osmith has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-dev/+/27436 )
Change subject: net/templates: split off common osmo-bsc.cfg part
......................................................................
Patch Set 1: Verified+1 Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-dev/+/27436
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-dev
Gerrit-Branch: master
Gerrit-Change-Id: Icb220657888b23ca19546cca78e10ae914f37751
Gerrit-Change-Number: 27436
Gerrit-PatchSet: 1
Gerrit-Owner: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Comment-Date: Fri, 11 Mar 2022 08:00:02 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
osmith has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-dev/+/27434 )
Change subject: net: get missing config variables from config_2g3g
......................................................................
Patch Set 1: Verified+1 Code-Review+2
--
To view, visit https://gerrit.osmocom.org/c/osmo-dev/+/27434
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-dev
Gerrit-Branch: master
Gerrit-Change-Id: I5870d39aee8be84c2024f8a2a71ee4a734a4fc7c
Gerrit-Change-Number: 27434
Gerrit-PatchSet: 1
Gerrit-Owner: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Comment-Date: Fri, 11 Mar 2022 07:59:51 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
Attention is currently required from: neels, fixeria.
osmith has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-dev/+/27432 )
Change subject: net/templates/run.sh: drop 'fg'
......................................................................
Patch Set 1: Verified+1 Code-Review+2
(1 comment)
Patchset:
PS1:
Neels wrote:
> I would invite you to merge your changes without waiting for code
> review. If something breaks for me we can still discuss and tweak it later.
--
To view, visit https://gerrit.osmocom.org/c/osmo-dev/+/27432
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-dev
Gerrit-Branch: master
Gerrit-Change-Id: Iba7a1adbc4f48b0477a53590ffec8af518fdf467
Gerrit-Change-Number: 27432
Gerrit-PatchSet: 1
Gerrit-Owner: osmith <osmith(a)sysmocom.de>
Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-Comment-Date: Fri, 11 Mar 2022 07:59:34 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Gerrit-MessageType: comment
fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-bts/+/27483 )
Change subject: osmo-bts-trx: rx_tchh_fn(): do not calculate BER10k for FACCH twice
......................................................................
osmo-bts-trx: rx_tchh_fn(): do not calculate BER10k for FACCH twice
We already have BER10k calculated in the generic code path, so do
not calculate it once again in the FACCH specific branch.
Change-Id: I5d3955d09990e280d11d687385eeaf5edf437395
---
M src/osmo-bts-trx/sched_lchan_tchh.c
1 file changed, 0 insertions(+), 1 deletion(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-bts refs/changes/83/27483/1
diff --git a/src/osmo-bts-trx/sched_lchan_tchh.c b/src/osmo-bts-trx/sched_lchan_tchh.c
index e47eeb4..ea3d63d 100644
--- a/src/osmo-bts-trx/sched_lchan_tchh.c
+++ b/src/osmo-bts-trx/sched_lchan_tchh.c
@@ -271,7 +271,6 @@
/* FACCH */
if (rc == GSM_MACBLOCK_LEN) {
chan_state->ul_ongoing_facch = 1;
- uint16_t ber10k = compute_ber10k(n_bits_total, n_errors);
if (lchan->nr == 0)
fn_begin = gsm0502_fn_remap(bi->fn, FN_REMAP_FACCH_H0);
else
--
To view, visit https://gerrit.osmocom.org/c/osmo-bts/+/27483
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-bts
Gerrit-Branch: master
Gerrit-Change-Id: I5d3955d09990e280d11d687385eeaf5edf437395
Gerrit-Change-Number: 27483
Gerrit-PatchSet: 1
Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>
Gerrit-MessageType: newchange
neels has submitted this change. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/27427 )
Change subject: Iu: add UEA encryption
......................................................................
Iu: add UEA encryption
Add vty 'encryption uea 0 1 2', defaults to 'encryption uea 0' to yield
previous behavior.
If any UEA above 0 is enabled, include the UEA key in the Iu Security
Mode Command.
I noticed that only the code bit in st_iu_security_cmd_on_enter()
affects the test. The same code in gsm48_gmm_authorize() seems to be
dead code? But applying the patch there as well just to be safe.
We cannot yet verify the chosen UEA to match a configured UEA level,
because the iu_client.c does not send us message details with the
RANAP_IU_EVENT_SECURITY_MODE_COMPLETE.
Also we cannot yet send the set of configured UEA to the hNodeB, since,
again, iu_client.c does not provide the proper API for it.
The proper solution here is to completely dissolve iu_client.c and do
all Iu handling in osmo-sgsn itself -- see OS#5487.
Related: SYS#5516
Related: I1a7c3b156830058c43f15f55883ea301d2d01d5f (osmo-ttcn3-hacks)
Change-Id: I27e8e0078c45426bf227bb44aac82a4875d18d0f
---
M include/osmocom/sgsn/sgsn.h
M src/sgsn/gprs_gmm.c
M src/sgsn/gprs_gmm_attach.c
M src/sgsn/gprs_ranap.c
M src/sgsn/sgsn_vty.c
M tests/osmo-sgsn_test-nodes.vty
6 files changed, 48 insertions(+), 3 deletions(-)
Approvals:
neels: Looks good to me, approved
Jenkins Builder: Verified
diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h
index 8823dea..1b34c2a 100644
--- a/include/osmocom/sgsn/sgsn.h
+++ b/include/osmocom/sgsn/sgsn.h
@@ -77,6 +77,7 @@
enum sgsn_auth_policy auth_policy;
uint8_t gea_encryption_mask;
+ uint8_t uea_encryption_mask;
struct llist_head imsi_acl;
struct sockaddr_in gsup_server_addr;
diff --git a/src/sgsn/gprs_gmm.c b/src/sgsn/gprs_gmm.c
index dfe477c..c2bf7a3 100644
--- a/src/sgsn/gprs_gmm.c
+++ b/src/sgsn/gprs_gmm.c
@@ -41,6 +41,7 @@
#include <osmocom/core/utils.h>
#include <osmocom/core/tdef.h>
#include <osmocom/crypt/auth.h>
+#include <osmocom/crypt/utran_cipher.h>
#include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
#include <osmocom/gprs/gprs_bssgp.h>
@@ -916,7 +917,13 @@
/* The MS is authorized */
#ifdef BUILD_IU
if (ctx->ran_type == MM_CTX_T_UTRAN_Iu && !ctx->iu.ue_ctx->integrity_active) {
- rc = ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, 0, ctx->iu.new_key);
+ /* Is any encryption above UEA0 enabled? */
+ bool send_ck = sgsn->cfg.uea_encryption_mask > (1 << OSMO_UTRAN_UEA0);
+ LOGMMCTXP(LOGL_DEBUG, ctx, "Iu Security Mode Command: %s encryption key (UEA encryption mask = 0x%x)\n",
+ send_ck ? "sending" : "not sending", sgsn->cfg.uea_encryption_mask);
+ /* FIXME: we should send the set of allowed UEA, as in ranap_new_msg_sec_mod_cmd2(). However, this
+ * is not possible in the iu_client API. See OS#5487. */
+ rc = ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, send_ck, ctx->iu.new_key);
ctx->iu.new_key = 0;
return rc;
}
diff --git a/src/sgsn/gprs_gmm_attach.c b/src/sgsn/gprs_gmm_attach.c
index 629cc53..59417df 100644
--- a/src/sgsn/gprs_gmm_attach.c
+++ b/src/sgsn/gprs_gmm_attach.c
@@ -1,4 +1,5 @@
#include <osmocom/core/tdef.h>
+#include <osmocom/crypt/utran_cipher.h>
#include <osmocom/sgsn/gprs_gmm_attach.h>
@@ -257,6 +258,7 @@
{
#ifdef BUILD_IU
struct sgsn_mm_ctx *ctx = fi->priv;
+ bool send_ck;
/* TODO: shouldn't this set always? not only when the integrity_active? */
if (ctx->iu.ue_ctx->integrity_active) {
@@ -264,7 +266,14 @@
return;
}
- ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, 0, ctx->iu.new_key);
+ /* Is any encryption above UEA0 enabled? */
+ send_ck = sgsn->cfg.uea_encryption_mask > (1 << OSMO_UTRAN_UEA0);
+ LOGMMCTXP(LOGL_DEBUG, ctx, "Iu Security Mode Command: %s encryption key (UEA encryption mask = 0x%x)\n",
+ send_ck ? "sending" : "not sending", sgsn->cfg.uea_encryption_mask);
+
+ /* FIXME: we should send the set of allowed UEA, as in ranap_new_msg_sec_mod_cmd2(). However, this
+ * is not possible in the iu_client API. See OS#5487. */
+ ranap_iu_tx_sec_mode_cmd(ctx->iu.ue_ctx, &ctx->auth_triplet.vec, send_ck, ctx->iu.new_key);
ctx->iu.new_key = 0;
#endif
}
diff --git a/src/sgsn/gprs_ranap.c b/src/sgsn/gprs_ranap.c
index ead20f7..ab3a968 100644
--- a/src/sgsn/gprs_ranap.c
+++ b/src/sgsn/gprs_ranap.c
@@ -145,6 +145,11 @@
rc = 0;
break;
case RANAP_IU_EVENT_SECURITY_MODE_COMPLETE:
+ /* FIXME: verify that a permitted UEA level was chosen. Compare how osmo-msc does it in
+ * msc_a_ran_dec_from_msc_i(), case RAN_MSG_CIPHER_MODE_COMPLETE.
+ * We should dissolve iu_client.c, it was a design mistake when first implementing Iu support. osmo-msc
+ * has moved away from it a long time ago.
+ */
/* Continue authentication here */
mm->iu.ue_ctx->integrity_active = 1;
ranap_iu_tx_common_id(mm->iu.ue_ctx, mm->imsi);
diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c
index 56a2d78..a394c41 100644
--- a/src/sgsn/sgsn_vty.c
+++ b/src/sgsn/sgsn_vty.c
@@ -47,6 +47,7 @@
#include <osmocom/vty/vty.h>
#include <osmocom/vty/misc.h>
#include <osmocom/crypt/gprs_cipher.h>
+#include <osmocom/crypt/utran_cipher.h>
#include <osmocom/abis/ipa.h>
#include <osmocom/gprs/gprs_bssgp.h>
@@ -775,9 +776,11 @@
return CMD_SUCCESS;
}
+#define ENCRYPTION_STR "Set encryption algorithms for SGSN\n"
+
DEFUN(cfg_encrypt2, cfg_encrypt2_cmd,
"encryption gea <0-4> [<0-4>] [<0-4>] [<0-4>] [<0-4>]",
- "Set encryption algorithms for SGSN\n"
+ ENCRYPTION_STR
"GPRS Encryption Algorithm\n"
"GEAn Algorithm Number\n"
"GEAn Algorithm Number\n"
@@ -835,6 +838,23 @@
return CMD_SUCCESS;
}
+DEFUN(cfg_encryption_uea, cfg_encryption_uea_cmd,
+ "encryption uea <0-2> [<0-2>] [<0-2>]",
+ ENCRYPTION_STR
+ "UTRAN (3G) encryption algorithms to allow: 0 = UEA0 (no encryption), 1 = UEA1, 2 = UEA2.\n"
+ "UEAn Algorithm Number\n"
+ "UEAn Algorithm Number\n"
+ "UEAn Algorithm Number\n")
+{
+ unsigned int i;
+
+ g_cfg->uea_encryption_mask = 0;
+ for (i = 0; i < argc; i++)
+ g_cfg->uea_encryption_mask |= (1 << atoi(argv[i]));
+
+ return CMD_SUCCESS;
+}
+
DEFUN(cfg_auth_policy, cfg_auth_policy_cmd,
"auth-policy (accept-all|closed|acl-only|remote)",
"Configure the Authorization policy of the SGSN. This setting determines which subscribers are"
@@ -1732,6 +1752,7 @@
/* order matters here: ensure we attempt to parse our new command first! */
install_element(SGSN_NODE, &cfg_encrypt2_cmd);
install_element(SGSN_NODE, &cfg_encrypt_cmd);
+ install_element(SGSN_NODE, &cfg_encryption_uea_cmd);
install_element(SGSN_NODE, &cfg_gsup_ipa_name_cmd);
install_element(SGSN_NODE, &cfg_gsup_remote_ip_cmd);
@@ -1784,6 +1805,7 @@
OSMO_ASSERT(g_cfg);
g_cfg->gea_encryption_mask = 0x1; /* support GEA0 by default unless specific encryption config exists */
+ g_cfg->uea_encryption_mask = (1 << OSMO_UTRAN_UEA0); /* support UEA0 by default unless specific encryption config exists */
rc = vty_read_config_file(config_file, NULL);
if (rc < 0) {
diff --git a/tests/osmo-sgsn_test-nodes.vty b/tests/osmo-sgsn_test-nodes.vty
index f2ed2dc..7e2e3a3 100644
--- a/tests/osmo-sgsn_test-nodes.vty
+++ b/tests/osmo-sgsn_test-nodes.vty
@@ -36,6 +36,7 @@
auth-policy (accept-all|closed|acl-only|remote)
authentication (optional|required)
encryption gea <0-4> [<0-4>] [<0-4>] [<0-4>] [<0-4>]
+ encryption uea <0-2> [<0-2>] [<0-2>]
gsup ipa-name NAME
gsup remote-ip A.B.C.D
gsup remote-port <0-65535>
--
To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/27427
To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings
Gerrit-Project: osmo-sgsn
Gerrit-Branch: master
Gerrit-Change-Id: I27e8e0078c45426bf227bb44aac82a4875d18d0f
Gerrit-Change-Number: 27427
Gerrit-PatchSet: 4
Gerrit-Owner: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: laforge <laforge(a)osmocom.org>
Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de>
Gerrit-Reviewer: osmith <osmith(a)sysmocom.de>
Gerrit-MessageType: merged