}
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_msc,
+      show_msc_cmd,
+      "show msc connection",
+      SHOW_STR "Show the status of the MSC connection.")
+{
+	if (!_nat->msc_con) {
+		vty_out(vty, "The MSC is not yet configured.\n");
+		return CMD_WARNING;
+	}
+
+	vty_out(vty, "MSC on %s:%d is connected: %d%s\n",
+		_nat->msc_con->ip, _nat->msc_con->port,
+		_nat->msc_con->is_connected, VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+DEFUN(close_bsc,
+      close_bsc_cmd,
+      "close bsc connection BSC_NR",
+      "Close the connection with the BSC identified by the config number.")
+{
+	struct bsc_connection *bsc;
+	int bsc_nr = atoi(argv[0]);
+
+	llist_for_each_entry(bsc, &_nat->bsc_connections, list_entry) {
+		if (!bsc->cfg || bsc->cfg->nr != bsc_nr)
+			continue;
+		bsc_close_connection(bsc);
+		break;
+	}
+
+	return CMD_SUCCESS;
+}
 
 DEFUN(cfg_nat, cfg_nat_cmd, "nat", "Configute the NAT")
 {
@@ -123,8 +251,83 @@ DEFUN(cfg_nat, cfg_nat_cmd, "nat", "Configute the NAT")
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_nat_msc_ip,
+      cfg_nat_msc_ip_cmd,
+      "msc ip A.B.C.D",
+      "Set the IP address of the MSC.")
+{
+	bsc_nat_set_msc_ip(_nat, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_msc_port,
+      cfg_nat_msc_port_cmd,
+      "msc port <1-65500>",
+      "Set the port of the MSC.")
+{
+	_nat->msc_port = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_auth_time,
+      cfg_nat_auth_time_cmd,
+      "timeout auth <1-256>",
+      "The time to wait for an auth response.")
+{
+	_nat->auth_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_ping_time,
+      cfg_nat_ping_time_cmd,
+      "timeout ping NR",
+      "Send a ping every NR seconds. Negative to disable.")
+{
+	_nat->ping_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_pong_time,
+      cfg_nat_pong_time_cmd,
+      "timeout pong NR",
+      "Wait NR seconds for the PONG response. Should be smaller than ping.")
+{
+	_nat->pong_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_token, cfg_nat_token_cmd,
+      "token TOKEN",
+      "Set a token for the NAT")
+{
+	if (_nat->token)
+		talloc_free(_nat->token);
+	_nat->token = talloc_strdup(_nat, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_bsc_ip_tos, cfg_nat_bsc_ip_tos_cmd,
+      "ip-tos <0-255>",
+      "Set the IP_TOS for the BSCs to use\n" "Set the IP_TOS attribute")
+{
+	_nat->bsc_ip_tos = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_nat_acc_lst_name,
+      cfg_nat_acc_lst_name_cmd,
+      "access-list-name NAME",
+      "Set the name of the access list to use.\n"
+      "The name of the to be used access list.")
+{
+	if (_nat->acc_lst_name)
+		talloc_free(_nat->acc_lst_name);
+	_nat->acc_lst_name = talloc_strdup(_nat, argv[0]);
+	return CMD_SUCCESS;
+}
+
 /* per BSC configuration */
-DEFUN(cfg_bsc, cfg_bsc_cmd, "bsc BSC_NR", "Select a BSC to configure\n")
+DEFUN(cfg_bsc, cfg_bsc_cmd, "bsc BSC_NR", "Select a BSC to configure")
 {
 	int bsc_nr = atoi(argv[0]);
 	struct bsc_config *bsc;
@@ -159,19 +362,13 @@ DEFUN(cfg_bsc_token, cfg_bsc_token_cmd, "token TOKEN", "Set the token")
 }
 
 DEFUN(cfg_bsc_lac, cfg_bsc_lac_cmd, "location_area_code <0-65535>",
-      "Set the Location Area Code (LAC) of this BSC\n")
+      "Set the Location Area Code (LAC) of this BSC")
 {
 	struct bsc_config *tmp;
 	struct bsc_config *conf = vty->index;
 
 	int lac = atoi(argv[0]);
 
-	if (lac < 0 || lac > 0xffff) {
-		vty_out(vty, "%% LAC %d is not in the valid range (0-65535)%s",
-			lac, VTY_NEWLINE);
-		return CMD_WARNING;
-	}
-
 	if (lac == GSM_LAC_RESERVED_DETACHED || lac == GSM_LAC_RESERVED_ALL_BTS) {
 		vty_out(vty, "%% LAC %d is reserved by GSM 04.08%s",
 			lac, VTY_NEWLINE);
@@ -191,6 +388,126 @@ DEFUN(cfg_bsc_lac, cfg_bsc_lac_cmd, "location_area_code <0-65535>",
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_lst_imsi_allow,
+      cfg_lst_imsi_allow_cmd,
+      "access-list NAME imsi-allow [REGEXP]",
+      "Allow IMSIs matching the REGEXP\n"
+      "The name of the access-list\n"
+      "The regexp of allowed IMSIs\n")
+{
+	struct bsc_nat_acc_lst *acc;
+	struct bsc_nat_acc_lst_entry *entry;
+
+	acc = bsc_nat_acc_lst_get(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	entry = bsc_nat_acc_lst_entry_create(acc);
+	if (!entry)
+		return CMD_WARNING;
+
+	bsc_parse_reg(acc, &entry->imsi_allow_re, &entry->imsi_allow, argc - 1, &argv[1]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_lst_imsi_deny,
+      cfg_lst_imsi_deny_cmd,
+      "access-list NAME imsi-deny [REGEXP]",
+      "Allow IMSIs matching the REGEXP\n"
+      "The name of the access-list\n"
+      "The regexp of to be denied IMSIs\n")
+{
+	struct bsc_nat_acc_lst *acc;
+	struct bsc_nat_acc_lst_entry *entry;
+
+	acc = bsc_nat_acc_lst_get(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	entry = bsc_nat_acc_lst_entry_create(acc);
+	if (!entry)
+		return CMD_WARNING;
+
+	bsc_parse_reg(acc, &entry->imsi_deny_re, &entry->imsi_deny, argc - 1, &argv[1]);
+	return CMD_SUCCESS;
+}
+
+/* naming to follow Zebra... */
+DEFUN(cfg_lst_no,
+      cfg_lst_no_cmd,
+      "no access-list NAME",
+      NO_STR "Remove an access-list by name\n"
+      "The access-list to remove\n")
+{
+	struct bsc_nat_acc_lst *acc;
+	acc = bsc_nat_acc_lst_find(_nat, argv[0]);
+	if (!acc)
+		return CMD_WARNING;
+
+	bsc_nat_acc_lst_delete(acc);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_acc_lst_name,
+      cfg_bsc_acc_lst_name_cmd,
+      "access-list-name NAME",
+      "Set the name of the access list to use.\n"
+      "The name of the to be used access list.")
+{
+	struct bsc_config *conf = vty->index;
+
+	if (conf->acc_lst_name)
+		talloc_free(conf->acc_lst_name);
+	conf->acc_lst_name = talloc_strdup(conf, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_paging,
+      cfg_bsc_paging_cmd,
+      "paging forbidden (0|1)",
+      "Forbid sending PAGING REQUESTS to the BSC.")
+{
+	struct bsc_config *conf = vty->index;
+
+	if (strcmp("1", argv[0]) == 0)
+		conf->forbid_paging = 1;
+	else
+		conf->forbid_paging = 0;
+
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bsc_desc,
+      cfg_bsc_desc_cmd,
+      "description DESC",
+      "Provide a description for the given BSC.")
+{
+	struct bsc_config *conf = vty->index;
+
+	if (conf->description)
+		talloc_free(conf->description);
+	conf->description = talloc_strdup(conf, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(test_regex, test_regex_cmd,
+      "test regex PATTERN STRING",
+      "Check if the string is matching the current pattern.")
+{
+	regex_t reg;
+	char *str = NULL;
+
+	memset(&reg, 0, sizeof(reg));
+	bsc_parse_reg(_nat, &reg, &str, 1, argv);
+
+	vty_out(vty, "String matches allow pattern: %d%s",
+		regexec(&reg, argv[1], 0, NULL, 0) == 0, VTY_NEWLINE);
+
+	talloc_free(str);
+	regfree(&reg);
+	return CMD_SUCCESS;
+}
+
 int bsc_nat_vty_init(struct bsc_nat *nat)
 {
 	_nat = nat;
@@ -202,6 +519,10 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_element(VIEW_NODE, &show_sccp_cmd);
 	install_element(VIEW_NODE, &show_bsc_cmd);
 	install_element(VIEW_NODE, &show_bsc_cfg_cmd);
+	install_element(VIEW_NODE, &show_stats_cmd);
+	install_element(VIEW_NODE, &close_bsc_cmd);
+	install_element(VIEW_NODE, &show_msc_cmd);
+	install_element(VIEW_NODE, &test_regex_cmd);
 
 	openbsc_vty_add_cmds();
 
@@ -209,6 +530,19 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_element(CONFIG_NODE, &cfg_nat_cmd);
 	install_node(&nat_node, config_write_nat);
 	install_default(NAT_NODE);
+	install_element(NAT_NODE, &cfg_nat_msc_ip_cmd);
+	install_element(NAT_NODE, &cfg_nat_msc_port_cmd);
+	install_element(NAT_NODE, &cfg_nat_auth_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_ping_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_pong_time_cmd);
+	install_element(NAT_NODE, &cfg_nat_token_cmd);
+	install_element(NAT_NODE, &cfg_nat_bsc_ip_tos_cmd);
+	install_element(NAT_NODE, &cfg_nat_acc_lst_name_cmd);
+
+	/* access-list */
+	install_element(NAT_NODE, &cfg_lst_imsi_allow_cmd);
+	install_element(NAT_NODE, &cfg_lst_imsi_deny_cmd);
+	install_element(NAT_NODE, &cfg_lst_no_cmd);
 
 	/* BSC subgroups */
 	install_element(NAT_NODE, &cfg_bsc_cmd);
@@ -216,6 +550,9 @@ int bsc_nat_vty_init(struct bsc_nat *nat)
 	install_default(BSC_NODE);
 	install_element(BSC_NODE, &cfg_bsc_token_cmd);
 	install_element(BSC_NODE, &cfg_bsc_lac_cmd);
+	install_element(BSC_NODE, &cfg_bsc_paging_cmd);
+	install_element(BSC_NODE, &cfg_bsc_desc_cmd);
+	install_element(BSC_NODE, &cfg_bsc_acc_lst_name_cmd);
 
 	mgcp_vty_init();
 

openbsc/src/nat/bsc_sccp.c

@@ -28,6 +28,7 @@
 #include <osmocore/talloc.h>
 
 #include <string.h>
+#include <time.h>
 
 static int equal(struct sccp_source_reference *ref1, struct sccp_source_reference *ref2)
 {
@@ -81,31 +82,60 @@ static int assign_src_local_reference(struct sccp_source_reference *ref, struct
 	return -1;
 }
 
-int create_sccp_src_ref(struct bsc_connection *bsc, struct msgb *msg, struct bsc_nat_parsed *parsed)
+struct sccp_connections *create_sccp_src_ref(struct bsc_connection *bsc,
+					     struct bsc_nat_parsed *parsed)
 {
 	struct sccp_connections *conn;
 
+	/* Some commercial BSCs like to reassign there SRC ref */
+	llist_for_each_entry(conn, &bsc->nat->sccp_connections, list_entry) {
+		if (conn->bsc != bsc)
+			continue;
+		if (memcmp(&conn->real_ref, parsed->src_local_ref, sizeof(conn->real_ref)) != 0)
+			continue;
+
+		/* the BSC has reassigned the SRC ref and we failed to keep track */
+		memset(&conn->remote_ref, 0, sizeof(conn->remote_ref));
+		if (assign_src_local_reference(&conn->patched_ref, bsc->nat) != 0) {
+			LOGP(DNAT, LOGL_ERROR, "BSC %d reused src ref: %d and we failed to generate a new id.\n",
+			     bsc->cfg->nr, sccp_src_ref_to_int(parsed->src_local_ref));
+			bsc_mgcp_dlcx(conn);
+			llist_del(&conn->list_entry);
+			talloc_free(conn);
+			return NULL;
+		} else {
+			clock_gettime(CLOCK_MONOTONIC, &conn->creation_time);
+			bsc_mgcp_dlcx(conn);
+			return conn;
+		}
+	}
+
+
 	conn = talloc_zero(bsc->nat, struct sccp_connections);
 	if (!conn) {
 		LOGP(DNAT, LOGL_ERROR, "Memory allocation failure.\n");
-		return -1;
+		return NULL;
 	}
 
 	conn->bsc = bsc;
+	clock_gettime(CLOCK_MONOTONIC, &conn->creation_time);
 	conn->real_ref = *parsed->src_local_ref;
 	if (assign_src_local_reference(&conn->patched_ref, bsc->nat) != 0) {
 		LOGP(DNAT, LOGL_ERROR, "Failed to assign a ref.\n");
 		talloc_free(conn);
-		return -1;
+		return NULL;
 	}
 
-	llist_add(&conn->list_entry, &bsc->nat->sccp_connections);
+	bsc_mgcp_init(conn);
+	llist_add_tail(&conn->list_entry, &bsc->nat->sccp_connections);
+	counter_inc(bsc->cfg->stats.sccp.conn);
+	counter_inc(bsc->cfg->nat->stats.sccp.conn);
 
 	LOGP(DNAT, LOGL_DEBUG, "Created 0x%x <-> 0x%x mapping for con %p\n",
 	     sccp_src_ref_to_int(&conn->real_ref),
 	     sccp_src_ref_to_int(&conn->patched_ref), bsc);
 
-	return 0;
+	return conn;
 }
 
 int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *parsed)
@@ -116,6 +146,7 @@ int update_sccp_src_ref(struct sccp_connections *sccp, struct bsc_nat_parsed *pa
 	}
 
 	sccp->remote_ref = *parsed->src_local_ref;
+	sccp->has_remote_ref = 1;
 	LOGP(DNAT, LOGL_DEBUG, "Updating 0x%x to remote 0x%x on %p\n",
 	     sccp_src_ref_to_int(&sccp->patched_ref),
 	     sccp_src_ref_to_int(&sccp->remote_ref), sccp->bsc);
@@ -179,11 +210,14 @@ struct sccp_connections *patch_sccp_src_ref_to_bsc(struct msgb *msg,
  */
 struct sccp_connections *patch_sccp_src_ref_to_msc(struct msgb *msg,
 						   struct bsc_nat_parsed *parsed,
-						   struct bsc_nat *nat)
+						   struct bsc_connection *bsc)
 {
 	struct sccp_connections *conn;
 
-	llist_for_each_entry(conn, &nat->sccp_connections, list_entry) {
+	llist_for_each_entry(conn, &bsc->nat->sccp_connections, list_entry) {
+		if (conn->bsc != bsc)
+			continue;
+
 		if (parsed->src_local_ref) {
 			if (equal(parsed->src_local_ref, &conn->real_ref)) {
 				*parsed->src_local_ref = conn->patched_ref;

openbsc/src/openbsc.cfg.nanobts

@@ -1,6 +1,6 @@
 !
 ! OpenBSC configuration saved from vty
-!
+!   !
 password foo
 !
 line vty
@@ -11,17 +11,52 @@ network
  mobile network code 1
  short name OpenBSC
  long name OpenBSC
+ auth policy closed
+ location updating reject cause 13
+ encryption a5 0
+ neci 0
+ rrlp mode none
+ mm info 1
+ handover 0
+ handover window rxlev averaging 10
+ handover window rxqual averaging 1
+ handover window rxlev neighbor averaging 10
+ handover power budget interval 6
+ handover power budget hysteresis 3
+ handover maximum distance 9999
  timer t3101 10
+ timer t3103 0
+ timer t3105 0
+ timer t3107 0
+ timer t3109 0
+ timer t3111 0
  timer t3113 60
+ timer t3115 0
+ timer t3117 0
+ timer t3119 0
+ timer t3141 0
  bts 0
   type nanobts
-  ip.access unit_id 1801 0
-  band GSM1800
+  band DCS1800
+  cell_identity 0
   location_area_code 1
   training_sequence_code 7
   base_station_id_code 63
+  ms max power 15
+  cell reselection hysteresis 4
+  rxlev access min 0
+  channel allocator ascending
+  rach tx integer 9
+  rach max transmission 7
+  ip.access unit_id 1801 0
+  oml ip.access stream_id 255
+  gprs mode none
   trx 0
+   rf_locked 0
    arfcn 514
+   nominal power 23
+   max_power_red 20
+   rsl e1 tei 0
     timeslot 0
      phys_chan_config CCCH+SDCCH4
     timeslot 1

openbsc/src/openbsc.cfg.nanobts.multitrx

@@ -0,0 +1,97 @@
+!
+! OpenBSC configuration saved from vty
+!   !
+password foo
+!
+line vty
+ no login
+!
+network
+ network country code 1
+ mobile network code 1
+ short name OpenBSC
+ long name OpenBSC
+ auth policy closed
+ location updating reject cause 13
+ encryption a5 0
+ neci 0
+ rrlp mode none
+ mm info 0
+ handover 0
+ handover window rxlev averaging 10
+ handover window rxqual averaging 1
+ handover window rxlev neighbor averaging 10
+ handover power budget interval 6
+ handover power budget hysteresis 3
+ handover maximum distance 9999
+ timer t3101 10
+ timer t3103 0
+ timer t3105 0
+ timer t3107 0
+ timer t3109 0
+ timer t3111 0
+ timer t3113 60
+ timer t3115 0
+ timer t3117 0
+ timer t3119 0
+ timer t3141 0
+ bts 0
+  type nanobts
+  band DCS1800
+  cell_identity 0
+  location_area_code 1
+  training_sequence_code 7
+  base_station_id_code 63
+  ms max power 15
+  cell reselection hysteresis 4
+  rxlev access min 0
+  channel allocator ascending
+  rach tx integer 9
+  rach max transmission 7
+  ip.access unit_id 1800 0
+  oml ip.access stream_id 255
+  gprs mode none
+  trx 0
+   rf_locked 0
+   arfcn 871
+   nominal power 23
+   max_power_red 0
+   rsl e1 tei 0
+    timeslot 0
+     phys_chan_config CCCH+SDCCH4
+    timeslot 1
+     phys_chan_config SDCCH8
+    timeslot 2
+     phys_chan_config TCH/F
+    timeslot 3
+     phys_chan_config TCH/F
+    timeslot 4
+     phys_chan_config TCH/F
+    timeslot 5
+     phys_chan_config TCH/F
+    timeslot 6
+     phys_chan_config TCH/F
+    timeslot 7
+     phys_chan_config TCH/F
+  trx 1
+   rf_locked 0
+   arfcn 873
+   nominal power 23
+   max_power_red 0
+   rsl e1 tei 0
+    timeslot 0
+     phys_chan_config CCCH+SDCCH4
+    timeslot 1
+     phys_chan_config SDCCH8
+    timeslot 2
+     phys_chan_config TCH/F
+    timeslot 3
+     phys_chan_config TCH/F
+    timeslot 4
+     phys_chan_config TCH/F
+    timeslot 5
+     phys_chan_config TCH/F
+    timeslot 6
+     phys_chan_config TCH/F
+    timeslot 7
+     phys_chan_config TCH/F

openbsc/src/paging.c

@@ -45,9 +45,12 @@
 #include <openbsc/signal.h>
 #include <openbsc/abis_rsl.h>
 #include <openbsc/gsm_data.h>
+#include <openbsc/chan_alloc.h>
 
 void *tall_paging_ctx;
 
+#define PAGING_TIMER 0, 500000
+
 static unsigned int calculate_group(struct gsm_bts *bts, struct gsm_subscriber *subscr)
 {
 	int ccch_conf;
@@ -70,14 +73,6 @@ static unsigned int calculate_group(struct gsm_bts *bts, struct gsm_subscriber *
 static void paging_remove_request(struct gsm_bts_paging_state *paging_bts,
 				struct gsm_paging_request *to_be_deleted)
 {
-	/* Update the last_request if that is necessary */
-	if (to_be_deleted == paging_bts->last_request) {
-		paging_bts->last_request =
-			(struct gsm_paging_request *)paging_bts->last_request->entry.next;
-		if (&to_be_deleted->entry == &paging_bts->pending_requests)
-			paging_bts->last_request = NULL;
-	}
-
 	bsc_del_timer(&to_be_deleted->T3113);
 	llist_del(&to_be_deleted->entry);
 	subscr_put(to_be_deleted->subscr);
@@ -90,7 +85,7 @@ static void page_ms(struct gsm_paging_request *request)
 	unsigned int mi_len;
 	unsigned int page_group;
 
-	DEBUGP(DPAG, "Going to send paging commands: imsi: '%s' tmsi: '0x%x'\n",
+	LOGP(DPAG, LOGL_INFO, "Going to send paging commands: imsi: '%s' tmsi: '0x%x'\n",
 		request->subscr->imsi, request->subscr->tmsi);
 
 	if (request->subscr->tmsi == GSM_RESERVED_TMSI)
@@ -103,12 +98,70 @@ static void page_ms(struct gsm_paging_request *request)
 			request->chan_type);
 }
 
-static void paging_move_to_next(struct gsm_bts_paging_state *paging_bts)
+static void paging_schedule_if_needed(struct gsm_bts_paging_state *paging_bts)
 {
-	paging_bts->last_request =
-		(struct gsm_paging_request *)paging_bts->last_request->entry.next;
-	if (&paging_bts->last_request->entry == &paging_bts->pending_requests)
-		paging_bts->last_request = NULL;
+	if (llist_empty(&paging_bts->pending_requests))
+		return;
+
+	if (!bsc_timer_pending(&paging_bts->work_timer))
+		bsc_schedule_timer(&paging_bts->work_timer, PAGING_TIMER);
+}
+
+
+static void paging_handle_pending_requests(struct gsm_bts_paging_state *paging_bts);
+static void paging_give_credit(void *data)
+{
+	struct gsm_bts_paging_state *paging_bts = data;
+
+	LOGP(DPAG, LOGL_NOTICE, "No slots available on bts nr %d\n", paging_bts->bts->nr);
+	paging_bts->available_slots = 20;
+	paging_handle_pending_requests(paging_bts);
+}
+
+static int can_send_pag_req(struct gsm_bts *bts, int rsl_type)
+{
+	struct pchan_load pl;
+	int count;
+
+	memset(&pl, 0, sizeof(pl));
+	bts_chan_load(&pl, bts);
+
+	switch (rsl_type) {
+	case RSL_CHANNEED_TCH_F:
+	case RSL_CHANNEED_TCH_ForH:
+		goto count_tch;
+		break;
+	case RSL_CHANNEED_SDCCH:
+		goto count_sdcch;
+		break;
+	case RSL_CHANNEED_ANY:
+	default:
+		if (bts->network->pag_any_tch)
+			goto count_tch;
+		else
+			goto count_sdcch;
+		break;
+	}
+
+	return 0;
+
+	/* could available SDCCH */
+count_sdcch:
+	count = 0;
+	count += pl.pchan[GSM_PCHAN_SDCCH8_SACCH8C].total
+			- pl.pchan[GSM_PCHAN_SDCCH8_SACCH8C].used;
+	count += pl.pchan[GSM_PCHAN_CCCH_SDCCH4].total
+			- pl.pchan[GSM_PCHAN_CCCH_SDCCH4].used;
+	return bts->paging.free_chans_need > count;
+
+count_tch:
+	count = 0;
+	count += pl.pchan[GSM_PCHAN_TCH_F].total
+			- pl.pchan[GSM_PCHAN_TCH_F].used;
+	if (bts->network->neci)
+		count += pl.pchan[GSM_PCHAN_TCH_H].total
+				- pl.pchan[GSM_PCHAN_TCH_H].used;
+	return bts->paging.free_chans_need > count;
 }
 
 /*
@@ -120,47 +173,49 @@ static void paging_move_to_next(struct gsm_bts_paging_state *paging_bts)
  */
 static void paging_handle_pending_requests(struct gsm_bts_paging_state *paging_bts)
 {
-	struct gsm_paging_request *initial_request = NULL;
-	struct gsm_paging_request *current_request = NULL;
+	struct gsm_paging_request *request = NULL;
 
 	/*
 	 * Determine if the pending_requests list is empty and
 	 * return then.
 	 */
 	if (llist_empty(&paging_bts->pending_requests)) {
-		paging_bts->last_request = NULL;
 		/* since the list is empty, no need to reschedule the timer */
 		return;
 	}
 
-	if (!paging_bts->last_request)
-		paging_bts->last_request =
-			(struct gsm_paging_request *)paging_bts->pending_requests.next;
+	/*
+	 * In case the BTS does not provide us with load indication and we
+	 * ran out of slots, call an autofill routine. It might be that the
+	 * BTS did not like our paging messages and then we have counted down
+	 * to zero and we do not get any messages.
+	 */
+	if (paging_bts->available_slots == 0) {
+		paging_bts->credit_timer.cb = paging_give_credit;
+		paging_bts->credit_timer.data = paging_bts;
+		bsc_schedule_timer(&paging_bts->credit_timer, 5, 0);
+		return;
+	}
 
-	assert(paging_bts->last_request);
-	initial_request = paging_bts->last_request;
-	current_request = initial_request;
+	request = llist_entry(paging_bts->pending_requests.next,
+			      struct gsm_paging_request, entry);
 
-	do {
-		/* handle the paging request now */
-		page_ms(current_request);
-		paging_bts->available_slots--;
+	/* we need to determine the number of free channels */
+	if (paging_bts->free_chans_need != -1) {
+		if (can_send_pag_req(request->bts, request->chan_type) != 0)
+			goto skip_paging;
+	}
 
-		/*
-		 * move to the next item. We might wrap around
-		 * this means last_request will be NULL and we just
-		 * call paging_page_to_next again. It it guranteed
-		 * that the list is not empty.
-		 */
-		paging_move_to_next(paging_bts);
-		if (!paging_bts->last_request)
-			paging_bts->last_request =
-				(struct gsm_paging_request *)paging_bts->pending_requests.next;
-		current_request = paging_bts->last_request;
-	} while (paging_bts->available_slots > 0
-		    &&  initial_request != current_request);
+	/* handle the paging request now */
+	page_ms(request);
+	paging_bts->available_slots--;
 
-	bsc_schedule_timer(&paging_bts->work_timer, 2, 0);
+	/* take the current and add it to the back */
+	llist_del(&request->entry);
+	llist_add_tail(&request->entry, &paging_bts->pending_requests);
+
+skip_paging:
+	bsc_schedule_timer(&paging_bts->work_timer, PAGING_TIMER);
 }
 
 static void paging_worker(void *data)
@@ -178,7 +233,7 @@ void paging_init(struct gsm_bts *bts)
 	bts->paging.work_timer.data = &bts->paging;
 
 	/* Large number, until we get a proper message */
-	bts->paging.available_slots = 100;
+	bts->paging.available_slots = 20;
 }
 
 static int paging_pending_request(struct gsm_bts_paging_state *bts,
@@ -200,7 +255,7 @@ static void paging_T3113_expired(void *data)
 	void *cbfn_param;
 	gsm_cbfn *cbfn;
 
-	DEBUGP(DPAG, "T3113 expired for request %p (%s)\n",
+	LOGP(DPAG, LOGL_INFO, "T3113 expired for request %p (%s)\n",
 		req, req->subscr->imsi);
 	
 	sig_data.subscr = req->subscr;
@@ -208,11 +263,11 @@ static void paging_T3113_expired(void *data)
 	sig_data.lchan	= NULL;
 
 	/* must be destroyed before calling cbfn, to prevent double free */
+	counter_inc(req->bts->network->stats.paging.expired);
 	cbfn_param = req->cbfn_param;
 	cbfn = req->cbfn;
 	paging_remove_request(&req->bts->paging, req);
 
-	counter_inc(req->bts->network->stats.paging.expired);
 
 	dispatch_signal(SS_PAGING, S_PAGING_EXPIRED, &sig_data);
 	if (cbfn)
@@ -227,11 +282,11 @@ static int _paging_request(struct gsm_bts *bts, struct gsm_subscriber *subscr,
 	struct gsm_paging_request *req;
 
 	if (paging_pending_request(bts_entry, subscr)) {
-		DEBUGP(DPAG, "Paging request already pending\n");
+		LOGP(DPAG, LOGL_INFO, "Paging request already pending for %s\n", subscr->imsi);
 		return -EEXIST;
 	}
 
-	DEBUGP(DPAG, "Start paging of subscriber %llu on bts %d.\n",
+	LOGP(DPAG, LOGL_DEBUG, "Start paging of subscriber %llu on bts %d.\n",
 		subscr->id, bts->nr);
 	req = talloc_zero(tall_paging_ctx, struct gsm_paging_request);
 	req->subscr = subscr_get(subscr);
@@ -243,9 +298,7 @@ static int _paging_request(struct gsm_bts *bts, struct gsm_subscriber *subscr,
 	req->T3113.data = req;
 	bsc_schedule_timer(&req->T3113, bts->network->T3113, 0);
 	llist_add_tail(&req->entry, &bts_entry->pending_requests);
-
-	if (!bsc_timer_pending(&bts_entry->work_timer))
-		bsc_schedule_timer(&bts_entry->work_timer, 2, 0);
+	paging_schedule_if_needed(bts_entry);
 
 	return 0;
 }
@@ -296,11 +349,11 @@ static void _paging_request_stop(struct gsm_bts *bts, struct gsm_subscriber *sub
 				 entry) {
 		if (req->subscr == subscr) {
 			if (lchan && req->cbfn) {
-				DEBUGP(DPAG, "Stop paging on bts %d, calling cbfn.\n", bts->nr);
+				LOGP(DPAG, LOGL_DEBUG, "Stop paging on bts %d, calling cbfn.\n", bts->nr);
 				req->cbfn(GSM_HOOK_RR_PAGING, GSM_PAGING_SUCCEEDED,
 					  NULL, lchan, req->cbfn_param);
 			} else
-				DEBUGP(DPAG, "Stop paging on bts %d silently.\n", bts->nr);
+				LOGP(DPAG, LOGL_DEBUG, "Stop paging on bts %d silently.\n", bts->nr);
 			paging_remove_request(&bts->paging, req);
 			break;
 		}
@@ -328,12 +381,26 @@ void paging_request_stop(struct gsm_bts *_bts, struct gsm_subscriber *subscr,
 			break;
 
 		/* Stop paging */
-                if (bts != _bts)
+		if (bts != _bts)
 			_paging_request_stop(bts, subscr, NULL);
 	} while (1);
 }
 
 void paging_update_buffer_space(struct gsm_bts *bts, u_int16_t free_slots)
 {
+	bsc_del_timer(&bts->paging.credit_timer);
 	bts->paging.available_slots = free_slots;
+	paging_schedule_if_needed(&bts->paging);
+}
+
+unsigned int paging_pending_requests_nr(struct gsm_bts *bts)
+{
+	unsigned int requests = 0;
+
+	struct gsm_paging_request *req;
+
+	llist_for_each_entry(req, &bts->paging.pending_requests, entry)
+		++requests;
+
+	return requests;
 }

openbsc/src/rest_octets.c

@@ -133,6 +133,7 @@ static int append_lsa_params(struct bitvec *bv,
 			     const struct gsm48_lsa_params *lsa_params)
 {
 	/* FIXME */
+	return -1;
 }
 
 /* Generate SI4 Rest Octets (Chapter 10.5.2.35) */
@@ -315,11 +316,42 @@ static int append_gprs_cell_opt(struct bitvec *bv,
 	bitvec_set_bit(bv, 1);
 	bitvec_set_uint(bv, gco->bs_cv_max, 4);
 
-	/* hard-code no PAN_{DEC,INC,MAX} */
-	bitvec_set_bit(bv, 0);
+	if (0) {
+		/* hard-code no PAN_{DEC,INC,MAX} */
+		bitvec_set_bit(bv, 0);
+	} else {
+		/* copied from ip.access BSC protocol trace */
+		bitvec_set_bit(bv, 1);
+		bitvec_set_uint(bv, 1, 3);	/* DEC */
+		bitvec_set_uint(bv, 1, 3);	/* INC */
+		bitvec_set_uint(bv, 15, 3);	/* MAX */
+	}
 
-	/* no extension information (EDGE) */
-	bitvec_set_bit(bv, 0);
+	if (!gco->ext_info_present) {
+		/* no extension information */
+		bitvec_set_bit(bv, 0);
+	} else {
+		/* extension information */
+		bitvec_set_bit(bv, 1);
+		if (!gco->ext_info.egprs_supported) {
+			/* 6bit length of extension */
+			bitvec_set_uint(bv, (1 + 3)-1, 6);
+			/* EGPRS supported in the cell */
+			bitvec_set_bit(bv, 0);
+		} else {
+			/* 6bit length of extension */
+			bitvec_set_uint(bv, (1 + 5 + 3)-1, 6);
+			/* EGPRS supported in the cell */
+			bitvec_set_bit(bv, 1);
+			/* 1bit EGPRS PACKET CHANNEL REQUEST */
+			bitvec_set_bit(bv, gco->ext_info.use_egprs_p_ch_req);
+			/* 4bit BEP PERIOD */
+			bitvec_set_uint(bv, gco->ext_info.bep_period, 4);
+		}
+		bitvec_set_bit(bv, gco->ext_info.pfc_supported);
+		bitvec_set_bit(bv, gco->ext_info.dtm_supported);
+		bitvec_set_bit(bv, gco->ext_info.bss_paging_coordination);
+	}
 
 	return 0;
 }
@@ -334,7 +366,7 @@ static void append_gprs_pwr_ctrl_pars(struct bitvec *bv,
 	bitvec_set_uint(bv, pcp->n_avg_i, 4);
 }
 
-/* Generate SI13 Rest Octests (Chapter 10.5.2.37b) */
+/* Generate SI13 Rest Octests (04.08 Chapter 10.5.2.37b) */
 int rest_octets_si13(u_int8_t *data, const struct gsm48_si13_info *si13)
 {
 	struct bitvec bv;
@@ -390,6 +422,11 @@ int rest_octets_si13(u_int8_t *data, const struct gsm48_si13_info *si13)
 				break;
 			}
 		}
+		/* 3GPP TS 44.018 Release 6 / 10.5.2.37b */
+		bitvec_set_bit(&bv, H);	/* added Release 99 */
+		/* claim our SGSN is compatible with Release 99, as EDGE and EGPRS
+		 * was only added in this Release */
+		bitvec_set_bit(&bv, 1);
 	}
 	bitvec_spare_padding(&bv, (bv.data_len*8)-1);
 	return bv.data_len;

openbsc/src/sccp/sccp.c

@@ -81,7 +81,7 @@ static struct sccp_data_callback *_find_ssn(u_int8_t ssn)
 	/* need to add one */
 	cb = talloc_zero(tall_sccp_ctx, struct sccp_data_callback);
 	if (!cb) {
-		DEBUGP(DSCCP, "Failed to allocate sccp callback.\n");
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate sccp callback.\n");
 		return NULL;
 	}
 
@@ -108,13 +108,13 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	u_int8_t length;
 
 	if (room <= 0) {
-		DEBUGP(DSCCP, "Not enough room for an address: %u\n", room);
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for an address: %u\n", room);
 		return -1;
 	}
 
 	length = msgb->l2h[offset];
 	if (room <= length) {
-		DEBUGP(DSCCP, "Not enough room for optional data %u %u\n", room, length);
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for optional data %u %u\n", room, length);
 		return -1;
 	}
 
@@ -122,7 +122,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	party = (struct sccp_called_party_address *)(msgb->l2h + offset + 1);
 	if (party->point_code_indicator) {
 		if (length <= read + 2) {
-		    DEBUGP(DSCCP, "POI does not fit %u\n", length);
+		    LOGP(DSCCP, LOGL_ERROR, "POI does not fit %u\n", length);
 		    return -1;
 		}
 
@@ -133,7 +133,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 
 	if (party->ssn_indicator) {
 		if (length <= read + 1) {
-		    DEBUGP(DSCCP, "SSN does not fit %u\n", length);
+		    LOGP(DSCCP, LOGL_ERROR, "SSN does not fit %u\n", length);
 		    return -1;
 		}
 
@@ -142,7 +142,7 @@ static int copy_address(struct sccp_address *addr, u_int8_t offset, struct msgb
 	}
 
 	if (party->global_title_indicator) {
-		DEBUGP(DSCCP, "GTI not supported %u\n", *(u_int8_t *)party);
+		LOGP(DSCCP, LOGL_ERROR, "GTI not supported %u\n", *(u_int8_t *)party);
 		return -1;
 	}
 
@@ -156,7 +156,8 @@ static int check_address(struct sccp_address *addr)
 	if (addr->address.ssn_indicator != 1
 	    || addr->address.global_title_indicator == 1
 	    || addr->address.routing_indicator != 1) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR,
+			"Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&addr->address, addr->ssn);
 		return -1;
 	}
@@ -176,7 +177,7 @@ static int _sccp_parse_optional_data(const int offset,
 			return 0;
 
 		if (read + 1 >= room) {
-			DEBUGP(DSCCP, "no place for length\n");
+			LOGP(DSCCP, LOGL_ERROR, "no place for length\n");
 			return 0;
 		}
 
@@ -185,7 +186,8 @@ static int _sccp_parse_optional_data(const int offset,
 
 
 		if (room <= read) {
-			DEBUGP(DSCCP, "no space for the data: type: %d read: %d room: %d l2: %d\n",
+			LOGP(DSCCP, LOGL_ERROR,
+			       "no space for the data: type: %d read: %d room: %d l2: %d\n",
 			       type, read, room, msgb_l2len(msgb));
 			return 0;
 		}
@@ -214,7 +216,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -224,7 +226,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 		return -1;
 
 	if (check_address(&result->called) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 		return -1;
 	}
@@ -236,7 +238,7 @@ int _sccp_parse_connection_request(struct msgb *msgb, struct sccp_parse_result *
 	 */
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + req->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -260,14 +262,14 @@ int _sccp_parse_connection_released(struct msgb *msgb, struct sccp_parse_result
 
 	/* we don't have enough size for the struct */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb > header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb > header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + rls->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -295,7 +297,7 @@ int _sccp_parse_connection_refused(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -306,7 +308,7 @@ int _sccp_parse_connection_refused(struct msgb *msgb, struct sccp_parse_result *
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + ref->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -333,7 +335,7 @@ int _sccp_parse_connection_confirm(struct msgb *msgb, struct sccp_parse_result *
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -344,7 +346,7 @@ int _sccp_parse_connection_confirm(struct msgb *msgb, struct sccp_parse_result *
 
 	memset(&optional_data, 0, sizeof(optional_data));
 	if (_sccp_parse_optional_data(optional_offset + con->optional_start, msgb, &optional_data) != 0) {
-		DEBUGP(DSCCP, "parsing of optional data failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "parsing of optional data failed.\n");
 		return -1;
 	}
 
@@ -366,7 +368,7 @@ int _sccp_parse_connection_release_complete(struct msgb *msgb, struct sccp_parse
 
 	/* header check */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -387,13 +389,13 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 
 	/* we don't have enough size for the struct */
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb > header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb > header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
 
 	if (dt1->segmenting != 0) {
-		DEBUGP(DSCCP, "This packet has segmenting, not supported: %d\n", dt1->segmenting);
+		LOGP(DSCCP, LOGL_ERROR, "This packet has segmenting, not supported: %d\n", dt1->segmenting);
 		return -1;
 	}
 
@@ -401,7 +403,7 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 
 	/* some more  size checks in here */
 	if (msgb_l2len(msgb) < variable_offset + dt1->variable_start + 1) {
-		DEBUGP(DSCCP, "Not enough space for variable start: %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "Not enough space for variable start: %u %u\n",
 			msgb_l2len(msgb), dt1->variable_start);
 		return -1;
 	}
@@ -410,7 +412,7 @@ int _sccp_parse_connection_dt1(struct msgb *msgb, struct sccp_parse_result *resu
 	msgb->l3h = &msgb->l2h[dt1->variable_start + variable_offset + 1];
 
 	if (msgb_l3len(msgb) < result->data_len) {
-		DEBUGP(DSCCP, "Not enough room for the payload: %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "Not enough room for the payload: %u %u\n",
 			msgb_l3len(msgb), result->data_len);
 		return -1;
 	}
@@ -428,7 +430,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 	struct sccp_data_unitdata *udt = (struct sccp_data_unitdata *)msgb->l2h;
 
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -438,7 +440,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 		return -1;
 
 	if (check_address(&result->called) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 		return -1;
 	}
@@ -447,13 +449,13 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 		return -1;
 
 	if (check_address(&result->calling) != 0) {
-		DEBUGP(DSCCP, "Invalid called address according to 08.06: 0x%x 0x%x\n",
+		LOGP(DSCCP, LOGL_ERROR, "Invalid called address according to 08.06: 0x%x 0x%x\n",
 			*(u_int8_t *)&result->called.address, result->called.ssn);
 	}
 
 	/* we don't have enough size for the data */
 	if (msgb_l2len(msgb) < data_offset + udt->variable_data + 1) {
-		DEBUGP(DSCCP, "msgb < header + offset %u %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header + offset %u %u %u\n",
 			msgb_l2len(msgb), header_size, udt->variable_data);
 		return -1;
 	}
@@ -463,7 +465,7 @@ int _sccp_parse_udt(struct msgb *msgb, struct sccp_parse_result *result)
 	result->data_len = msgb_l3len(msgb);
 
 	if (msgb_l3len(msgb) !=  msgb->l3h[-1]) {
-		DEBUGP(DSCCP, "msgb is truncated is: %u should: %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb is truncated is: %u should: %u\n",
 			msgb_l3len(msgb), msgb->l3h[-1]);
 		return -1;
 	}
@@ -478,7 +480,7 @@ static int _sccp_parse_it(struct msgb *msgb, struct sccp_parse_result *result)
 	struct sccp_data_it *it;
 
 	if (msgb_l2len(msgb) < header_size) {
-		DEBUGP(DSCCP, "msgb < header_size %u %u\n",
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
 		        msgb_l2len(msgb), header_size);
 		return -1;
 	}
@@ -490,6 +492,23 @@ static int _sccp_parse_it(struct msgb *msgb, struct sccp_parse_result *result)
 	return 0;
 }
 
+static int _sccp_parse_err(struct msgb *msgb, struct sccp_parse_result *result)
+{
+	static const u_int32_t header_size = sizeof(struct sccp_proto_err);
+
+	struct sccp_proto_err *err;
+
+	if (msgb_l2len(msgb) < header_size) {
+		LOGP(DSCCP, LOGL_ERROR, "msgb < header_size %u %u\n",
+		     msgb_l2len(msgb), header_size);
+		return -1;
+	}
+
+	err = (struct sccp_proto_err *) msgb->l2h;
+	result->data_len = 0;
+	result->destination_local_reference = &err->destination_local_reference;
+	return 0;
+}
 
 /*
  * Send UDT. Currently we have a fixed address...
@@ -501,7 +520,7 @@ static int _sccp_send_data(int class, const struct sockaddr_sccp *in,
 	u_int8_t *data;
 
 	if (msgb_l3len(payload) > 256) {
-		DEBUGP(DSCCP, "The payload is too big for one udt\n");
+		LOGP(DSCCP, LOGL_ERROR, "The payload is too big for one udt\n");
 		return -1;
 	}
 
@@ -546,7 +565,7 @@ static int _sccp_handle_read(struct msgb *msgb)
 
 	cb = _find_ssn(result.called.ssn);
 	if (!cb || !cb->read_cb) {
-		DEBUGP(DSCCP, "No routing for UDT for called SSN: %u\n", result.called.ssn);
+		LOGP(DSCCP, LOGL_ERROR, "No routing for UDT for called SSN: %u\n", result.called.ssn);
 		return -1;
 	}
 
@@ -595,7 +614,7 @@ static int assign_source_local_reference(struct sccp_connection *connection)
 		++last_ref;
 		/* do not use the reversed word and wrap around */
 		if ((last_ref & 0x00FFFFFF) == 0x00FFFFFF) {
-			DEBUGP(DSCCP, "Wrapped searching for a free code\n");
+			LOGP(DSCCP, LOGL_DEBUG, "Wrapped searching for a free code\n");
 			last_ref = 0;
 			++wrapped;
 		}
@@ -606,7 +625,7 @@ static int assign_source_local_reference(struct sccp_connection *connection)
 		}
 	} while (wrapped != 2);
 
-	DEBUGP(DSCCP, "Finding a free reference failed\n");
+	LOGP(DSCCP, LOGL_ERROR, "Finding a free reference failed\n");
 	return -1;
 }
 
@@ -619,7 +638,7 @@ static void _sccp_set_connection_state(struct sccp_connection *connection, int n
 		connection->state_cb(connection, old_state);
 }
 
-static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
+struct msgb *sccp_create_refuse(struct sccp_source_reference *src_ref, int cause, uint8_t *inp, int length)
 {
 	struct msgb *msgb;
 	struct sccp_connection_refused *ref;
@@ -627,6 +646,11 @@ static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
 
 	msgb = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				   SCCP_MSG_HEADROOM, "sccp ref");
+	if (!msgb) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate refusal msg.\n");
+		return NULL;
+	}
+
 	msgb->l2h = &msgb->data[0];
 
 	ref = (struct sccp_connection_refused *) msgb_put(msgb, sizeof(*ref));
@@ -636,40 +660,70 @@ static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
 	ref->cause = cause;
 	ref->optional_start = 1;
 
+	if (inp) {
+		data = msgb_put(msgb, 1 + 1 + length);
+		data[0] = SCCP_PNC_DATA;
+		data[1] = length;
+		memcpy(&data[2], inp, length);
+	}
+
 	data = msgb_put(msgb, 1);
 	data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return msgb;
+}
+
+static int _sccp_send_refuse(struct sccp_source_reference *src_ref, int cause)
+{
+	struct msgb *msgb = sccp_create_refuse(src_ref, cause, NULL, 0);
+	if (!msgb)
+		return -1;
 
 	_send_msg(msgb);
 	return 0;
 }
 
-static int _sccp_send_connection_confirm(struct sccp_connection *connection)
+struct msgb *sccp_create_cc(struct sccp_source_reference *src_ref,
+			    struct sccp_source_reference *dst_ref)
 {
 	struct msgb *response;
 	struct sccp_connection_confirm *confirm;
 	u_int8_t *optional_data;
 
-	if (assign_source_local_reference(connection) != 0)
-		return -1;
-
 	response = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				       SCCP_MSG_HEADROOM, "sccp confirm");
+	if (!response) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to create SCCP Confirm.\n");
+		return NULL;
+	}
+
 	response->l2h = &response->data[0];
 
 	confirm = (struct sccp_connection_confirm *) msgb_put(response, sizeof(*confirm));
 
 	confirm->type = SCCP_MSG_TYPE_CC;
 	memcpy(&confirm->destination_local_reference,
-	       &connection->destination_local_reference,
-	       sizeof(connection->destination_local_reference));
+	       dst_ref, sizeof(*dst_ref));
 	memcpy(&confirm->source_local_reference,
-	       &connection->source_local_reference,
-	       sizeof(connection->source_local_reference));
+	       src_ref, sizeof(*src_ref));
 	confirm->proto_class = 2;
 	confirm->optional_start = 1;
 
 	optional_data = (u_int8_t *) msgb_put(response, 1);
 	optional_data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return response;
+}
+
+static int _sccp_send_connection_confirm(struct sccp_connection *connection)
+{
+	struct msgb *response;
+
+	if (assign_source_local_reference(connection) != 0)
+		return -1;
+
+	response = sccp_create_cc(&connection->source_local_reference,
+				  &connection->destination_local_reference);
+	if (!response)
+		return -1;
 
 	_send_msg(response);
 	_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_ESTABLISHED);
@@ -686,13 +740,13 @@ static int _sccp_send_connection_request(struct sccp_connection *connection,
 
 
 	if (msg && (msgb_l3len(msg) < 3 || msgb_l3len(msg) > 130)) {
-		DEBUGP(DSCCP, "Invalid amount of data... %d\n", msgb_l3len(msg));
+		LOGP(DSCCP, LOGL_ERROR, "Invalid amount of data... %d\n", msgb_l3len(msg));
 		return -1;
 	}
 
 	/* try to find a id */
 	if (assign_source_local_reference(connection) != 0) {
-		DEBUGP(DSCCP, "Assigning a local reference failed.\n");
+		LOGP(DSCCP, LOGL_ERROR, "Assigning a local reference failed.\n");
 		_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_SETUP_ERROR);
 		return -1;
 	}
@@ -736,34 +790,49 @@ static int _sccp_send_connection_request(struct sccp_connection *connection,
 	return 0;
 }
 
-static int _sccp_send_connection_data(struct sccp_connection *conn, struct msgb *_data)
+struct msgb *sccp_create_dt1(struct sccp_source_reference *dst_ref, uint8_t *inp_data, uint8_t len)
 {
 	struct msgb *msgb;
 	struct sccp_data_form1 *dt1;
 	u_int8_t *data;
-	int extra_size;
 
-	if (msgb_l3len(_data) < 2 || msgb_l3len(_data) > 256) {
-		DEBUGP(DSCCP, "data size too big, segmenting unimplemented.\n");
-		return -1;
-	}
-
-	extra_size = 1 + msgb_l3len(_data);
 	msgb = msgb_alloc_headroom(SCCP_MSG_SIZE,
 				   SCCP_MSG_HEADROOM, "sccp dt1");
+	if (!msgb) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to create DT1 msg.\n");
+		return NULL;
+	}
+
 	msgb->l2h = &msgb->data[0];
 
 	dt1 = (struct sccp_data_form1 *) msgb_put(msgb, sizeof(*dt1));
 	dt1->type = SCCP_MSG_TYPE_DT1;
-	memcpy(&dt1->destination_local_reference, &conn->destination_local_reference,
+	memcpy(&dt1->destination_local_reference, dst_ref,
 	       sizeof(struct sccp_source_reference));
 	dt1->segmenting = 0;
 
 	/* copy the data */
 	dt1->variable_start = 1;
-	data = msgb_put(msgb, extra_size);
-	data[0] = extra_size - 1;
-	memcpy(&data[1], _data->l3h, extra_size - 1);
+	data = msgb_put(msgb, 1 + len);
+	data[0] = len;
+	memcpy(&data[1], inp_data, len);
+
+	return msgb;
+}
+
+static int _sccp_send_connection_data(struct sccp_connection *conn, struct msgb *_data)
+{
+	struct msgb *msgb;
+
+	if (msgb_l3len(_data) < 2 || msgb_l3len(_data) > 256) {
+		LOGP(DSCCP, LOGL_ERROR, "data size too big, segmenting unimplemented.\n");
+		return -1;
+	}
+
+	msgb = sccp_create_dt1(&conn->destination_local_reference,
+			       _data->l3h, msgb_l3len(_data));
+	if (!msgb)
+		return -1;
 
 	_send_msg(msgb);
 	return 0;
@@ -792,7 +861,8 @@ static int _sccp_send_connection_it(struct sccp_connection *conn)
 	return 0;
 }
 
-static int _sccp_send_connection_released(struct sccp_connection *conn, int cause)
+struct msgb *sccp_create_rlsd(struct sccp_source_reference *src_ref,
+			      struct sccp_source_reference *dst_ref, int cause)
 {
 	struct msgb *msg;
 	struct sccp_connection_released *rel;
@@ -800,19 +870,36 @@ static int _sccp_send_connection_released(struct sccp_connection *conn, int caus
 
 	msg = msgb_alloc_headroom(SCCP_MSG_SIZE, SCCP_MSG_HEADROOM,
 				  "sccp: connection released");
+	if (!msg) {
+		LOGP(DSCCP, LOGL_ERROR, "Failed to allocate RLSD.\n");
+		return NULL;
+	}
+
 	msg->l2h = &msg->data[0];
 	rel = (struct sccp_connection_released *) msgb_put(msg, sizeof(*rel));
 	rel->type = SCCP_MSG_TYPE_RLSD;
 	rel->release_cause = cause;
 
 	/* copy the source references */
-	memcpy(&rel->destination_local_reference, &conn->destination_local_reference,
+	memcpy(&rel->destination_local_reference, dst_ref,
 	       sizeof(struct sccp_source_reference));
-	memcpy(&rel->source_local_reference, &conn->source_local_reference,
+	memcpy(&rel->source_local_reference, src_ref,
 	       sizeof(struct sccp_source_reference));
 
 	data = msgb_put(msg, 1);
 	data[0] = SCCP_PNC_END_OF_OPTIONAL;
+	return msg;
+}
+
+static int _sccp_send_connection_released(struct sccp_connection *conn, int cause)
+{
+	struct msgb *msg;
+
+	msg = sccp_create_rlsd(&conn->source_local_reference,
+			       &conn->destination_local_reference,
+			       cause);
+	if (!msg)
+		return -1;
 
 	_sccp_set_connection_state(conn, SCCP_CONNECTION_STATE_RELEASE);
 	_send_msg(msg);
@@ -840,14 +927,14 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 
 	cb = _find_ssn(result.called.ssn);
 	if (!cb || !cb->accept_cb) {
-		DEBUGP(DSCCP, "No routing for CR for called SSN: %u\n", result.called.ssn);
+		LOGP(DSCCP, LOGL_ERROR, "No routing for CR for called SSN: %u\n", result.called.ssn);
 		return -1;
 	}
 
 	/* check if the system wants this connection */
 	connection = talloc_zero(tall_sccp_ctx, struct sccp_connection);
 	if (!connection) {
-		DEBUGP(DSCCP, "Allocation failed\n");
+		LOGP(DSCCP, LOGL_ERROR, "Allocation failed\n");
 		return -1;
 	}
 
@@ -859,7 +946,7 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 	 * one....
 	 */
 	if (destination_local_reference_is_free(result.source_local_reference) != 0) {
-		DEBUGP(DSCCP, "Need to reject connection with existing reference\n");
+		LOGP(DSCCP, LOGL_ERROR, "Need to reject connection with existing reference\n");
 		_sccp_send_refuse(result.source_local_reference, SCCP_REFUSAL_SCCP_FAILURE);
 		talloc_free(connection);
 		return -1;
@@ -879,7 +966,7 @@ static int _sccp_handle_connection_request(struct msgb *msgb)
 	llist_add_tail(&connection->list, &sccp_connections);
 
 	if (_sccp_send_connection_confirm(connection) != 0) {
-		DEBUGP(DSCCP, "Sending confirm failed... no available source reference?\n");
+		LOGP(DSCCP, LOGL_ERROR, "Sending confirm failed... no available source reference?\n");
 
 		_sccp_send_refuse(result.source_local_reference, SCCP_REFUSAL_SCCP_FAILURE);
 		_sccp_set_connection_state(connection, SCCP_CONNECTION_STATE_REFUSED);
@@ -922,7 +1009,7 @@ static int _sccp_handle_connection_release_complete(struct msgb *msgb)
 	}
 
 
-	DEBUGP(DSCCP, "Release complete of unknown connection\n");
+	LOGP(DSCCP, LOGL_ERROR, "Release complete of unknown connection\n");
 	return -1;
 
 found:
@@ -950,7 +1037,7 @@ static int _sccp_handle_connection_dt1(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "No connection found for dt1 data\n");
+	LOGP(DSCCP, LOGL_ERROR, "No connection found for dt1 data\n");
 	return -1;
 
 found:
@@ -1009,7 +1096,7 @@ static int _sccp_handle_connection_released(struct msgb *msgb)
 	}
 
 
-	DEBUGP(DSCCP, "Unknown connection was released.\n");
+	LOGP(DSCCP, LOGL_ERROR, "Unknown connection was released.\n");
 	return -1;
 
 	/* we have found a connection */
@@ -1021,7 +1108,7 @@ found:
 
 	/* generate a response */
 	if (_sccp_send_connection_release_complete(conn) != 0) {
-		DEBUGP(DSCCP, "Sending release confirmed failed\n");
+		LOGP(DSCCP, LOGL_ERROR, "Sending release confirmed failed\n");
 		return -1;
 	}
 
@@ -1046,7 +1133,7 @@ static int _sccp_handle_connection_refused(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "Refused but no connection found\n");
+	LOGP(DSCCP, LOGL_ERROR, "Refused but no connection found\n");
 	return -1;
 
 found:
@@ -1079,7 +1166,7 @@ static int _sccp_handle_connection_confirm(struct msgb *msgb)
 		}
 	}
 
-	DEBUGP(DSCCP, "Confirmed but no connection found\n");
+	LOGP(DSCCP, LOGL_ERROR, "Confirmed but no connection found\n");
 	return -1;
 
 found:
@@ -1108,7 +1195,7 @@ int sccp_system_init(void (*outgoing)(struct msgb *data, void *ctx), void *ctx)
 int sccp_system_incoming(struct msgb *msgb)
 {
 	if (msgb_l2len(msgb) < 1 ) {
-		DEBUGP(DSCCP, "Too short packet\n");
+		LOGP(DSCCP, LOGL_ERROR, "Too short packet\n");
 		return -1;
 	}
 
@@ -1137,7 +1224,7 @@ int sccp_system_incoming(struct msgb *msgb)
 		return _sccp_handle_read(msgb);
 		break;
 	default:
-		DEBUGP(DSCCP, "unimplemented msg type: %d\n", type);
+		LOGP(DSCCP, LOGL_ERROR, "unimplemented msg type: %d\n", type);
 	};
 
 	return -1;
@@ -1148,7 +1235,7 @@ int sccp_connection_write(struct sccp_connection *connection, struct msgb *data)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGP(DSCCP, "sccp_connection_write: Wrong connection state: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "sccp_connection_write: Wrong connection state: %p %d\n",
 		       connection, connection->connection_state);
 		return -1;
 	}
@@ -1165,7 +1252,7 @@ int sccp_connection_send_it(struct sccp_connection *connection)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGP(DSCCP, "sccp_connection_write: Wrong connection state: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "sccp_connection_write: Wrong connection state: %p %d\n",
 		       connection, connection->connection_state);
 		return -1;
 	}
@@ -1178,7 +1265,7 @@ int sccp_connection_close(struct sccp_connection *connection, int cause)
 {
 	if (connection->connection_state < SCCP_CONNECTION_STATE_CONFIRM
 	    || connection->connection_state > SCCP_CONNECTION_STATE_ESTABLISHED) {
-		DEBUGPC(DSCCP, "Can not close the connection. It was never opened: %p %d\n",
+		LOGP(DSCCP, LOGL_ERROR, "Can not close the connection. It was never opened: %p %d\n",
 			connection, connection->connection_state);
 		return -1;
 	}
@@ -1190,7 +1277,7 @@ int sccp_connection_free(struct sccp_connection *connection)
 {
 	if (connection->connection_state > SCCP_CONNECTION_STATE_NONE
 	    && connection->connection_state < SCCP_CONNECTION_STATE_RELEASE_COMPLETE) {
-		DEBUGP(DSCCP, "The connection needs to be released before it is freed");
+		LOGP(DSCCP, LOGL_ERROR, "The connection needs to be released before it is freed");
 		return -1;
 	}
 
@@ -1318,6 +1405,9 @@ int sccp_parse_header(struct msgb *msg, struct sccp_parse_result *result)
 	case SCCP_MSG_TYPE_IT:
 		return _sccp_parse_it(msg, result);
 		break;
+	case SCCP_MSG_TYPE_ERR:
+		return _sccp_parse_err(msg, result);
+		break;
 	};
 
 	LOGP(DSCCP, LOGL_ERROR, "Unimplemented MSG Type: 0x%x\n", type);

openbsc/src/system_information.c

@@ -397,18 +397,28 @@ static int generate_si6(u_int8_t *output, struct gsm_bts *bts)
 
 static struct gsm48_si13_info si13_default = {
 	.cell_opts = {
-		.nmo 		= GPRS_NMO_III,
-		.t3168		= 1500,
-		.t3192		= 500,
+		.nmo 		= GPRS_NMO_II,
+		.t3168		= 2000,
+		.t3192		= 200,
 		.drx_timer_max	= 3,
 		.bs_cv_max	= 15,
+		.ext_info_present = 1,
+		.ext_info = {
+			/* The values below are just guesses ! */
+			.egprs_supported = 0,
+			.use_egprs_p_ch_req = 1,
+			.bep_period = 5,
+			.pfc_supported = 0,
+			.dtm_supported = 0,
+			.bss_paging_coordination = 0,
+		},
 	},
 	.pwr_ctrl_pars = {
 		.alpha		= 10,	/* a = 1.0 */
-		.t_avg_w	= 25,
-		.t_avg_t	= 25,
+		.t_avg_w	= 16,
+		.t_avg_t	= 16,
 		.pc_meas_chan	= 0, 	/* downling measured on CCCH */
-		.n_avg_i	= 15,
+		.n_avg_i	= 8,
 	},
 	.bcch_change_mark	= 1,
 	.si_change_field	= 0,
@@ -441,14 +451,26 @@ static int generate_si13(u_int8_t *output, struct gsm_bts *bts)
 	if (ret < 0)
 		return ret;
 
-	si13->header.l2_plen = ret & 0xff;
+	/* length is coded in bit 2 an up */
+	si13->header.l2_plen = 0x01;
 
 	return sizeof (*si13) + ret;
 }
 
 int gsm_generate_si(u_int8_t *output, struct gsm_bts *bts, int type)
 {
-	si_info.gprs_ind.present = bts->gprs.enabled;
+	switch (bts->gprs.mode) {
+	case BTS_GPRS_EGPRS:
+		si13_default.cell_opts.ext_info_present = 1;
+		si13_default.cell_opts.ext_info.egprs_supported = 1;
+		/* fallthrough */
+	case BTS_GPRS_GPRS:
+		si_info.gprs_ind.present = 1;
+		break;
+	case BTS_GPRS_NONE:
+		si_info.gprs_ind.present = 0;
+		break;
+	}
 
 	switch (type) {
 	case RSL_SYSTEM_INFO_1:

openbsc/src/vty/buffer.c

@@ -65,11 +65,11 @@ struct buffer_data {
 #define BUFFER_DATA_FREE(D) talloc_free((D))
 
 /* Make new buffer. */
-struct buffer *buffer_new(size_t size)
+struct buffer *buffer_new(void *ctx, size_t size)
 {
 	struct buffer *b;
 
-	b = talloc_zero(tall_vty_ctx, struct buffer);
+	b = talloc_zero(ctx, struct buffer);
 
 	if (size)
 		b->size = size;
@@ -138,7 +138,7 @@ static struct buffer_data *buffer_add(struct buffer *b)
 {
 	struct buffer_data *d;
 
-	d = _talloc_zero(tall_vty_ctx,
+	d = _talloc_zero(b,
 			 offsetof(struct buffer_data, data[b->size]),
 			 "buffer_add");
 	if (!d)

openbsc/src/vty/vty.c

@@ -51,10 +51,10 @@ struct vty *vty_new()
 	if (!new)
 		goto out;
 
-	new->obuf = buffer_new(0);	/* Use default buffer size. */
+	new->obuf = buffer_new(new, 0);	/* Use default buffer size. */
 	if (!new->obuf)
 		goto out_new;
-	new->buf = _talloc_zero(tall_vty_ctx, VTY_BUFSIZ, "vty_new->buf");
+	new->buf = _talloc_zero(new, VTY_BUFSIZ, "vty_new->buf");
 	if (!new->buf)
 		goto out_obuf;
 
@@ -170,8 +170,7 @@ void vty_close(struct vty *vty)
 	/* Check configure. */
 	vty_config_unlock(vty);
 
-	/* FIXME: memory leak. We need to call telnet_close_client() but don't
-	 * have bfd */
+	/* VTY_CLOSED is handled by the telnet_interface */
 	vty_event(VTY_CLOSED, vty->fd, vty);
 
 	/* OK free vty. */
@@ -211,7 +210,7 @@ int vty_out(struct vty *vty, const char *format, ...)
 				else
 					size = size * 2;
 
-				p = talloc_realloc_size(tall_vty_ctx, p, size);
+				p = talloc_realloc_size(vty, p, size);
 				if (!p)
 					return -1;
 
@@ -358,7 +357,7 @@ static void vty_ensure(struct vty *vty, int length)
 {
 	if (vty->max <= length) {
 		vty->max *= 2;
-		vty->buf = talloc_realloc_size(tall_vty_ctx, vty->buf, vty->max);
+		vty->buf = talloc_realloc_size(vty, vty->buf, vty->max);
 		// FIXME: check return
 	}
 }
@@ -459,7 +458,7 @@ static void vty_hist_add(struct vty *vty)
 	/* Insert history entry. */
 	if (vty->hist[vty->hindex])
 		talloc_free(vty->hist[vty->hindex]);
-	vty->hist[vty->hindex] = talloc_strdup(tall_vty_ctx, vty->buf);
+	vty->hist[vty->hindex] = talloc_strdup(vty, vty->buf);
 
 	/* History index rotation. */
 	vty->hindex++;
@@ -916,7 +915,7 @@ static void vty_complete_command(struct vty *vty)
 		vty_backward_pure_word(vty);
 		vty_insert_word_overwrite(vty, matched[0]);
 		vty_self_insert(vty, ' ');
-		//talloc_free(matched[0]);
+		talloc_free(matched[0]);
 		break;
 	case CMD_COMPLETE_MATCH:
 		vty_prompt(vty);
@@ -924,8 +923,6 @@ static void vty_complete_command(struct vty *vty)
 		vty_backward_pure_word(vty);
 		vty_insert_word_overwrite(vty, matched[0]);
 		talloc_free(matched[0]);
-		vector_only_index_free(matched);
-		return;
 		break;
 	case CMD_COMPLETE_LIST_MATCH:
 		for (i = 0; matched[i] != NULL; i++) {
@@ -966,7 +963,7 @@ vty_describe_fold(struct vty *vty, int cmd_width,
 		return;
 	}
 
-	buf = _talloc_zero(tall_vty_ctx, strlen(desc->str) + 1, "describe_fold");
+	buf = _talloc_zero(vty, strlen(desc->str) + 1, "describe_fold");
 	if (!buf)
 		return;
 

openbsc/src/vty_interface.c

@@ -27,6 +27,7 @@
 #include <vty/vty.h>
 
 #include <arpa/inet.h>
+#include <netinet/ip.h>
 
 #include <osmocore/linuxlist.h>
 #include <openbsc/gsm_data.h>
@@ -39,9 +40,37 @@
 #include <osmocore/talloc.h>
 #include <openbsc/telnet_interface.h>
 #include <openbsc/vty.h>
+#include <openbsc/ipaccess.h>
+#include <openbsc/paging.h>
 
 static struct gsm_network *gsmnet;
 
+static struct value_string gprs_ns_timer_strs[] = {
+	{ 0, "tns-block" },
+	{ 1, "tns-block-retries" },
+	{ 2, "tns-reset" },
+	{ 3, "tns-reset-retries" },
+	{ 4, "tns-test" },
+	{ 5, "tns-alive" },
+	{ 6, "tns-alive-retries" },
+	{ 0, NULL }
+};
+
+static struct value_string gprs_bssgp_cfg_strs[] = {
+	{ 0,	"blocking-timer" },
+	{ 1,	"blocking-retries" },
+	{ 2,	"unblocking-retries" },
+	{ 3,	"reset-timer" },
+	{ 4,	"reset-retries" },
+	{ 5,	"suspend-timer" },
+	{ 6,	"suspend-retries" },
+	{ 7,	"resume-timer" },
+	{ 8,	"resume-retries" },
+	{ 9,	"capability-update-timer" },
+	{ 10,	"capability-update-retries" },
+	{ 0,	NULL }
+};
+
 struct cmd_node net_node = {
 	GSMNET_NODE,
 	"%s(network)#",
@@ -195,7 +224,8 @@ static void bts_dump_vty(struct vty *vty, struct gsm_bts *bts)
 	net_dump_nmstate(vty, &bts->nm_state);
 	vty_out(vty, "  Site Mgr NM State: ");
 	net_dump_nmstate(vty, &bts->site_mgr.nm_state);
-	vty_out(vty, "  Paging: FIXME pending requests, %u free slots%s",
+	vty_out(vty, "  Paging: %u pending requests, %u free slots%s",
+		paging_pending_requests_nr(bts),
 		bts->paging.available_slots, VTY_NEWLINE);
 	if (!is_ipaccess_bts(bts)) {
 		vty_out(vty, "  E1 Signalling Link:%s", VTY_NEWLINE);
@@ -233,6 +263,36 @@ DEFUN(show_bts, show_bts_cmd, "show bts [number]",
 	return CMD_SUCCESS;
 }
 
+DEFUN(test_bts_lchan_alloc, test_bts_lchan_alloc_cmd, "test bts alloc (sdcch|tch_h|tch_f)",
+      "Test command to allocate all channels. You will need to restart. To free these channels.\n")
+{
+	struct gsm_network *net = gsmnet;
+	int bts_nr;
+
+	enum gsm_chan_t type = GSM_LCHAN_NONE;
+
+	if (strcmp("sdcch", argv[0]) == 0)
+		type = GSM_LCHAN_SDCCH;
+	else if (strcmp("tch_h", argv[0]) == 0)
+		type = GSM_LCHAN_TCH_H;
+	else if (strcmp("tch_f", argv[0]) == 0)
+		type = GSM_LCHAN_TCH_F;
+	else {
+		vty_out(vty, "Unknown mode for allocation.%s", VTY_NEWLINE);
+	}
+
+	for (bts_nr = 0; bts_nr < net->num_bts; ++bts_nr) {
+		struct gsm_bts *bts = gsm_bts_num(net, bts_nr);
+		struct gsm_lchan *lchan;
+
+		/* alloc the channel */
+		while ((lchan = lchan_alloc(bts, type, 0)) != NULL)
+			rsl_lchan_set_state(lchan, LCHAN_S_REL_ERR);
+	}
+
+	return CMD_SUCCESS;
+}
+
 /* utility functions */
 static void parse_e1_link(struct gsm_e1_subslot *e1_link, const char *line,
 			  const char *ts, const char *ss)
@@ -275,6 +335,9 @@ static void config_write_trx_single(struct vty *vty, struct gsm_bts_trx *trx)
 	int i;
 
 	vty_out(vty, "  trx %u%s", trx->nr, VTY_NEWLINE);
+	vty_out(vty, "   rf_locked %u%s",
+		trx->nm_state.administrative == NM_STATE_LOCKED ? 1 : 0,
+		VTY_NEWLINE);
 	vty_out(vty, "   arfcn %u%s", trx->arfcn, VTY_NEWLINE);
 	vty_out(vty, "   nominal power %u%s", trx->nominal_power, VTY_NEWLINE);
 	vty_out(vty, "   max_power_red %u%s", trx->max_power_red, VTY_NEWLINE);
@@ -285,10 +348,48 @@ static void config_write_trx_single(struct vty *vty, struct gsm_bts_trx *trx)
 		config_write_ts_single(vty, &trx->ts[i]);
 }
 
+static void config_write_bts_gprs(struct vty *vty, struct gsm_bts *bts)
+{
+	unsigned int i;
+	vty_out(vty, "  gprs mode %s%s", bts_gprs_mode_name(bts->gprs.mode),
+		VTY_NEWLINE);
+	if (bts->gprs.mode == BTS_GPRS_NONE)
+		return;
+
+	vty_out(vty, "  gprs routing area %u%s", bts->gprs.rac,
+		VTY_NEWLINE);
+	vty_out(vty, "  gprs cell bvci %u%s", bts->gprs.cell.bvci,
+		VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.cell.timer); i++)
+		vty_out(vty, "  gprs cell timer %s %u%s",
+			get_value_string(gprs_bssgp_cfg_strs, i),
+			bts->gprs.cell.timer[i], VTY_NEWLINE);
+	vty_out(vty, "  gprs nsei %u%s", bts->gprs.nse.nsei,
+		VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.nse.timer); i++)
+		vty_out(vty, "  gprs ns timer %s %u%s",
+			get_value_string(gprs_ns_timer_strs, i),
+			bts->gprs.nse.timer[i], VTY_NEWLINE);
+	for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) {
+		struct gsm_bts_gprs_nsvc *nsvc =
+					&bts->gprs.nsvc[i];
+		struct in_addr ia;
+
+		ia.s_addr = htonl(nsvc->remote_ip);
+		vty_out(vty, "  gprs nsvc %u nsvci %u%s", i,
+			nsvc->nsvci, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u local udp port %u%s", i,
+			nsvc->local_port, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u remote udp port %u%s", i,
+			nsvc->remote_port, VTY_NEWLINE);
+		vty_out(vty, "  gprs nsvc %u remote ip %s%s", i,
+			inet_ntoa(ia), VTY_NEWLINE);
+	}
+}
+
 static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 {
 	struct gsm_bts_trx *trx;
-	int i;
 
 	vty_out(vty, " bts %u%s", bts->nr, VTY_NEWLINE);
 	vty_out(vty, "  type %s%s", btstype2str(bts->type), VTY_NEWLINE);
@@ -314,8 +415,17 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 	vty_out(vty, "  rach max transmission %u%s",
 		rach_max_trans_raw2val(bts->si_common.rach_control.max_trans),
 		VTY_NEWLINE);
+
+	if (bts->rach_b_thresh != -1)
+		vty_out(vty, "  rach nm busy threshold %u%s",
+			bts->rach_b_thresh, VTY_NEWLINE);
+	if (bts->rach_ldavg_slots != -1)
+		vty_out(vty, "  rach nm load average %u%s",
+			bts->rach_ldavg_slots, VTY_NEWLINE);
 	if (bts->si_common.rach_control.cell_bar)
 		vty_out(vty, "  cell barred 1%s", VTY_NEWLINE);
+	if ((bts->si_common.rach_control.t2 & 0x4) == 0)
+		vty_out(vty, "  rach emergency call allowed 1%s", VTY_NEWLINE);
 	if (is_ipaccess_bts(bts)) {
 		vty_out(vty, "  ip.access unit_id %u %u%s",
 			bts->ip_access.site_id, bts->ip_access.bts_id, VTY_NEWLINE);
@@ -324,30 +434,13 @@ static void config_write_bts_single(struct vty *vty, struct gsm_bts *bts)
 		config_write_e1_link(vty, &bts->oml_e1_link, "  oml ");
 		vty_out(vty, "  oml e1 tei %u%s", bts->oml_tei, VTY_NEWLINE);
 	}
-	vty_out(vty, "  gprs enabled %u%s", bts->gprs.enabled, VTY_NEWLINE);
-	if (bts->gprs.enabled) {
-		vty_out(vty, "  gprs routing area %u%s", bts->gprs.rac,
-			VTY_NEWLINE);
-		vty_out(vty, "  gprs cell bvci %u%s", bts->gprs.cell.bvci,
-			VTY_NEWLINE);
-		vty_out(vty, "  gprs nsei %u%s", bts->gprs.nse.nsei,
-			VTY_NEWLINE);
-		for (i = 0; i < ARRAY_SIZE(bts->gprs.nsvc); i++) {
-			struct gsm_bts_gprs_nsvc *nsvc =
-						&bts->gprs.nsvc[i];
-			struct in_addr ia;
 
-			ia.s_addr = htonl(nsvc->remote_ip);
-			vty_out(vty, "  gprs nsvc %u nsvci %u%s", i,
-				nsvc->nsvci, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u local udp port %u%s", i,
-				nsvc->local_port, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u remote udp port %u%s", i,
-				nsvc->remote_port, VTY_NEWLINE);
-			vty_out(vty, "  gprs nsvc %u remote ip %s%s", i,
-				inet_ntoa(ia), VTY_NEWLINE);
-		}
-	}
+	config_write_bts_gprs(vty, bts);
+
+	/* if we have a limit, write it */
+	if (bts->paging.free_chans_need >= 0)
+		vty_out(vty, "  paging free %d%s", bts->paging.free_chans_need, VTY_NEWLINE);
+
 
 	llist_for_each_entry(trx, &bts->trx_list, list)
 		config_write_trx_single(vty, trx);
@@ -429,6 +522,11 @@ static int config_write_net(struct vty *vty)
 
 	if (gsmnet->bsc_token)
 		vty_out(vty, " bsc_token %s%s", gsmnet->bsc_token, VTY_NEWLINE);
+	vty_out(vty, " msc ip %s%s", gsmnet->msc_ip, VTY_NEWLINE);
+	vty_out(vty, " msc port %d%s", gsmnet->msc_port, VTY_NEWLINE);
+	vty_out(vty, " msc ip-tos %d%s", gsmnet->msc_prio, VTY_NEWLINE);
+	vty_out(vty, " timeout ping %d%s", gsmnet->ping_timeout, VTY_NEWLINE);
+	vty_out(vty, " timeout pong %d%s", gsmnet->pong_timeout, VTY_NEWLINE);
 
 	return CMD_SUCCESS;
 }
@@ -576,10 +674,6 @@ DEFUN(show_ts,
 
 static void subscr_dump_vty(struct vty *vty, struct gsm_subscriber *subscr)
 {
-	int rc;
-	struct gsm_auth_info ainfo;
-	struct gsm_auth_tuple atuple;
-
 	vty_out(vty, "    ID: %llu, Authorized: %d%s", subscr->id,
 		subscr->authorized, VTY_NEWLINE);
 	if (subscr->name)
@@ -630,7 +724,7 @@ static void meas_rep_dump_vty(struct vty *vty, struct gsm_meas_rep *mr,
 	meas_rep_dump_uni_vty(vty, &mr->ul, prefix, "ul");
 }
 
-static void lchan_dump_vty(struct vty *vty, struct gsm_lchan *lchan)
+static void lchan_dump_full_vty(struct vty *vty, struct gsm_lchan *lchan)
 {
 	int idx;
 
@@ -652,7 +746,7 @@ static void lchan_dump_vty(struct vty *vty, struct gsm_lchan *lchan)
 		vty_out(vty, "  No Subscriber%s", VTY_NEWLINE);
 	if (is_ipaccess_bts(lchan->ts->trx->bts)) {
 		struct in_addr ia;
-		ia.s_addr = lchan->abis_ip.bound_ip;
+		ia.s_addr = htonl(lchan->abis_ip.bound_ip);
 		vty_out(vty, "  Bound IP: %s Port %u RTP_TYPE2=%u CONN_ID=%u%s",
 			inet_ntoa(ia), lchan->abis_ip.bound_port,
 			lchan->abis_ip.rtp_payload2, lchan->abis_ip.conn_id,
@@ -665,37 +759,41 @@ static void lchan_dump_vty(struct vty *vty, struct gsm_lchan *lchan)
 	meas_rep_dump_vty(vty, &lchan->meas_rep[idx], "  ");
 }
 
-#if 0
-TODO: callref and remote callref of call must be resolved to get gsm_trans object
-static void call_dump_vty(struct vty *vty, struct gsm_call *call)
+static void lchan_dump_short_vty(struct vty *vty, struct gsm_lchan *lchan)
 {
-	vty_out(vty, "Call Type %u, State %u, Transaction ID %u%s",
-		call->type, call->state, call->transaction_id, VTY_NEWLINE);
+	struct gsm_meas_rep *mr;
+	int idx;
 
-	if (call->local_lchan) {
-		vty_out(vty, "Call Local Channel:%s", VTY_NEWLINE);
-		lchan_dump_vty(vty, call->local_lchan);
-	} else
-		vty_out(vty, "Call has no Local Channel%s", VTY_NEWLINE);
+	/* we want to report the last measurement report */
+	idx = calc_initial_idx(ARRAY_SIZE(lchan->meas_rep),
+			       lchan->meas_rep_idx, 1);
+	mr =  &lchan->meas_rep[idx];
 
-	if (call->remote_lchan) {
-		vty_out(vty, "Call Remote Channel:%s", VTY_NEWLINE);
-		lchan_dump_vty(vty, call->remote_lchan);
-	} else
-		vty_out(vty, "Call has no Remote Channel%s", VTY_NEWLINE);
-
-	if (call->called_subscr) {
-		vty_out(vty, "Called Subscriber:%s", VTY_NEWLINE);
-		subscr_dump_vty(vty, call->called_subscr);
-	} else
-		vty_out(vty, "Call has no Called Subscriber%s", VTY_NEWLINE);
+	vty_out(vty, "Lchan: %u Timeslot: %u TRX: %u BTS: %u Type: %s - L1 MS Power: %u dBm "
+		     "RXL-FULL-dl: %4d dBm RXL-FULL-ul: %4d dBm%s",
+		lchan->nr, lchan->ts->nr, lchan->ts->trx->nr,
+		lchan->ts->trx->bts->nr, gsm_lchant_name(lchan->type),
+		mr->ms_l1.pwr,
+		rxlev2dbm(mr->dl.full.rx_lev),
+		rxlev2dbm(mr->ul.full.rx_lev),
+		VTY_NEWLINE);
 }
-#endif
 
-DEFUN(show_lchan,
-      show_lchan_cmd,
-      "show lchan [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
-	SHOW_STR "Display information about a logical channel\n")
+static void lchan_dump_status_vty(struct vty *vty, struct gsm_lchan *lchan)
+{
+	vty_out(vty, "Lchan: %u/%u/%u/%u Type: %s State: %s ref: %u HO: %d Subscriber: %d "
+		"Time: %lu SAPI: %d/%d%s",
+		lchan->nr, lchan->ts->nr, lchan->ts->trx->nr,
+		lchan->ts->trx->bts->nr, gsm_lchant_name(lchan->type),
+		gsm_lchans_name(lchan->state), lchan->conn.use_count,
+		lchan->conn.hand_off,
+		lchan->conn.subscr != NULL, (unsigned long) lchan->alloc_time.tv_sec,
+		lchan->sapis[0], lchan->sapis[3],
+		VTY_NEWLINE);
+}
+
+static int lchan_summary(struct vty *vty, int argc, const char **argv,
+			 void (*dump_cb)(struct vty *, struct gsm_lchan *))
 {
 	struct gsm_network *net = gsmnet;
 	struct gsm_bts *bts;
@@ -740,7 +838,7 @@ DEFUN(show_lchan,
 			return CMD_WARNING;
 		}
 		lchan = &ts->lchan[lchan_nr];
-		lchan_dump_vty(vty, lchan);
+		dump_cb(vty, lchan);
 		return CMD_SUCCESS;
 	}
 	for (bts_nr = 0; bts_nr < net->num_bts; bts_nr++) {
@@ -754,7 +852,7 @@ DEFUN(show_lchan,
 					lchan = &ts->lchan[lchan_nr];
 					if (lchan->type == GSM_LCHAN_NONE)
 						continue;
-					lchan_dump_vty(vty, lchan);
+					dump_cb(vty, lchan);
 				}
 			}
 		}
@@ -763,6 +861,31 @@ DEFUN(show_lchan,
 	return CMD_SUCCESS;
 }
 
+
+DEFUN(show_lchan,
+      show_lchan_cmd,
+      "show lchan [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
+	SHOW_STR "Display information about a logical channel\n")
+{
+	return lchan_summary(vty, argc, argv, lchan_dump_full_vty);
+}
+
+DEFUN(show_lchan_summary,
+      show_lchan_summary_cmd,
+      "show lchan-summary [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
+	SHOW_STR "Display a short summary about a logical channel\n")
+{
+	return lchan_summary(vty, argc, argv, lchan_dump_short_vty);
+}
+
+DEFUN(show_lchan_status,
+      show_lchan_status_cmd,
+      "show lchan-status [bts_nr] [trx_nr] [ts_nr] [lchan_nr]",
+	SHOW_STR "Display a short stat about a logical channel\n")
+{
+	return lchan_summary(vty, argc, argv, lchan_dump_status_vty);
+}
+
 static void e1drv_dump_vty(struct vty *vty, struct e1inp_driver *drv)
 {
 	vty_out(vty, "E1 Input Driver %s%s", drv->name, VTY_NEWLINE);
@@ -915,43 +1038,47 @@ DEFUN(show_paging,
 	return CMD_SUCCESS;
 }
 
-DEFUN(show_stats,
-      show_stats_cmd,
-      "show statistics",
-	SHOW_STR "Display network statistics\n")
+DEFUN(drop_bts,
+      drop_bts_cmd,
+      "drop bts connection <0-65535> (oml|rsl)",
+      "Debug/Simulation command to drop ipaccess BTS\n")
 {
-	struct gsm_network *net = gsmnet;
+	struct gsm_bts_trx *trx;
+	struct gsm_bts *bts;
+	unsigned int bts_nr;
+
+	bts_nr = atoi(argv[0]);
+	if (bts_nr >= gsmnet->num_bts) {
+		vty_out(vty, "BTS number must be between 0 and %d. It was %d.%s",
+			gsmnet->num_bts, bts_nr, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	bts = gsm_bts_num(gsmnet, bts_nr);
+	if (!bts) {
+		vty_out(vty, "BTS Nr. %d could not be found.%s", bts_nr, VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (!is_ipaccess_bts(bts)) {
+		vty_out(vty, "This command only works for ipaccess.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+
+	/* close all connections */
+	if (strcmp(argv[1], "oml") == 0)
+		ipaccess_drop_oml(bts);
+	else if (strcmp(argv[1], "rsl") == 0) {
+		/* close all rsl connections */
+		llist_for_each_entry(trx, &bts->trx_list, list) {
+			ipaccess_drop_rsl(trx);
+		}
+	} else {
+		vty_out(vty, "Argument must be 'oml' or 'rsl'.%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
 
-	vty_out(vty, "Channel Requests        : %lu total, %lu no channel%s",
-		counter_get(net->stats.chreq.total),
-		counter_get(net->stats.chreq.no_channel), VTY_NEWLINE);
-	vty_out(vty, "Location Update         : %lu attach, %lu normal, %lu periodic%s",
-		counter_get(net->stats.loc_upd_type.attach),
-		counter_get(net->stats.loc_upd_type.normal),
-		counter_get(net->stats.loc_upd_type.periodic), VTY_NEWLINE);
-	vty_out(vty, "IMSI Detach Indications : %lu%s",
-		counter_get(net->stats.loc_upd_type.detach), VTY_NEWLINE);
-	vty_out(vty, "Location Update Response: %lu accept, %lu reject%s",
-		counter_get(net->stats.loc_upd_resp.accept),
-		counter_get(net->stats.loc_upd_resp.reject), VTY_NEWLINE);
-	vty_out(vty, "Paging                  : %lu attempted, %lu complete, %lu expired%s",
-		counter_get(net->stats.paging.attempted),
-		counter_get(net->stats.paging.completed),
-		counter_get(net->stats.paging.expired), VTY_NEWLINE);
-	vty_out(vty, "Handover                : %lu attempted, %lu no_channel, %lu timeout, "
-		"%lu completed, %lu failed%s",
-		counter_get(net->stats.handover.attempted),
-		counter_get(net->stats.handover.no_channel),
-		counter_get(net->stats.handover.timeout),
-		counter_get(net->stats.handover.completed),
-		counter_get(net->stats.handover.failed), VTY_NEWLINE);
-	vty_out(vty, "SMS MO                  : %lu submitted, %lu no receiver%s",
-		counter_get(net->stats.sms.submitted),
-		counter_get(net->stats.sms.no_receiver), VTY_NEWLINE);
-	vty_out(vty, "SMS MT                  : %lu delivered, %lu no memory, %lu other error%s",
-		counter_get(net->stats.sms.delivered),
-		counter_get(net->stats.sms.rp_err_mem),
-		counter_get(net->stats.sms.rp_err_other), VTY_NEWLINE);
 	return CMD_SUCCESS;
 }
 
@@ -1264,6 +1391,53 @@ DEFUN(cfg_net_pag_any_tch,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_net_msc_ip,
+      cfg_net_msc_ip_cmd,
+      "msc ip A.B.C.D",
+      "Set the MSC/MUX IP address.")
+{
+	if (gsmnet->msc_ip)
+		talloc_free(gsmnet->msc_ip);
+	gsmnet->msc_ip = talloc_strdup(gsmnet, argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_msc_port,
+      cfg_net_msc_port_cmd,
+      "msc port <1-65000>",
+      "Set the MSC/MUX port.")
+{
+	gsmnet->msc_port = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_msc_prio,
+      cfg_net_msc_prio_cmd,
+      "msc ip-tos <0-255>",
+      "Set the IP_TOS socket attribite")
+{
+	gsmnet->msc_prio = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_ping_time,
+      cfg_net_ping_time_cmd,
+      "timeout ping NR",
+      "Set the PING interval, negative for not sending PING")
+{
+	gsmnet->ping_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_net_pong_time,
+      cfg_net_pong_time_cmd,
+      "timeout pong NR",
+      "Set the time to wait for a PONG.")
+{
+	gsmnet->pong_timeout = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
 #define DECLARE_TIMER(number, doc) \
     DEFUN(cfg_net_T##number,					\
       cfg_net_T##number##_cmd,					\
@@ -1287,7 +1461,7 @@ DECLARE_TIMER(3103, "Set the timeout value for HANDOVER.")
 DECLARE_TIMER(3105, "Currently not used.")
 DECLARE_TIMER(3107, "Currently not used.")
 DECLARE_TIMER(3109, "Currently not used.")
-DECLARE_TIMER(3111, "Currently not used.")
+DECLARE_TIMER(3111, "Set the RSL timeout to wait before releasing the RF Channel.")
 DECLARE_TIMER(3113, "Set the time to try paging a subscriber.")
 DECLARE_TIMER(3115, "Currently not used.")
 DECLARE_TIMER(3117, "Currently not used.")
@@ -1539,6 +1713,26 @@ DEFUN(cfg_bts_rach_max_trans,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_bts_rach_nm_b_thresh,
+      cfg_bts_rach_nm_b_thresh_cmd,
+      "rach nm busy threshold <0-255>",
+      "Set the NM Busy Threshold in DB")
+{
+	struct gsm_bts *bts = vty->index;
+	bts->rach_b_thresh = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
+DEFUN(cfg_bts_rach_nm_ldavg,
+      cfg_bts_rach_nm_ldavg_cmd,
+      "rach nm load average <0-65535>",
+      "Set the NM Loadaver Slots value")
+{
+	struct gsm_bts *bts = vty->index;
+	bts->rach_ldavg_slots = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_bts_cell_barred, cfg_bts_cell_barred_cmd,
       "cell barred (0|1)",
       "Should this cell be barred from access?")
@@ -1550,6 +1744,20 @@ DEFUN(cfg_bts_cell_barred, cfg_bts_cell_barred_cmd,
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_bts_rach_ec_allowed, cfg_bts_rach_ec_allowed_cmd,
+      "rach emergency call allowed (0|1)",
+      "Should this cell allow emergency calls?")
+{
+	struct gsm_bts *bts = vty->index;
+
+	if (atoi(argv[0]) == 0)
+		bts->si_common.rach_control.t2 |= 0x4;
+	else
+		bts->si_common.rach_control.t2 &= ~0x4;
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_bts_ms_max_power, cfg_bts_ms_max_power_cmd,
       "ms max power <0-40>",
       "Maximum transmit power of the MS")
@@ -1595,12 +1803,12 @@ DEFUN(cfg_bts_per_loc_upd, cfg_bts_per_loc_upd_cmd,
 }
 
 DEFUN(cfg_bts_prs_bvci, cfg_bts_gprs_bvci_cmd,
-	"gprs cell bvci <0-65535>",
+	"gprs cell bvci <2-65535>",
 	"GPRS BSSGP VC Identifier")
 {
 	struct gsm_bts *bts = vty->index;
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1616,7 +1824,7 @@ DEFUN(cfg_bts_gprs_nsei, cfg_bts_gprs_nsei_cmd,
 {
 	struct gsm_bts *bts = vty->index;
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1634,7 +1842,7 @@ DEFUN(cfg_bts_gprs_nsvci, cfg_bts_gprs_nsvci_cmd,
 	struct gsm_bts *bts = vty->index;
 	int idx = atoi(argv[0]);
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1651,7 +1859,7 @@ DEFUN(cfg_bts_gprs_nsvc_lport, cfg_bts_gprs_nsvc_lport_cmd,
 	struct gsm_bts *bts = vty->index;
 	int idx = atoi(argv[0]);
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1668,7 +1876,7 @@ DEFUN(cfg_bts_gprs_nsvc_rport, cfg_bts_gprs_nsvc_rport_cmd,
 	struct gsm_bts *bts = vty->index;
 	int idx = atoi(argv[0]);
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1686,7 +1894,7 @@ DEFUN(cfg_bts_gprs_nsvc_rip, cfg_bts_gprs_nsvc_rip_cmd,
 	int idx = atoi(argv[0]);
 	struct in_addr ia;
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1697,13 +1905,71 @@ DEFUN(cfg_bts_gprs_nsvc_rip, cfg_bts_gprs_nsvc_rip_cmd,
 	return CMD_SUCCESS;
 }
 
+#define GPRS_TEXT "GPRS Packet Network\n"
+#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries)"
+#define NS_TIMERS_HELP	\
+	"(un)blocking Timer (Tns-block) timeout\n"		\
+	"(un)blocking Timer (Tns-block) number of retries\n"	\
+	"Reset Timer (Tns-reset) timeout\n"			\
+	"Reset Timer (Tns-reset) number of retries\n"		\
+	"Test Timer (Tns-test) timeout\n"			\
+
+DEFUN(cfg_bts_gprs_ns_timer, cfg_bts_gprs_ns_timer_cmd,
+	"gprs ns timer " NS_TIMERS " <0-255>",
+	GPRS_TEXT "Network Service\n"
+	"Network Service Timer\n"
+	NS_TIMERS_HELP "Timer Value\n")
+{
+	struct gsm_bts *bts = vty->index;
+	int idx = get_string_value(gprs_ns_timer_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
+		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (idx < 0 || idx >= ARRAY_SIZE(bts->gprs.nse.timer))
+		return CMD_WARNING;
+
+	bts->gprs.nse.timer[idx] = val;
+
+	return CMD_SUCCESS;
+}
+
+#define BSSGP_TIMERS "(blocking-timer|blocking-retries|unblocking-retries|reset-timer|reset-retries|suspend-timer|suspend-retries|resume-timer|resume-retries|capability-update-timer|capability-update-retries)"
+#define BSSGP_TIMERS_HELP	""
+
+DEFUN(cfg_bts_gprs_cell_timer, cfg_bts_gprs_cell_timer_cmd,
+	"gprs cell timer " BSSGP_TIMERS " <0-255>",
+	GPRS_TEXT "Cell / BSSGP\n"
+	"Cell/BSSGP Timer\n"
+	BSSGP_TIMERS_HELP "Timer Value\n")
+{
+	struct gsm_bts *bts = vty->index;
+	int idx = get_string_value(gprs_bssgp_cfg_strs, argv[0]);
+	int val = atoi(argv[1]);
+
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
+		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
+		return CMD_WARNING;
+	}
+
+	if (idx < 0 || idx >= ARRAY_SIZE(bts->gprs.cell.timer))
+		return CMD_WARNING;
+
+	bts->gprs.cell.timer[idx] = val;
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(cfg_bts_gprs_rac, cfg_bts_gprs_rac_cmd,
 	"gprs routing area <0-255>",
 	"GPRS Routing Area Code")
 {
 	struct gsm_bts *bts = vty->index;
 
-	if (!bts->gprs.enabled) {
+	if (bts->gprs.mode == BTS_GPRS_NONE) {
 		vty_out(vty, "%% GPRS not enabled on this BTS%s", VTY_NEWLINE);
 		return CMD_WARNING;
 	}
@@ -1713,17 +1979,26 @@ DEFUN(cfg_bts_gprs_rac, cfg_bts_gprs_rac_cmd,
 	return CMD_SUCCESS;
 }
 
-DEFUN(cfg_bts_gprs_enabled, cfg_bts_gprs_enabled_cmd,
-	"gprs enabled <0-1>",
-	"GPRS Enabled on this BTS")
+DEFUN(cfg_bts_gprs_mode, cfg_bts_gprs_mode_cmd,
+	"gprs mode (none|gprs|egprs)",
+	"GPRS Mode for this BTS")
 {
 	struct gsm_bts *bts = vty->index;
 
-	bts->gprs.enabled = atoi(argv[0]);
+	bts->gprs.mode = bts_gprs_mode_parse(argv[0]);
 
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_bts_pag_free, cfg_bts_pag_free_cmd,
+      "paging free FREE_NR",
+      "Only page when having a certain amount of free slots. -1 to disable")
+{
+	struct gsm_bts *bts = vty->index;
+
+	bts->paging.free_chans_need = atoi(argv[0]);
+	return CMD_SUCCESS;
+}
 
 /* per TRX configuration */
 DEFUN(cfg_trx,
@@ -1902,6 +2177,8 @@ DEFUN(cfg_ts_e1_subslot,
 	return CMD_SUCCESS;
 }
 
+extern int bsc_vty_init_extra(struct gsm_network *net);
+
 int bsc_vty_init(struct gsm_network *net)
 {
 	gsmnet = net;
@@ -1914,13 +2191,17 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(VIEW_NODE, &show_trx_cmd);
 	install_element(VIEW_NODE, &show_ts_cmd);
 	install_element(VIEW_NODE, &show_lchan_cmd);
+	install_element(VIEW_NODE, &show_lchan_summary_cmd);
+	install_element(VIEW_NODE, &show_lchan_status_cmd);
 
 	install_element(VIEW_NODE, &show_e1drv_cmd);
 	install_element(VIEW_NODE, &show_e1line_cmd);
 	install_element(VIEW_NODE, &show_e1ts_cmd);
 
 	install_element(VIEW_NODE, &show_paging_cmd);
-	install_element(VIEW_NODE, &show_stats_cmd);
+
+	install_element(VIEW_NODE, &drop_bts_cmd);
+	install_element(VIEW_NODE, &test_bts_lchan_alloc_cmd);
 
 	openbsc_vty_add_cmds();
         
@@ -1962,6 +2243,11 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(GSMNET_NODE, &cfg_net_T3141_cmd);
 	install_element(GSMNET_NODE, &cfg_net_bsc_token_cmd);
 	install_element(GSMNET_NODE, &cfg_net_pag_any_tch_cmd);
+	install_element(GSMNET_NODE, &cfg_net_msc_ip_cmd);
+	install_element(GSMNET_NODE, &cfg_net_msc_port_cmd);
+	install_element(GSMNET_NODE, &cfg_net_msc_prio_cmd);
+	install_element(GSMNET_NODE, &cfg_net_ping_time_cmd);
+	install_element(GSMNET_NODE, &cfg_net_pong_time_cmd);
 
 	install_element(GSMNET_NODE, &cfg_bts_cmd);
 	install_node(&bts_node, config_write_bts);
@@ -1979,19 +2265,25 @@ int bsc_vty_init(struct gsm_network *net)
 	install_element(BTS_NODE, &cfg_bts_challoc_cmd);
 	install_element(BTS_NODE, &cfg_bts_rach_tx_integer_cmd);
 	install_element(BTS_NODE, &cfg_bts_rach_max_trans_cmd);
+	install_element(BTS_NODE, &cfg_bts_rach_nm_b_thresh_cmd);
+	install_element(BTS_NODE, &cfg_bts_rach_nm_ldavg_cmd);
 	install_element(BTS_NODE, &cfg_bts_cell_barred_cmd);
+	install_element(BTS_NODE, &cfg_bts_rach_ec_allowed_cmd);
 	install_element(BTS_NODE, &cfg_bts_ms_max_power_cmd);
 	install_element(BTS_NODE, &cfg_bts_per_loc_upd_cmd);
 	install_element(BTS_NODE, &cfg_bts_cell_resel_hyst_cmd);
 	install_element(BTS_NODE, &cfg_bts_rxlev_acc_min_cmd);
-	install_element(BTS_NODE, &cfg_bts_gprs_enabled_cmd);
+	install_element(BTS_NODE, &cfg_bts_gprs_mode_cmd);
+	install_element(BTS_NODE, &cfg_bts_gprs_ns_timer_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_rac_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_bvci_cmd);
+	install_element(BTS_NODE, &cfg_bts_gprs_cell_timer_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsei_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvci_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvc_lport_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvc_rport_cmd);
 	install_element(BTS_NODE, &cfg_bts_gprs_nsvc_rip_cmd);
+	install_element(BTS_NODE, &cfg_bts_pag_free_cmd);
 
 	install_element(BTS_NODE, &cfg_trx_cmd);
 	install_node(&trx_node, dummy_config_write);

openbsc/src/vty_interface_bsc.c

@@ -27,22 +27,69 @@
 #include <vty/vty.h>
 
 #include <openbsc/gsm_data.h>
+#include <openbsc/bsc_msc.h>
+#include <openbsc/vty.h>
 
-static struct gsmnet *gsmnet = NULL;
+#include <sccp/sccp.h>
+
+static struct gsm_network *gsmnet = NULL;
+
+extern struct llist_head *bsc_sccp_connections();
 
 DEFUN(show_bsc, show_bsc_cmd, "show bsc",
 	SHOW_STR "Display information about the BSC\n")
 {
-	vty_out(vty, "BSC... not implemented yet%s", VTY_NEWLINE);
+	struct bss_sccp_connection_data *con;
+
+	vty_out(vty, "BSC Information%s", VTY_NEWLINE);
+	llist_for_each_entry(con, bsc_sccp_connections(), active_connections) {
+		vty_out(vty, " Connection: LCHAN: %p sec LCHAN: 0x%p SCCP src: 0x%x dest: 0x%x%s",
+			con->lchan, con->secondary_lchan,
+			con->sccp ? (int) sccp_src_ref_to_int(&con->sccp->source_local_reference) : -1,
+			con->sccp ? (int) sccp_src_ref_to_int(&con->sccp->destination_local_reference) : -1,
+			VTY_NEWLINE);
+	}
+
 	return CMD_SUCCESS;
 }
 
+DEFUN(show_stats,
+      show_stats_cmd,
+      "show statistics",
+	SHOW_STR "Display network statistics\n")
+{
+	struct gsm_network *net = gsmnet;
+
+	openbsc_vty_print_statistics(vty, net);
+	return CMD_SUCCESS;
+}
+
+DEFUN(show_msc,
+      show_msc_cmd,
+      "show msc connection",
+      SHOW_STR "Show the status of the MSC connection.")
+{
+	if (!gsmnet->msc_con) {
+		vty_out(vty, "The MSC is not yet configured.\n");
+		return CMD_WARNING;
+	}
+
+	vty_out(vty, "MSC on %s:%d is connected: %d%s\n",
+		gsmnet->msc_con->ip, gsmnet->msc_con->port,
+		gsmnet->msc_con->is_connected, VTY_NEWLINE);
+
+	return CMD_SUCCESS;
+}
+
+
 int bsc_vty_init_extra(struct gsm_network *net)
 {
 	gsmnet = net;
 
 	/* get runtime information */
 	install_element(VIEW_NODE, &show_bsc_cmd);
+	install_element(VIEW_NODE, &show_stats_cmd);
+	install_element(VIEW_NODE, &show_msc_cmd);
 
 	return 0;
 }

openbsc/src/vty_interface_cmds.c

@@ -228,6 +228,23 @@ DEFUN(diable_logging,
 	return CMD_SUCCESS;
 }
 
+void openbsc_vty_print_statistics(struct vty *vty, struct gsm_network *net)
+{
+	vty_out(vty, "Channel Requests        : %lu total, %lu no channel%s",
+		counter_get(net->stats.chreq.total),
+		counter_get(net->stats.chreq.no_channel), VTY_NEWLINE);
+	vty_out(vty, "Channel Failures        : %lu rf_failures, %lu rll failures%s",
+		counter_get(net->stats.chan.rf_fail),
+		counter_get(net->stats.chan.rll_err), VTY_NEWLINE);
+	vty_out(vty, "Paging                  : %lu attempted, %lu complete, %lu expired%s",
+		counter_get(net->stats.paging.attempted),
+		counter_get(net->stats.paging.completed),
+		counter_get(net->stats.paging.expired), VTY_NEWLINE);
+	vty_out(vty, "BTS failures            : %lu OML, %lu RSL%s",
+		counter_get(net->stats.bts.oml_fail),
+		counter_get(net->stats.bts.rsl_fail), VTY_NEWLINE);
+}
+
 void openbsc_vty_add_cmds()
 {
 	install_element(VIEW_NODE, &enable_logging_cmd);

openbsc/src/vty_interface_layer3.c

@@ -41,6 +41,7 @@
 #include <osmocore/talloc.h>
 #include <openbsc/signal.h>
 #include <openbsc/debug.h>
+#include <openbsc/vty.h>
 
 static struct gsm_network *gsmnet;
 
@@ -57,7 +58,7 @@ static int dummy_config_write(struct vty *v)
 
 static struct buffer *argv_to_buffer(int argc, const char *argv[], int base)
 {
-	struct buffer *b = buffer_new(1024);
+	struct buffer *b = buffer_new(NULL, 1024);
 	int i;
 
 	if (!b)
@@ -502,6 +503,41 @@ static int scall_cbfn(unsigned int subsys, unsigned int signal,
 	return 0;
 }
 
+DEFUN(show_stats,
+      show_stats_cmd,
+      "show statistics",
+	SHOW_STR "Display network statistics\n")
+{
+	struct gsm_network *net = gsmnet;
+
+	openbsc_vty_print_statistics(vty, net);
+	vty_out(vty, "Location Update         : %lu attach, %lu normal, %lu periodic%s",
+		counter_get(net->stats.loc_upd_type.attach),
+		counter_get(net->stats.loc_upd_type.normal),
+		counter_get(net->stats.loc_upd_type.periodic), VTY_NEWLINE);
+	vty_out(vty, "IMSI Detach Indications : %lu%s",
+		counter_get(net->stats.loc_upd_type.detach), VTY_NEWLINE);
+	vty_out(vty, "Location Update Response: %lu accept, %lu reject%s",
+		counter_get(net->stats.loc_upd_resp.accept),
+		counter_get(net->stats.loc_upd_resp.reject), VTY_NEWLINE);
+	vty_out(vty, "Handover                : %lu attempted, %lu no_channel, %lu timeout, "
+		"%lu completed, %lu failed%s",
+		counter_get(net->stats.handover.attempted),
+		counter_get(net->stats.handover.no_channel),
+		counter_get(net->stats.handover.timeout),
+		counter_get(net->stats.handover.completed),
+		counter_get(net->stats.handover.failed), VTY_NEWLINE);
+	vty_out(vty, "SMS MO                  : %lu submitted, %lu no receiver%s",
+		counter_get(net->stats.sms.submitted),
+		counter_get(net->stats.sms.no_receiver), VTY_NEWLINE);
+	vty_out(vty, "SMS MT                  : %lu delivered, %lu no memory, %lu other error%s",
+		counter_get(net->stats.sms.delivered),
+		counter_get(net->stats.sms.rp_err_mem),
+		counter_get(net->stats.sms.rp_err_other), VTY_NEWLINE);
+	return CMD_SUCCESS;
+}
+
+
 int bsc_vty_init_extra(struct gsm_network *net)
 {
 	gsmnet = net;
@@ -517,6 +553,7 @@ int bsc_vty_init_extra(struct gsm_network *net)
 	install_element(VIEW_NODE, &subscriber_silent_sms_cmd);
 	install_element(VIEW_NODE, &subscriber_silent_call_start_cmd);
 	install_element(VIEW_NODE, &subscriber_silent_call_stop_cmd);
+	install_element(VIEW_NODE, &show_stats_cmd);
 
 	install_element(CONFIG_NODE, &cfg_subscr_cmd);
 	install_node(&subscr_node, dummy_config_write);

openbsc/tests/bsc-nat/Makefile.am

@@ -13,5 +13,5 @@ bsc_nat_test_SOURCES = bsc_nat_test.c \
 			$(top_srcdir)/src/mgcp/mgcp_protocol.c \
 			$(top_srcdir)/src/mgcp/mgcp_network.c \
 			$(top_srcdir)/src/bssap.c
-bsc_nat_test_LDADD = $(top_builddir)/src/libbsc.a $(top_builddir)/src/libsccp.a $(LIBOSMOCORE_LIBS)
+bsc_nat_test_LDADD = $(top_builddir)/src/libbsc.a $(top_builddir)/src/libsccp.a $(LIBOSMOCORE_LIBS) -lrt
 

openbsc/tests/bsc-nat/bsc_nat_test.c

@@ -96,12 +96,40 @@ static const u_int8_t connnection_it[] = {
 	0x00, 0x00, 0x00, 0x00,
 };
 
+/* error in both directions */
+static const u_int8_t proto_error[] = {
+	0x00, 0x05, 0xfd,
+	0x0f, 0x22, 0x33, 0x44, 0x00,
+};
+
 /* MGCP wrap... */
 static const u_int8_t mgcp_msg[] = {
 	0x00, 0x03, 0xfc,
 	0x20, 0x20, 0x20,
 };
 
+/* location updating request */
+static const u_int8_t bss_lu[] = {
+	0x00, 0x2e, 0xfd,
+	0x01, 0x91, 0x45, 0x14, 0x02, 0x02, 0x04, 0x02,
+	0x42, 0xfe, 0x0f, 0x21, 0x00, 0x1f, 0x57, 0x05,
+	0x08, 0x00, 0x72, 0xf4, 0x80, 0x20, 0x14, 0xc3,
+	0x50, 0x17, 0x12, 0x05, 0x08, 0x70, 0x72, 0xf4,
+	0x80, 0xff, 0xfe, 0x30, 0x08, 0x29, 0x44, 0x50,
+	0x12, 0x03, 0x24, 0x01, 0x95, 0x00
+};
+
+/* paging response */
+static const uint8_t pag_resp[] = {
+	0x00, 0x2c, 0xfd, 0x01, 0xe5, 0x68,
+	0x14, 0x02, 0x02, 0x04, 0x02, 0x42, 0xfe, 0x0f,
+	0x1f, 0x00, 0x1d, 0x57, 0x05, 0x08, 0x00, 0x72,
+	0xf4, 0x80, 0x20, 0x16, 0xc3, 0x50, 0x17, 0x10,
+	0x06, 0x27, 0x01, 0x03, 0x30, 0x18, 0x96, 0x08,
+	0x29, 0x26, 0x30, 0x32, 0x11, 0x42, 0x01, 0x19,
+	0x00
+};
+
 struct filter_result {
 	const u_int8_t *data;
 	const u_int16_t length;
@@ -176,6 +204,19 @@ static const struct filter_result results[] = {
 		.dir = DIR_MSC,
 		.result = 0,
 	},
+	{
+		.data = proto_error,
+		.length = ARRAY_SIZE(proto_error),
+		.dir = DIR_BSC,
+		.result = 0,
+	},
+	{
+		.data = proto_error,
+		.length = ARRAY_SIZE(proto_error),
+		.dir = DIR_MSC,
+		.result = 0,
+	},
+
 };
 
 static void test_filter(void)
@@ -232,36 +273,41 @@ static void copy_to_msg(struct msgb *msg, const u_int8_t *data, unsigned int len
 /* test conn tracking once */
 static void test_contrack()
 {
-	int rc;
 	struct bsc_nat *nat;
 	struct bsc_connection *con;
 	struct sccp_connections *con_found;
+	struct sccp_connections *rc_con;
 	struct bsc_nat_parsed *parsed;
 	struct msgb *msg;
 
 	fprintf(stderr, "Testing connection tracking.\n");
 	nat = bsc_nat_alloc();
 	con = bsc_connection_alloc(nat);
+	con->cfg = bsc_config_alloc(nat, "foo", 23);
 	msg = msgb_alloc(4096, "test");
 
 	/* 1.) create a connection */
 	copy_to_msg(msg, bsc_cr, sizeof(bsc_cr));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (con_found != NULL) {
 		fprintf(stderr, "Con should not exist %p\n", con_found);
 		abort();
 	}
-	rc = create_sccp_src_ref(con, msg, parsed);
-	if (rc != 0) {
+	rc_con = create_sccp_src_ref(con, parsed);
+	if (!rc_con) {
 		fprintf(stderr, "Failed to create a ref\n");
 		abort();
 	}
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (!con_found || con_found->bsc != con) {
 		fprintf(stderr, "Failed to find the con: %p\n", con_found);
 		abort();
 	}
+	if (con_found != rc_con) {
+		fprintf(stderr, "Failed to find the right connection.\n");
+		abort();
+	}
 	if (memcmp(msg->data, bsc_cr_patched, sizeof(bsc_cr_patched)) != 0) {
 		fprintf(stderr, "Failed to patch the BSC CR msg.\n");
 		abort();
@@ -281,7 +327,7 @@ static void test_contrack()
 	/* 3.) send some data */
 	copy_to_msg(msg, bsc_dtap, sizeof(bsc_dtap));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	VERIFY(con_found, con, msg, bsc_dtap_patched, "BSC DTAP");
 
 	/* 4.) receive some data */
@@ -299,7 +345,7 @@ static void test_contrack()
 	/* 6.) confirm the connection close */
 	copy_to_msg(msg, bsc_rlc, sizeof(bsc_rlc));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 	if (!con_found || con_found->bsc != con) {
 		fprintf(stderr, "Failed to find the con: %p\n", con_found);
 		abort();
@@ -313,7 +359,7 @@ static void test_contrack()
 
 	copy_to_msg(msg, bsc_rlc, sizeof(bsc_rlc));
 	parsed = bsc_nat_parse(msg);
-	con_found = patch_sccp_src_ref_to_msc(msg, parsed, nat);
+	con_found = patch_sccp_src_ref_to_msc(msg, parsed, con);
 
 	/* verify that it is gone */
 	if (con_found != NULL) {
@@ -329,6 +375,7 @@ static void test_contrack()
 
 static void test_paging(void)
 {
+	int lac;
 	struct bsc_nat *nat;
 	struct bsc_connection *con;
 	struct bsc_nat_parsed *parsed;
@@ -347,7 +394,7 @@ static void test_paging(void)
 
 	/* Test completely bad input */
 	copy_to_msg(msg, paging_by_lac_cmd, sizeof(paging_by_lac_cmd));
-	if (bsc_nat_find_bsc(nat, msg) != 0) {
+	if (bsc_nat_find_bsc(nat, msg, &lac) != 0) {
 		fprintf(stderr, "Should have not found anything.\n");
 		abort();
 	}
@@ -355,7 +402,7 @@ static void test_paging(void)
 	/* Test it by not finding it */
 	copy_to_msg(msg, paging_by_lac_cmd, sizeof(paging_by_lac_cmd));
 	parsed = bsc_nat_parse(msg);
-	if (bsc_nat_find_bsc(nat, msg) != 0) {
+	if (bsc_nat_find_bsc(nat, msg, &lac) != 0) {
 		fprintf(stderr, "Should have not found aynthing.\n");
 		abort();
 	}
@@ -365,7 +412,7 @@ static void test_paging(void)
 	cfg.lac = 8213;
 	copy_to_msg(msg, paging_by_lac_cmd, sizeof(paging_by_lac_cmd));
 	parsed = bsc_nat_parse(msg);
-	if (bsc_nat_find_bsc(nat, msg) != con) {
+	if (bsc_nat_find_bsc(nat, msg, &lac) != con) {
 		fprintf(stderr, "Should have found it.\n");
 		abort();
 	}
@@ -374,6 +421,8 @@ static void test_paging(void)
 
 static void test_mgcp_ass_tracking(void)
 {
+	struct bsc_connection *bsc;
+	struct bsc_nat *nat;
 	struct sccp_connections con;
 	struct bsc_nat_parsed *parsed;
 	struct msgb *msg;
@@ -381,6 +430,14 @@ static void test_mgcp_ass_tracking(void)
 	fprintf(stderr, "Testing MGCP.\n");
 	memset(&con, 0, sizeof(con));
 
+	nat = bsc_nat_alloc();
+	nat->bsc_endpoints = talloc_zero_array(nat,
+					       struct bsc_endpoint,
+					       33);
+	bsc = bsc_connection_alloc(nat);
+	bsc->cfg = bsc_config_alloc(nat, "foo", 2323);
+	con.bsc = bsc;
+
 	msg = msgb_alloc(4096, "foo");
 	copy_to_msg(msg, ass_cmd, sizeof(ass_cmd));
 	parsed = bsc_nat_parse(msg);
@@ -400,11 +457,13 @@ static void test_mgcp_ass_tracking(void)
 	}
 	talloc_free(parsed);
 
-	bsc_mgcp_clear(&con);
+	bsc_mgcp_dlcx(&con);
 	if (con.bsc_timeslot != -1 || con.msc_timeslot != -1) {
 		fprintf(stderr, "Clearing should remove the mapping.\n");
 		abort();
 	}
+
+	talloc_free(nat);
 }
 
 /* test the code to find a given connection */
@@ -431,14 +490,14 @@ static void test_mgcp_find(void)
 		abort();
 	}
 
-	if (bsc_mgcp_find_con(nat, 12) != con) {
+	if (bsc_mgcp_find_con(nat, 12) != sccp_con) {
 		fprintf(stderr, "Didn't find the connection\n");
 		abort();
 	}
 
 	sccp_con->msc_timeslot = 0;
 	sccp_con->bsc_timeslot = 0;
-	if (bsc_mgcp_find_con(nat, 1) != con) {
+	if (bsc_mgcp_find_con(nat, 1) != sccp_con) {
 		fprintf(stderr, "Didn't find the connection\n");
 		abort();
 	}
@@ -507,6 +566,135 @@ static void test_mgcp_parse(void)
 	}
 }
 
+struct cr_filter {
+	const u_int8_t *data;
+	int length;
+	int result;
+	int contype;
+
+	const char *bsc_imsi_allow;
+	const char *bsc_imsi_deny;
+	const char *nat_imsi_deny;
+};
+
+static struct cr_filter cr_filter[] = {
+	{
+		.data = bssmap_cr,
+		.length = sizeof(bssmap_cr),
+		.result = 0,
+		.contype = NAT_CON_TYPE_CM_SERV_REQ,
+	},
+	{
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		.data = pag_resp,
+		.length = sizeof(pag_resp),
+		.result = 0,
+		.contype = NAT_CON_TYPE_PAG_RESP,
+	},
+	{
+		/* nat deny is before blank/null BSC */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = -3,
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* BSC allow is before NAT deny */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.nat_imsi_deny = "[0-9]*",
+		.bsc_imsi_allow = "2440[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* BSC allow is before NAT deny */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = 0,
+		.bsc_imsi_allow = "[0-9]*",
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+	{
+		/* filter as deny is first */
+		.data = bss_lu,
+		.length = sizeof(bss_lu),
+		.result = -2,
+		.bsc_imsi_deny = "[0-9]*",
+		.bsc_imsi_allow = "[0-9]*",
+		.nat_imsi_deny = "[0-9]*",
+		.contype = NAT_CON_TYPE_LU,
+	},
+
+};
+
+static void test_cr_filter()
+{
+	int i, res, contype;
+	struct msgb *msg = msgb_alloc(4096, "test_cr_filter");
+	struct bsc_nat_parsed *parsed;
+	struct bsc_nat_acc_lst *nat_lst, *bsc_lst;
+	struct bsc_nat_acc_lst_entry *nat_entry, *bsc_entry;
+
+	struct bsc_nat *nat = bsc_nat_alloc();
+	struct bsc_connection *bsc = bsc_connection_alloc(nat);
+	bsc->cfg = bsc_config_alloc(nat, "foo", 1234);
+	bsc->cfg->acc_lst_name = "bsc";
+	nat->acc_lst_name = "nat";
+
+	nat_lst = bsc_nat_acc_lst_get(nat, "nat");
+	bsc_lst = bsc_nat_acc_lst_get(nat, "bsc");
+
+	bsc_entry = bsc_nat_acc_lst_entry_create(bsc_lst);
+	nat_entry = bsc_nat_acc_lst_entry_create(nat_lst);
+
+	for (i = 0; i < ARRAY_SIZE(cr_filter); ++i) {
+		msgb_reset(msg);
+		copy_to_msg(msg, cr_filter[i].data, cr_filter[i].length);
+
+		nat_lst = bsc_nat_acc_lst_get(nat, "nat");
+		bsc_lst = bsc_nat_acc_lst_get(nat, "bsc");
+
+		bsc_parse_reg(nat_entry, &nat_entry->imsi_deny_re, &nat_entry->imsi_deny,
+			      cr_filter[i].nat_imsi_deny ? 1 : 0,
+			      &cr_filter[i].nat_imsi_deny);
+		bsc_parse_reg(bsc_entry, &bsc_entry->imsi_allow_re, &bsc_entry->imsi_allow,
+			      cr_filter[i].bsc_imsi_allow ? 1 : 0,
+			      &cr_filter[i].bsc_imsi_allow);
+		bsc_parse_reg(bsc_entry, &bsc_entry->imsi_deny_re, &bsc_entry->imsi_deny,
+			      cr_filter[i].bsc_imsi_deny ? 1 : 0,
+			      &cr_filter[i].bsc_imsi_deny);
+
+		parsed = bsc_nat_parse(msg);
+		if (!parsed) {
+			fprintf(stderr, "FAIL: Failed to parse the message\n");
+			abort();
+		}
+
+		res = bsc_nat_filter_sccp_cr(bsc, msg, parsed, &contype);
+		if (res != cr_filter[i].result) {
+			fprintf(stderr, "FAIL: Wrong result %d for test %d.\n", res, i);
+			abort();
+		}
+
+		if (contype != cr_filter[i].contype) {
+			fprintf(stderr, "FAIL: Wrong contype %d for test %d.\n", res, contype);
+			abort();
+		}
+
+		talloc_free(parsed);
+	}
+
+	msgb_free(msg);
+}
+
 int main(int argc, char **argv)
 {
 	struct log_target *stderr_target;
@@ -523,6 +711,7 @@ int main(int argc, char **argv)
 	test_mgcp_find();
 	test_mgcp_rewrite();
 	test_mgcp_parse();
+	test_cr_filter();
 	return 0;
 }
 

openbsc/tests/debug/debug_test.c

@@ -38,4 +38,6 @@ int main(int argc, char** argv)
 	DEBUGP(DRLL, "You should see this\n");
 	DEBUGP(DCC, "You should see this\n");
 	DEBUGP(DMM, "You should not see this\n");
+
+	return 0;
 }

openbsc/tests/sccp/sccp_test.c

@@ -264,6 +264,10 @@ static const u_int8_t it_test[] = {
 0x10, 0x01, 0x07, 
 0x94, 0x01, 0x04, 0x00, 0x02, 0x00, 0x00, 0x00 };
 
+static const u_int8_t proto_err[] = {
+0x0f, 0x0c, 0x04, 0x00, 0x00,
+};
+
 static const struct sccp_parse_header_result parse_result[] = {
 	{
 		.msg_type	= SCCP_MSG_TYPE_IT,
@@ -287,6 +291,21 @@ static const struct sccp_parse_header_result parse_result[] = {
 		.input		= it_test,
 		.input_len	= sizeof(it_test),
 	},
+	{
+		.msg_type	= SCCP_MSG_TYPE_ERR,
+		.wanted_len	= 0,
+		.src_ssn	= -1,
+		.dst_ssn	= -1,
+		.has_src_ref	= 0,
+		.has_dst_ref	= 1,
+		.dst_ref	= {
+			.octet1 = 0x0c,
+			.octet2 = 0x04,
+			.octet3 = 0x00,
+		},
+		.input		= proto_err,
+		.input_len	= sizeof(proto_err),
+	},
 };
 
 
@@ -777,7 +796,7 @@ static void test_sccp_parsing(void)
 
 		memset(&result, 0, sizeof(result));
 		if (sccp_parse_header(msg, &result) != 0) {
-			fprintf(stderr, "Failed to parse test: %d\n", current_test);
+			fprintf(stderr, "Failed to sccp parse test: %d\n", current_test);
 		} else {
 			if (parse_result[current_test].wanted_len != result.data_len) {
 				fprintf(stderr, "Unexpected data length.\n");