Inform the bsc about acked or nacked channels...
On channel allocation the bsc_hack added a cookie to the lchan on
ack and nack we will take a look and then assume it is the channel
we have allocated. This can be easily exploited by a MS sending fake
responses to paging commands. After the channel has been acked we would
have to ask for the tmsi or find the information on the channel
allocation. For now we will guess.
diff --git a/src/abis_rsl.c b/src/abis_rsl.c
index 03498e9..cf79253 100644
--- a/src/abis_rsl.c
+++ b/src/abis_rsl.c
@@ -455,6 +455,8 @@
/* Chapter 8.4.2: Channel Activate Acknowledge */
static int rsl_rx_chan_act_ack(struct msgb *msg)
{
+ struct gsm_lchan *lchan;
+ struct gsm_network *network;
struct abis_rsl_dchan_hdr *rslh = msgb_l2(msg);
/* BTS has confirmed channel activation, we now need
@@ -464,12 +466,20 @@
DEBUGP(DRSL, "Channel Activate ACK Channel 0x%02x\n", rslh->chan_nr);
+ lchan = lchan_lookup(msg->trx, rslh->chan_nr);
+ network = msg->trx->bts->network;
+ if (network->channel_acked)
+ (*network->channel_acked)(lchan);
+
+
return 0;
}
/* Chapter 8.4.3: Channel Activate NACK */
static int rsl_rx_chan_act_nack(struct msgb *msg)
{
+ struct gsm_lchan *lchan;
+ struct gsm_network *network;
struct abis_rsl_dchan_hdr *rslh = msgb_l2(msg);
/* BTS has confirmed channel activation, we now need
@@ -479,6 +489,11 @@
DEBUGP(DRSL, "Channel Activate NACK Channel 0x%02x\n", rslh->chan_nr);
+ lchan = lchan_lookup(msg->trx, rslh->chan_nr);
+ network = msg->trx->bts->network;
+ if (network->channel_nacked)
+ (*network->channel_nacked)(lchan);
+
return 0;
}