<p>fixeria <strong>submitted</strong> this change.</p><p><a href="https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/16684">View Change</a></p><div style="white-space:pre-wrap">Approvals:
laforge: Looks good to me, approved
pespin: Looks good to me, but someone else must approve
Jenkins Builder: Verified
</div><pre style="font-family: monospace,monospace; white-space: pre-wrap;">MSC_Tests.ttcn: introduce TC_mm_id_resp_no_identity<br><br>While investigating OS#4340, it was discovered that a malformed<br>MM Identity Request with MI Type '111'B crashes OsmoMSC.<br><br>Unfortunately, I could not find a way to encode such an invalid<br>message in TITAN (because value '111'B is reserved), so I<br>figured out that '000'B also crashes OsmoMSC.<br><br>MM Identity Request is triggered by initiating an Update Location<br>Request with reserved TMSI value 'FFFFFFFF'O (unknown to the MSC).<br><br>Change-Id: I62f23355eb91df2edf9dc837c928cb86b530b743<br>Related: OS#4340<br>---<br>M msc/MSC_Tests.ttcn<br>1 file changed, 38 insertions(+), 0 deletions(-)<br><br></pre><pre style="font-family: monospace,monospace; white-space: pre-wrap;"><span>diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn</span><br><span>index e0d9c7f..c2a5bbb 100644</span><br><span>--- a/msc/MSC_Tests.ttcn</span><br><span>+++ b/msc/MSC_Tests.ttcn</span><br><span>@@ -5778,6 +5778,43 @@</span><br><span> vc_conn.done;</span><br><span> }</span><br><span> </span><br><span style="color: hsl(120, 100%, 40%);">+friend function f_tc_mm_id_resp_no_identity(charstring id, BSC_ConnHdlrPars pars)</span><br><span style="color: hsl(120, 100%, 40%);">+runs on BSC_ConnHdlr {</span><br><span style="color: hsl(120, 100%, 40%);">+ pars.tmsi := 'FFFFFFFF'O;</span><br><span style="color: hsl(120, 100%, 40%);">+ f_init_handler(pars);</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ f_create_gsup_expect(hex2str(g_pars.imsi));</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ /* Initiate Location Updating using an unknown TMSI */</span><br><span style="color: hsl(120, 100%, 40%);">+ f_bssap_compl_l3(f_build_lu_tmsi(pars.tmsi));</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ /* Expect an Identity Request, send response with no identity */</span><br><span style="color: hsl(120, 100%, 40%);">+ BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req(CM_ID_TYPE_IMSI)));</span><br><span style="color: hsl(120, 100%, 40%);">+ BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp({</span><br><span style="color: hsl(120, 100%, 40%);">+ lengthIndicator := 1,</span><br><span style="color: hsl(120, 100%, 40%);">+ mobileIdentityV := {</span><br><span style="color: hsl(120, 100%, 40%);">+ typeOfIdentity := '000'B,</span><br><span style="color: hsl(120, 100%, 40%);">+ oddEvenInd_identity := {</span><br><span style="color: hsl(120, 100%, 40%);">+ no_identity := {</span><br><span style="color: hsl(120, 100%, 40%);">+ oddevenIndicator := '0'B,</span><br><span style="color: hsl(120, 100%, 40%);">+ fillerDigits := '00000'H</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span style="color: hsl(120, 100%, 40%);">+ }</span><br><span style="color: hsl(120, 100%, 40%);">+ })));</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ f_expect_lu_reject();</span><br><span style="color: hsl(120, 100%, 40%);">+ f_expect_clear();</span><br><span style="color: hsl(120, 100%, 40%);">+}</span><br><span style="color: hsl(120, 100%, 40%);">+testcase TC_mm_id_resp_no_identity() runs on MTC_CT {</span><br><span style="color: hsl(120, 100%, 40%);">+ var BSC_ConnHdlr vc_conn;</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ f_init();</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span style="color: hsl(120, 100%, 40%);">+ vc_conn := f_start_handler(refers(f_tc_mm_id_resp_no_identity), 7);</span><br><span style="color: hsl(120, 100%, 40%);">+ vc_conn.done;</span><br><span style="color: hsl(120, 100%, 40%);">+}</span><br><span style="color: hsl(120, 100%, 40%);">+</span><br><span> control {</span><br><span> execute( TC_cr_before_reset() );</span><br><span> execute( TC_lu_imsi_noauth_tmsi() );</span><br><span>@@ -5910,6 +5947,7 @@</span><br><span> execute( TC_lu_and_mt_call_osmux() );</span><br><span> }</span><br><span> execute( TC_invalid_mgcp_crash() );</span><br><span style="color: hsl(120, 100%, 40%);">+ execute( TC_mm_id_resp_no_identity() );</span><br><span> }</span><br><span> </span><br><span> </span><br><span></span><br></pre><p>To view, visit <a href="https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/16684">change 16684</a>. To unsubscribe, or for help writing mail filters, visit <a href="https://gerrit.osmocom.org/settings">settings</a>.</p><div itemscope itemtype="http://schema.org/EmailMessage"><div itemscope itemprop="action" itemtype="http://schema.org/ViewAction"><link itemprop="url" href="https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/16684"/><meta itemprop="name" content="View Change"/></div></div>
<div style="display:none"> Gerrit-Project: osmo-ttcn3-hacks </div>
<div style="display:none"> Gerrit-Branch: master </div>
<div style="display:none"> Gerrit-Change-Id: I62f23355eb91df2edf9dc837c928cb86b530b743 </div>
<div style="display:none"> Gerrit-Change-Number: 16684 </div>
<div style="display:none"> Gerrit-PatchSet: 3 </div>
<div style="display:none"> Gerrit-Owner: fixeria <axilirator@gmail.com> </div>
<div style="display:none"> Gerrit-Reviewer: Jenkins Builder </div>
<div style="display:none"> Gerrit-Reviewer: fixeria <axilirator@gmail.com> </div>
<div style="display:none"> Gerrit-Reviewer: laforge <laforge@osmocom.org> </div>
<div style="display:none"> Gerrit-Reviewer: pespin <pespin@sysmocom.de> </div>
<div style="display:none"> Gerrit-MessageType: merged </div>