Change in osmo-ttcn3-hacks[master]: PCU: also test GSGN originated PS/CS Paging containing TMSI

This is merely a historical archive of years 2008-2021, before the migration to mailman3.

A maintained and still updated list archive can be found at https://lists.osmocom.org/hyperkitty/list/gerrit-log@lists.osmocom.org/.

pespin gerrit-no-reply at lists.osmocom.org
Thu Mar 26 12:46:09 UTC 2020


pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/17616 )

Change subject: PCU: also test GSGN originated PS/CS Paging containing TMSI
......................................................................

PCU: also test GSGN originated PS/CS Paging containing TMSI

This additional couple of test cases reveals several bugs:

  1) the IUT encodes a erroneous RR Paging Request message
     containing P-TMSI, so TITAN fails to decode it;

  2) the IUT prints an invalid P-TMSI in its log output
     due to load of misaligned address (found by UBSan).

[1] I97fd5ffc15a4a58112d7c37c69b7ac42b0741a0e
[2] Icf8836f216793e342b239c8e6645aac1e82bf324

Change-Id: I7fbec5b2c5c3943a7413417b623f55c135c152d7
---
M library/Osmocom_Gb_Types.ttcn
M pcu/PCU_Tests_RAW.ttcn
2 files changed, 61 insertions(+), 8 deletions(-)

Approvals:
  pespin: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/library/Osmocom_Gb_Types.ttcn b/library/Osmocom_Gb_Types.ttcn
index 518ca80..9189b3e 100644
--- a/library/Osmocom_Gb_Types.ttcn
+++ b/library/Osmocom_Gb_Types.ttcn
@@ -1333,6 +1333,22 @@
 		}
 	}
 
+	template PDU_BSSGP ts_BSSGP_CS_PAGING_PTMSI(BssgpBvci bvci, hexstring imsi, GsmTmsi tmsi) := {
+		pDU_BSSGP_PAGING_CS := {
+			bssgpPduType := '07'O,
+			iMSI := ts_BSSGP_IMSI(imsi),
+			dRX_Parameters := t_defaultDRXparam,
+			paging_Field4 := {
+				bVCI := t_BSSGP_BVCI(bvci)
+			},
+			tLLI := omit,
+			channel_needed := omit,
+			eMLPP_Priority := omit,
+			tMSI := ts_BSSGP_TMSI(tmsi),
+			global_CN_Id := omit
+		}
+	}
+
 	template PDU_BSSGP tr_BSSGP_PS_PAGING(BssgpBvci bvci) := {
 		pDU_BSSGP_PAGING_PS := {
 			bssgpPduType := '06'O,
diff --git a/pcu/PCU_Tests_RAW.ttcn b/pcu/PCU_Tests_RAW.ttcn
index 505592c..62ebcd6 100644
--- a/pcu/PCU_Tests_RAW.ttcn
+++ b/pcu/PCU_Tests_RAW.ttcn
@@ -1364,6 +1364,14 @@
 	}
 }
 
+private function f_pkt_paging_match_tmsi(in PacketPagingReq req, template GsmTmsi tmsi) {
+	if (not match(req.repeated_pageinfo.cs.tmsi, tmsi)) {
+		setverdict(fail, "Mobile Identity (TMSI/P-TMSI) mismatch: ",
+			   "expected: ", tmsi, "got: ", req.repeated_pageinfo.cs.tmsi);
+		mtc.stop;
+	}
+}
+
 /* Test CS paging over the BTS<->PCU socket.
  * When a (class B or C, not A) MS has an active TBF (or is on the PDCH), the MS can not react on CS paging over CCCH.
  * Paging should be send on the PACCH.
@@ -1424,13 +1432,15 @@
 
 /* Test CS paging over Gb (SGSN->PCU->BTS[PDCH]).
  */
-private function f_tc_paging_cs_from_sgsn(Nsvci bvci) runs on RAW_PCU_Test_CT {
+private function f_tc_paging_cs_from_sgsn(Nsvci bvci, boolean use_ptmsi := false)
+runs on RAW_PCU_Test_CT {
 	var GsmRrMessage rr_imm_ass;
 	var PacketUlAssign ul_tbf_ass;
 	var RlcmacDlBlock dl_block;
 	var boolean ok;
 	var OCT4 tlli := '00000001'O;
 	var hexstring imsi := f_gen_imsi(42);
+	var GsmTmsi tmsi;
 
 	/* Initialize NS/BSSGP side */
 	f_init_bssgp();
@@ -1455,18 +1465,31 @@
 		mtc.stop;
 	}
 
-	/* Send paging request */
-	BSSGP[0].send(ts_BSSGP_CS_PAGING_IMSI(bvci, imsi));
+	/* Send paging request with or without TMSI */
+	if (use_ptmsi) {
+		tmsi := oct2int(f_rnd_octstring(4)); /* Random P-TMSI */
+		BSSGP[0].send(ts_BSSGP_CS_PAGING_PTMSI(bvci, imsi, tmsi));
+	} else {
+		BSSGP[0].send(ts_BSSGP_CS_PAGING_IMSI(bvci, imsi));
+	}
 
 	/* Receive it on BTS side towards MS */
 	f_rx_rlcmac_dl_block_exp_pkt_pag_req(dl_block);
 
-	/* Make sure that Packet Paging Request contains the same IMSI */
-	f_pkt_paging_match_imsi(dl_block.ctrl.payload.u.paging, imsi);
+	/* Make sure that Packet Paging Request contains the same P-TMSI/IMSI */
+	if (use_ptmsi) {
+		f_pkt_paging_match_tmsi(dl_block.ctrl.payload.u.paging, tmsi);
+	} else {
+		f_pkt_paging_match_imsi(dl_block.ctrl.payload.u.paging, imsi);
+	}
 
 	setverdict(pass);
 }
 
+testcase TC_paging_cs_from_sgsn_sign_ptmsi() runs on RAW_PCU_Test_CT {
+	f_tc_paging_cs_from_sgsn(0, true);
+}
+
 testcase TC_paging_cs_from_sgsn_sign() runs on RAW_PCU_Test_CT {
 	f_tc_paging_cs_from_sgsn(0);
 }
@@ -1477,12 +1500,14 @@
 
 /* Test PS paging over Gb (SGSN->PCU->BTS[CCCH]).
  */
-private function f_tc_paging_ps_from_sgsn(Nsvci bvci) runs on RAW_PCU_Test_CT {
+private function f_tc_paging_ps_from_sgsn(Nsvci bvci, boolean use_ptmsi := false)
+runs on RAW_PCU_Test_CT {
 	var GsmRrMessage rr_pag_req1;
 	var OCT4 tlli := '00000001'O;
 	var integer imsi_suff_rx;
 	var integer imsi_suff_tx := 423;
 	var hexstring imsi := f_gen_imsi(imsi_suff_tx);
+	var GsmTmsi tmsi;
 
 	/* Initialize NS/BSSGP side */
 	f_init_bssgp();
@@ -1494,8 +1519,13 @@
 	f_bssgp_establish();
 	f_bssgp_client_llgmm_assign('FFFFFFFF'O, tlli);
 
-	/* Send paging request */
-	BSSGP[0].send(ts_BSSGP_PS_PAGING_IMSI(bvci, imsi));
+	/* Send paging request with or without TMSI */
+	if (use_ptmsi) {
+		tmsi := oct2int(f_rnd_octstring(4)); /* Random P-TMSI */
+		BSSGP[0].send(ts_BSSGP_PS_PAGING_PTMSI(bvci, imsi, tmsi));
+	} else {
+		BSSGP[0].send(ts_BSSGP_PS_PAGING_IMSI(bvci, imsi));
+	}
 
 	/* Receive it on BTS side towards MS */
 	f_pcuif_rx_pch_pag_req1(imsi_suff_rx, rr_pag_req1);
@@ -1504,9 +1534,14 @@
 		mtc.stop;
 	}
 
+	/* TODO: match MI (P-TMSI/IMSI) of received RR Paging Request */
 	setverdict(pass);
 }
 
+testcase TC_paging_ps_from_sgsn_sign_ptmsi() runs on RAW_PCU_Test_CT {
+	f_tc_paging_ps_from_sgsn(0, true);
+}
+
 testcase TC_paging_ps_from_sgsn_sign() runs on RAW_PCU_Test_CT {
 	f_tc_paging_ps_from_sgsn(0);
 }
@@ -1530,8 +1565,10 @@
 	execute( TC_mt_ping_pong_with_dl_racap() );
 	execute( TC_imm_ass_dl_block_retrans() );
 	execute( TC_paging_cs_from_bts() );
+	execute( TC_paging_cs_from_sgsn_sign_ptmsi() );
 	execute( TC_paging_cs_from_sgsn_sign() );
 	execute( TC_paging_cs_from_sgsn_ptp() );
+	execute( TC_paging_ps_from_sgsn_sign_ptmsi() );
 	execute( TC_paging_ps_from_sgsn_sign() );
 	execute( TC_paging_ps_from_sgsn_ptp() );
 }

-- 
To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/17616
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings

Gerrit-Project: osmo-ttcn3-hacks
Gerrit-Branch: master
Gerrit-Change-Id: I7fbec5b2c5c3943a7413417b623f55c135c152d7
Gerrit-Change-Number: 17616
Gerrit-PatchSet: 3
Gerrit-Owner: fixeria <axilirator at gmail.com>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: fixeria <axilirator at gmail.com>
Gerrit-Reviewer: pespin <pespin at sysmocom.de>
Gerrit-MessageType: merged
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.osmocom.org/pipermail/gerrit-log/attachments/20200326/da0c080f/attachment.htm>


More information about the gerrit-log mailing list