Change in osmo-ttcn3-hacks[master]: msc: add TC_attached_imsi_lu_unknown_tmsi()

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

laforge gerrit-no-reply at lists.osmocom.org
Tue Aug 25 11:41:25 UTC 2020


laforge has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/19718 )

Change subject: msc: add TC_attached_imsi_lu_unknown_tmsi()
......................................................................

msc: add TC_attached_imsi_lu_unknown_tmsi()

The test currently fails with osmo-msc master. It uncovers the evil twin aspect
of osmo-msc's VLR, for an attached IMSI re-attaching with an unknown TMSI.

Related: OS#4721
Change-Id: Ia53733fc5bc414b0e3d3897f25b549f5183c862d
---
M msc/MSC_Tests.ttcn
1 file changed, 89 insertions(+), 0 deletions(-)

Approvals:
  laforge: Looks good to me, approved
  fixeria: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index a801db9..43c6287 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -962,6 +962,94 @@
 	vc_conn.done;
 }
 
+/* Test LU by unknown TMSI, while the IMSI is already attached: osmo-msc should switch to the attached vlr_subscr. */
+private function f_tc_attached_imsi_lu_unknown_tmsi(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	f_init_handler(pars);
+
+	var PDU_ML3_MS_NW l3_lu := f_build_lu_tmsi('56111111'O);
+	var PDU_DTAP_MT dtap_mt;
+
+	/* tell GSUP dispatcher to send this IMSI to us */
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_cl3_or_initial_ue(l3_lu);
+
+	/* Send Early Classmark, just for the fun of it */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* Wait for + respond to ID REQ (IMSI) */
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req(CM_ID_TYPE_IMSI)));
+	BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp_IMSI(g_pars.imsi)));
+	f_expect_common_id();
+
+	/* Expect MSC to do UpdateLocation to HLR; respond to it */
+	GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
+	GSUP.send(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn));
+	GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi));
+	GSUP.send(ts_GSUP_UL_RES(g_pars.imsi));
+
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) {
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_TmsiRealloc_Cmpl));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(fail, "Expected LU ACK, but received REJ");
+		mtc.stop;
+		}
+	}
+
+	/* Wait for MM-Information (if enabled) */
+	f_expect_mm_info();
+
+	/* wait for normal teardown */
+	f_expect_clear();
+
+	/* Now the same IMSI is still attached in the VLR, and a LU with an unknown TMSI reveals the same IMSI only
+	 * later during ID Response.  osmo-msc first creates a new vlr_subscr for the unknown TMSI, and as soon as the
+	 * IMSI becomes known, must notice that this IMSI is still regarded as attached, and must not create evil twins.
+	 */
+
+	/* (since the TMSI Reallocation happened, we could do this with exactly the same TMSI as above, but for test
+	 * readability just use a different one.) */
+	l3_lu := f_build_lu_tmsi('56222222'O);
+	f_cl3_or_initial_ue(l3_lu);
+
+	/* Wait for + respond to ID REQ (IMSI) */
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req(CM_ID_TYPE_IMSI)));
+	BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp_IMSI(g_pars.imsi)));
+	f_expect_common_id();
+
+	/* Expect MSC to do UpdateLocation to HLR; respond to it */
+	GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
+	GSUP.send(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn));
+	GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi));
+	GSUP.send(ts_GSUP_UL_RES(g_pars.imsi));
+
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) {
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_TmsiRealloc_Cmpl));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(fail, "Expected LU ACK, but received REJ");
+		mtc.stop;
+		}
+	}
+
+	/* Wait for MM-Information (if enabled) */
+	f_expect_mm_info();
+
+	/* wait for normal teardown */
+	f_expect_clear();
+}
+testcase TC_attached_imsi_lu_unknown_tmsi() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_attached_imsi_lu_unknown_tmsi), 56);
+	vc_conn.done;
+}
+
 friend function f_imsi_detach_by_imsi() runs on BSC_ConnHdlr {
 	var MobileIdentityLV mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
 
@@ -6079,6 +6167,7 @@
 	execute( TC_lu_disconnect() );
 	execute( TC_lu_by_imei() );
 	execute( TC_lu_by_tmsi_noauth_unknown() );
+	execute( TC_attached_imsi_lu_unknown_tmsi() );
 	execute( TC_imsi_detach_by_imsi() );
 	execute( TC_imsi_detach_by_tmsi() );
 	execute( TC_imsi_detach_by_imei() );

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/19718
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: Ia53733fc5bc414b0e3d3897f25b549f5183c862d
Gerrit-Change-Number: 19718
Gerrit-PatchSet: 5
Gerrit-Owner: neels <nhofmeyr at sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <vyanitskiy at sysmocom.de>
Gerrit-Reviewer: laforge <laforge at osmocom.org>
Gerrit-Reviewer: neels <nhofmeyr at sysmocom.de>
Gerrit-CC: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200825/ac79d617/attachment.htm>


More information about the gerrit-log mailing list