Inform the bsc about acked or nacked channels...
On channel allocation the bsc_hack added a cookie to the lchan on
ack and nack we will take a look and then assume it is the channel
we have allocated. This can be easily exploited by a MS sending fake
responses to paging commands. After the channel has been acked we would
have to ask for the tmsi or find the information on the channel
allocation. For now we will guess.
diff --git a/src/bsc_hack.c b/src/bsc_hack.c
index 1cf0731..a0b635d 100644
--- a/src/bsc_hack.c
+++ b/src/bsc_hack.c
@@ -52,6 +52,8 @@
static void bsc_hack_update_request_accepted(struct gsm_bts *bts, u_int32_t assigned_tmi);
static void bsc_hack_channel_allocated(struct gsm_lchan *chan,
enum gsm_chreq_reason_t reason);
+static void bsc_hack_channel_acked(struct gsm_lchan *chan);
+static void bsc_hack_channel_nacked(struct gsm_lchan *chan);
/* The following definitions are for OM and NM packets that we cannot yet
@@ -643,6 +645,8 @@
bts->trx[0].arfcn = HARDCODED_ARFCN;
gsmnet->update_request_accepted = bsc_hack_update_request_accepted;
gsmnet->channel_allocated = bsc_hack_channel_allocated;
+ gsmnet->channel_acked = bsc_hack_channel_acked;
+ gsmnet->channel_nacked = bsc_hack_channel_nacked;
if (mi_setup(bts, 0, mi_cb) < 0)
return -EIO;
@@ -836,6 +840,55 @@
del_timer(&pag_timer);
}
+static void bsc_hack_channel_acked(struct gsm_lchan *lchan)
+{
+ struct pending_registered_station *station;
+ if (llist_empty(&pending_stations)) {
+ DEBUGP(DPAG, "Channel nacked but nothing pending\n");
+ return;
+ }
+
+ station = (struct pending_registered_station*) pending_stations.next;
+ if (station->tmsi != (u_int32_t)lchan->user_data) {
+ DEBUGP(DPAG, "Hmmm the channel is not allocated by the"
+ "station we wanted channel: %u us:%u\n",
+ (u_int32_t)(lchan->user_data), station->tmsi);
+ return;
+ }
+
+ DEBUGP(DPAG, "We have probably paged a channel for tmsi: %u on %d\n",
+ station->tmsi, lchan->nr);
+
+ llist_del(&station->entry);
+ free(station);
+}
+
+/* failed... remove from the list */
+static void bsc_hack_channel_nacked(struct gsm_lchan *lchan)
+{
+ struct pending_registered_station *station;
+ if (llist_empty(&pending_stations)) {
+ DEBUGP(DPAG, "Channel nacked but nothing pending\n");
+ return;
+ }
+
+ station = (struct pending_registered_station*) pending_stations.next;
+ if (station->tmsi != (u_int32_t)lchan->user_data) {
+ DEBUGP(DPAG, "Hmmm the channel is not allocated by the"
+ "station we wanted channel: %u us:%u\n",
+ (u_int32_t)(lchan->user_data), station->tmsi);
+ return;
+ }
+
+
+ /*
+ * give up and go to the next channel
+ */
+ llist_del(&station->entry);
+ free(station);
+ pag_timer_cb(0);
+}
+
int main(int argc, char **argv)
{
/* parse options */