January 2024 - gerrit-log - lists.osmocom.org

[S] Change in osmo-ttcn3-hacks[master]: GTP_Templates: Add gtp1_requests template to match GTPv1C req messages
by pespin 17 Jan '24

17 Jan '24

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35574?usp=email ) Change subject: GTP_Templates: Add gtp1_requests template to match GTPv1C req messages ...................................................................... GTP_Templates: Add gtp1_requests template to match GTPv1C req messages I'm finally not using it for now, but since it takes a while to write, leave it there for some lucky future user. Change-Id: Ibf4b98e19ff13f23c552f50ca91832f0d317bbbf --- M library/GTP_Templates.ttcn 1 file changed, 43 insertions(+), 0 deletions(-) Approvals: daniel: Looks good to me, approved Jenkins Builder: Verified fixeria: Looks good to me, but someone else must approve diff --git a/library/GTP_Templates.ttcn b/library/GTP_Templates.ttcn index 30e42e6..3788725 100644 --- a/library/GTP_Templates.ttcn +++ b/library/GTP_Templates.ttcn @@ -19,6 +19,37 @@ import from IPCP_Types all; import from GSM_Types all; // RoutingAreaIdentification, CellIdentity + template (present) OCT1 gtp1_requests := ( + '10'O, /* createPDPContextRequest */ + '12'O, /* updatePDPContextRequest */ + '14'O, /* */ + '16'O, /* deletePDPContextRequest */ + '1B'O, /* pdu_NotificationRequest */ + '1D'O, /* pdu_NotificationRejectRequest */ + '1F'O, /* supportedExtensionHeadersNotification */ + '20'O, /* sendRouteingInformationForGPRSRequest */ + '22'O, /* failureReportRequest */ + '24'O, /* noteMS_GPRSPresentRequest */ + '30'O, /* identificationRequest */ + '32'O, /* sgsn_ContextRequest */ + '35'O, /* forwardRelocationRequest */ + '38'O, /* relocationCancelRequest */ + '3A'O, /* forwardSRNSContext */ + '3D'O, /* uERegistrationQueryRequest */ + '46'O, /* ranInformationRelay */ + '60'O, /* mBMSNotificationRequest */ + '62'O, /* mBMSNotificationRejectRequest */ + '64'O, /* createMBMSContextRequest */ + '66'O, /* updateMBMSContextRequest */ + '68'O, /* deleteMBMSContextRequest */ + '70'O, /* mBMSRegistrationRequest */ + '72'O, /* mBMSDeRegistrationRequest */ + '74'O, /* mBMSSessionStartRequest */ + '76'O, /* mBMSSessionStopRequest */ + '78'O, /* mBMSSessionUpdateRequest */ + '80'O /* mS_InfoChangeNotificationRequest */ + ); + type record GTP_CellId { RoutingAreaIdentification ra_id, CellIdentity cell_id -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35574?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ibf4b98e19ff13f23c552f50ca91832f0d317bbbf Gerrit-Change-Number: 35574 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

1 0

[M] Change in osmo-ttcn3-hacks[master]: mme: Add code to derive NAS token from NAS ul_count
by pespin 17 Jan '24

17 Jan '24

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35570?usp=email ) Change subject: mme: Add code to derive NAS token from NAS ul_count ...................................................................... mme: Add code to derive NAS token from NAS ul_count NAS Token is derived from kasme and NAS ul_count as specified in 3GPP TS 33.401 A.9, and its LSB 16 bits passed to the network when mapping the GUTI to RAI+PTMSI+PTIMSI_SIG. Take the chance to move guti2rai_ptmsi() up to before the place it is used. Change-Id: I5e6003a2fe3e74cc93cfe4a288e6c114aa288d0b --- M library/S1AP_Emulation.ttcn M mme/LTE_CryptoFunctionDefs.cc M mme/LTE_CryptoFunctions.ttcn M mme/MME_Tests.ttcn M mme/key_derivation.c M mme/key_derivation.h 6 files changed, 100 insertions(+), 37 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, but someone else must approve daniel: Looks good to me, approved diff --git a/library/S1AP_Emulation.ttcn b/library/S1AP_Emulation.ttcn index 1ef4a76..e3e3216 100644 --- a/library/S1AP_Emulation.ttcn +++ b/library/S1AP_Emulation.ttcn @@ -438,6 +438,7 @@ var S1APEM_Config s1cfg; var charstring vlr_name, mme_name; var integer ai; + var octetstring kasme; alt { /* Configuration primitive from client */ @@ -544,8 +545,13 @@ f_create_expect_proc(procedureCode, vc_conn); S1AP_PROC.reply(S1APEM_register_proc:{procedureCode, vc_conn}) to vc_conn; } + [] S1AP_PROC.getcall(S1APEM_derive_nas_token:{?, ?, -}) -> param(kasme, vc_conn) { + var integer assoc_id := f_assoc_id_by_comp(vc_conn); + var OCT32 nas_token := f_kdf_nas_token(kasme, S1apAssociationTable[assoc_id].nus.tx_count) + S1apAssociationTable[assoc_id].nus.tx_count := S1apAssociationTable[assoc_id].nus.tx_count + 1; + S1AP_PROC.reply(S1APEM_derive_nas_token:{kasme, vc_conn, nas_token}) to vc_conn; + } } - } } @@ -566,10 +572,12 @@ signature S1APEM_register(in MME_UE_S1AP_ID mme_id, in ENB_UE_S1AP_ID enb_id, in S1AP_ConnHdlr hdlr); signature S1APEM_register_proc(in integer procedureCode, in S1AP_ConnHdlr hdlr); +signature S1APEM_derive_nas_token(in octetstring kasme, in S1AP_ConnHdlr hdlr, out OCT32 nas_token); type port S1APEM_PROC_PT procedure { inout S1APEM_register; inout S1APEM_register_proc; + inout S1APEM_derive_nas_token; } with { extension "internal" }; /* Function that can be used as create_cb and will use the expect table */ @@ -669,6 +677,17 @@ log(procedureCode); } +/* Derive NAS Token (and post-increment ul_count): */ +function f_s1apem_derive_nas_token(in octetstring kasme) runs on S1AP_ConnHdlr return OCT32 +{ + var OCT32 nas_token; + S1AP_PROC.call(S1APEM_derive_nas_token:{kasme, self, -}) { + [] S1AP_PROC.getreply(S1APEM_derive_nas_token:{kasme, self, ?}) -> param(nas_token) { + return nas_token; + }; + } +} + private function f_expect_table_init() runs on S1AP_Emulation_CT { var integer i; diff --git a/mme/LTE_CryptoFunctionDefs.cc b/mme/LTE_CryptoFunctionDefs.cc index da2d521..7f82224 100644 --- a/mme/LTE_CryptoFunctionDefs.cc +++ b/mme/LTE_CryptoFunctionDefs.cc @@ -184,6 +184,14 @@ return OCTETSTRING(sizeof(kenb), kenb); } +OCTETSTRING f__kdf__nas__token(const OCTETSTRING &kasme, const INTEGER &ul_count) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + uint8_t nas_token[32]; + + mme_kdf_nas_token(ttcn_buf_kasme.get_data(), (int)ul_count, nas_token); + return OCTETSTRING(sizeof(nas_token), nas_token); +} } // namespace diff --git a/mme/LTE_CryptoFunctions.ttcn b/mme/LTE_CryptoFunctions.ttcn index 18a3755..f0ea990 100644 --- a/mme/LTE_CryptoFunctions.ttcn +++ b/mme/LTE_CryptoFunctions.ttcn @@ -40,6 +40,8 @@ external function f_kdf_nh(in OCT16 kasme, in OCT32 sync_inp) return OCT32; +external function f_kdf_nas_token(in OCT16 kasme, in integer ul_count) return OCT32; + /********************************************************************************* * mid-level API *********************************************************************************/ diff --git a/mme/MME_Tests.ttcn b/mme/MME_Tests.ttcn index f4f41e2..50b89b3 100644 --- a/mme/MME_Tests.ttcn +++ b/mme/MME_Tests.ttcn @@ -83,6 +83,7 @@ hexstring imsi, charstring ue_ip, NAS_EPS_Types.GUTI guti optional, + octetstring kasme optional, /* TEI (Control) local side, S11 (SGW) */ OCT4 s11_teic_local, @@ -289,6 +290,7 @@ imsi := f_gen_imsi(imsi_suffix), ue_ip := "192.168.123.50", guti := omit, + kasme := omit, s11_teic_local := '00000000'O, s11_teic_remote := omit, s5c_teic_local := '00000000'O, @@ -585,11 +587,11 @@ const OCT3 plmn_id := '00F110'O; const OCT6 sqn := '000000000020'O; const OCT6 ak := substr(autn, 0, 6) xor4b sqn; - var octetstring kasme := f_kdf_kasme(ck, ik, plmn_id, sqn, ak); + g_pars.ue_pars.kasme := f_kdf_kasme(ck, ik, plmn_id, sqn, ak); var S1APEM_Config cfg := { set_nas_keys := { - k_nas_int := f_kdf_nas_int(1, kasme), - k_nas_enc := f_kdf_nas_enc(1, kasme) + k_nas_int := f_kdf_nas_int(1, g_pars.ue_pars.kasme), + k_nas_enc := f_kdf_nas_enc(1, g_pars.ue_pars.kasme) } }; S1AP.send(cfg); @@ -856,6 +858,31 @@ } } + +/* 3GPP TS 23.401 D.3.5, TS 23.003 2.8.2.1 */ +private function guti2rai_ptmsi(in NAS_EPS_Types.GUTI guti, in OCT2 truncated_nas_token, out RoutingAreaIdentity rai, out OCT4 ptmsi, out OCT3 ptmsi_sig) runs on ConnHdlr { + var bitstring mtmsi_bits := oct2bit(guti.mTMSI); + var bitstring ptmsi_bits; + var bitstring ptmsi_sig_bits; + + rai := valueof(ts_RoutingAreaIdentity(guti.mccDigit1 & guti.mccDigit2 & guti.mccDigit3, + guti.mncDigit3 & guti.mncDigit1 & guti.mncDigit2, + guti.mMEGI, guti.mMEC)); + /* 3GPP TS 23.003 2.8.2.0: "P-TMSI shall be of 32 bits length where the two topmost bits are + * reserved and always set to '11'. Hence, for a UE which may handover to GERAN/UTRAN (based on + * subscription and UE capabilities), the corresponding bits in the M-TMSI are set to '11'" + */ + ptmsi_bits := '11'B & substr(mtmsi_bits, 2, 6) & oct2bit(guti.mMEC) & substr(mtmsi_bits, 16, 16); + ptmsi_sig_bits := substr(mtmsi_bits, 8, 8) & oct2bit(truncated_nas_token); + ptmsi := bit2oct(ptmsi_bits); + ptmsi_sig := bit2oct(ptmsi_sig_bits); + /* TODO: The UE shall fill the remaining 2 octets of the <P-TMSI signature> according to clauses 9.1.1, 9.4.1, 10.2.1, or + * 10.5.1 of 3GPP TS.33.401 [89] , as appropriate, for RAU/Attach procedures.*/ +} + +/* Test UE attached to EUTRAN reselecting a GERAN cell. In this scenario, the + * new SGSN will attempt to obtain information of the UE from the old SGSN (MME) + * through Gn interface using SGSN Context Request/Response procedure (OS#6294). */ private function f_gtp_sgsn_context_4g_to_2g(OCT4 new_sgsn_local_teid := '12345678'O) runs on ConnHdlr { var template (value) GTPC_PDUs SGSNContextReqPDU; var RoutingAreaIdentity rai; @@ -864,7 +891,11 @@ var Gtp1cUnitdata gtpc_pdu; var OCT4 old_mme_local_teid; - guti2rai_ptmsi(g_pars.ue_pars.guti, rai, ptmsi, ptmsi_sig); + /* Derive NAS Token (and post-increment ul_count): */ + var OCT32 nas_token := f_s1apem_derive_nas_token(g_pars.ue_pars.kasme); + var OCT2 truncated_nas_token := substr(nas_token, 30, 2); + + guti2rai_ptmsi(g_pars.ue_pars.guti, truncated_nas_token, rai, ptmsi, ptmsi_sig); SGSNContextReqPDU := ts_SGSNContextReqPDU(rai, new_sgsn_local_teid, f_inet_addr(mp_gn_local_ip), ptmsi := ts_PTMSI(ptmsi), ptmsi_sig := ts_PTMSI_sig(ptmsi_sig)); @@ -880,10 +911,10 @@ setverdict(pass); } [] GTP.receive { - setverdict(fail, "unexpected GTPC message from MME"); + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("unexpected GTPC message from MME")); } [] T.timeout { - setverdict(fail, "no SGSN Context Response from MME"); + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("no SGSN Context Response from MME")); } } @@ -1312,36 +1343,6 @@ vc_conn.done; } -/* Test UE attached to EUTRAN reselecting a GERAN cell. In this scenario, the - * new SGSN will attempt to obtain information of the UE from the old SGSN (MME) - * through Gn interface using SGSN Context Request/Response procedure (OS#6294). */ -/* TS 23.003 2.8.2.1 */ -private function guti2rai_ptmsi(in NAS_EPS_Types.GUTI guti, out RoutingAreaIdentity rai, out OCT4 ptmsi, out OCT3 ptmsi_sig) runs on ConnHdlr { - var bitstring mtmsi_bits := oct2bit(guti.mTMSI); - var bitstring ptmsi_bits; - var bitstring ptmsi_sig_bits; - - rai := valueof(ts_RoutingAreaIdentity(guti.mccDigit1 & guti.mccDigit2 & guti.mccDigit3, - guti.mncDigit3 & guti.mncDigit1 & guti.mncDigit2, - guti.mMEGI, guti.mMEC)); - /* 3GPP TS 23.003 2.8.2.0: "P-TMSI shall be of 32 bits length where the two topmost bits are - * reserved and always set to '11'. Hence, for a UE which may handover to GERAN/UTRAN (based on - * subscription and UE capabilities), the corresponding bits in the M-TMSI are set to '11'" - */ - ptmsi_bits := '11'B & substr(mtmsi_bits, 2, 6) & oct2bit(guti.mMEC) & substr(mtmsi_bits, 16, 16); - ptmsi_sig_bits := substr(mtmsi_bits, 8, 8) & oct2bit('0000'O); - ptmsi := bit2oct(ptmsi_bits); - ptmsi_sig := bit2oct(ptmsi_sig_bits); - /* TODO: The UE shall fill the remaining 2 octets of the <P-TMSI signature> according to clauses 9.1.1, 9.4.1, 10.2.1, or - * 10.5.1 of 3GPP TS.33.401 [89] , as appropriate, for RAU/Attach procedures.*/ - /* TODO: 3GPP TS 33.401 9.1.1 The 16 least significant bits available in - * the P-TMSI signature field shall be filled with the truncated NAS-token - * according to 3GPP TS 23.003 [3].The truncated NAS-token is defined as the 16 - * least significant bits of the NAS-token. - * The NAS-token is derived as specified in Annex A.9. The UE shall use the uplink NAS COUNT value that it would use - * in the next NAS message to calculate the NAS-token and increase the stored uplink NAS COUNT value by 1.*/ - /* TODO: mMEC "also copied into the 8 Most Significant Bits of the NRI field within the P-TMSI" */ -} private function f_TC_ue_cell_reselect_eutran_to_geran(ConnHdlrPars pars) runs on ConnHdlr { f_init_handler(pars); f_gtp_register_imsi(g_pars.ue_pars.imsi); diff --git a/mme/key_derivation.c b/mme/key_derivation.c index 36e4c91..8d5d8a4 100644 --- a/mme/key_derivation.c +++ b/mme/key_derivation.c @@ -80,3 +80,19 @@ gnutls_hmac_fast(GNUTLS_MAC_SHA256, k, 32, s, 14, kasme); } + +/* TS33.401 Annex A.9: NAS token derivation for inter-RAT mobility */ +void mme_kdf_nas_token(const uint8_t *kasme, uint32_t ul_count, uint8_t *nas_token) +{ + uint8_t s[7]; + + s[0] = 0x17; /* FC Value */ + + ul_count = htonl(ul_count); + memcpy(s+1, &ul_count, 4); + + s[5] = 0x00; + s[6] = 0x04; + + gnutls_hmac_fast(GNUTLS_MAC_SHA256, kasme, 32, s, 7, nas_token); +} diff --git a/mme/key_derivation.h b/mme/key_derivation.h index 496f52b..ae15b65 100644 --- a/mme/key_derivation.h +++ b/mme/key_derivation.h @@ -19,3 +19,5 @@ void mme_kdf_enb(const uint8_t *kasme, uint32_t ul_count, uint8_t *kenb); void mme_kdf_nh(const uint8_t *kasme, const uint8_t *sync_input, uint8_t *kenb); + +void mme_kdf_nas_token(const uint8_t *kasme, uint32_t ul_count, uint8_t *nas_token); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35570?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I5e6003a2fe3e74cc93cfe4a288e6c114aa288d0b Gerrit-Change-Number: 35570 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

1 0

[M] Change in osmo-ttcn3-hacks[master]: mme: Introduce test TC_ue_cell_reselect_geran_to_eutran
by pespin 17 Jan '24

17 Jan '24

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35513?usp=email ) Change subject: mme: Introduce test TC_ue_cell_reselect_geran_to_eutran ...................................................................... mme: Introduce test TC_ue_cell_reselect_geran_to_eutran This test allows reproducing an idle mobility GERAN->EUTRAN. Related: OS#6294 Change-Id: I6f8f077b99e83e6467d2b0c05148b81dbcf2ede4 --- M library/NAS_Templates.ttcn M library/S1AP_Emulation.ttcn M mme/MME_Tests.ttcn 3 files changed, 241 insertions(+), 6 deletions(-) Approvals: daniel: Looks good to me, approved Jenkins Builder: Verified diff --git a/library/NAS_Templates.ttcn b/library/NAS_Templates.ttcn index 944d857..d45dc7d 100644 --- a/library/NAS_Templates.ttcn +++ b/library/NAS_Templates.ttcn @@ -44,6 +44,9 @@ } const BIT4 c_EPS_SEC_NONE := '0000'B; +const BIT4 c_EPS_SEC_IP := '0001'B; +const BIT4 c_EPS_SEC_IP_CIPH := '0010'B; + const BIT4 c_EPS_NAS_PD_EMM := '0111'B; const BIT4 c_EPS_NAS_PD_ESM := '0010'B; @@ -58,6 +61,16 @@ content := inp } +/* 9.9.3.4A - 10.5.1.2/24.008 */ +template (value) CipheringKeySequenceNumberTV +ts_CipheringKeySequenceNumberTV(template (value) BIT3 key_seq) := { + keySequence := { + keySequence := key_seq, + spare := '0'B + }, + elementIdentifier := '1000'B +} + private template (value) MobileIdentityLV ts_NAS_MobileIdLV(template (value) MobileIdentityV mid) := { lengthIndicator := 0, @@ -178,6 +191,19 @@ ePS_MobileIdentity := ts_NAS_MobileId_GUTI(guti) } +/* 9.9.3.25 Nonce */ +template (value) NonceTV +ts_NonceTV(template (value) OCT4 nonce) := { + elementIdentifier := '55'O, + noncevalue := nonce +} +function f_ts_NonceTV(template (omit) OCT4 nonce) return template (omit) NonceTV { + if (istemplatekind(nonce, "omit")) { + return omit; + } + return ts_NonceTV(nonce); +} + /* 9.9.3.26 P-TMSI signature */ template (value) P_TMSISignatureTV ts_PTMSI_SignatureTV(template (value) OCT3 ptmsi_sig) := { @@ -408,6 +434,20 @@ } } +/* 8.2.27 Tracking Area Update Complete */ +template (value) PDU_NAS_EPS +ts_PDU_NAS_EPS_TrackingAreaUpdateComplete(template (value) BIT4 securityHeaderType := c_EPS_SEC_NONE) := { + protocolDiscriminator := c_EPS_NAS_PD_EMM, + ePS_messages := { + ePS_MobilityManagement := { + pDU_NAS_EPS_TrackingAreaUpdateComplete := { + securityHeaderType := securityHeaderType, + messageType := '01001010'B + } + } + } +} + /* 8.2.28 Tracking Area Update Reject */ template (present) PDU_NAS_EPS tr_PDU_NAS_EPS_TrackingAreaUpdateReject(template (present) EMM_CauseV cause := ?) := { @@ -429,7 +469,9 @@ template (value) PDU_NAS_EPS ts_PDU_NAS_EPS_TrackingAreaUpdateRequest(template (value) EPS_MobileIdentityLV old_guti, template (omit) P_TMSISignatureTV old_ptmsi_sig := omit, - template (omit) GUTI_TypeTV old_guti_type := omit) := { + template (omit) GUTI_TypeTV old_guti_type := omit, + template (omit) NonceTV nonce_ue := omit, + template (omit) CipheringKeySequenceNumberTV gprs_cksn := omit) := { protocolDiscriminator := c_EPS_NAS_PD_EMM, ePS_messages := { ePS_MobilityManagement := { @@ -440,10 +482,10 @@ nasKeySetId := ts_NAS_KeySetIdentifierV, oldGUTI := old_guti, nonCurrentNative_nasKeySetId := omit, - gprsCipheringKeySequenceNumber := omit, + gprsCipheringKeySequenceNumber := gprs_cksn, old_P_TMSISignature := old_ptmsi_sig, additionalGUTI := omit, - nonce := omit, + nonce := nonce_ue, uENetworkCapability := omit, lastVisitedRegisteredTAI := omit, dRXParameter := omit, diff --git a/library/S1AP_Emulation.ttcn b/library/S1AP_Emulation.ttcn index e3e3216..955c690 100644 --- a/library/S1AP_Emulation.ttcn +++ b/library/S1AP_Emulation.ttcn @@ -72,7 +72,8 @@ }; type union S1APEM_Config { NAS_Keys set_nas_keys, - ResetNAScounts reset_nas_counts + ResetNAScounts reset_nas_counts, + NAS_ALG_INT set_nas_alg_int }; type enumerated S1APEM_EventUpDown { @@ -453,6 +454,11 @@ S1apAssociationTable[assoc_id].nus.rx_count := 0; S1apAssociationTable[assoc_id].nus.tx_count := 0; } + /* Configuration primitive from client */ + [] S1AP_CLIENT.receive(S1APEM_Config:{set_nas_alg_int:=?}) -> value s1cfg sender vc_conn { + var integer assoc_id := f_assoc_id_by_comp(vc_conn); + S1apAssociationTable[assoc_id].nus.alg_int := s1cfg.set_nas_alg_int; + } /* S1AP from client: InitialUE */ [] S1AP_CLIENT.receive(tr_S1AP_InitialUE) -> value msg sender vc_conn { /* create a table entry about this connection */ diff --git a/mme/MME_Tests.ttcn b/mme/MME_Tests.ttcn index 2194e8a..aa23a84 100644 --- a/mme/MME_Tests.ttcn +++ b/mme/MME_Tests.ttcn @@ -617,7 +617,7 @@ } -private altstep as_s1ap_handle_IntialCtxSetupReq() runs on ConnHdlr { +private altstep as_s1ap_handle_IntialCtxSetupReq_Attach_Accept() runs on ConnHdlr { var S1AP_PDU rx_msg; var PDU_NAS_EPS rx_nas; [] S1AP.receive(tr_S1AP_IntialCtxSetupReq) -> value rx_msg { @@ -654,6 +654,40 @@ } } +private altstep as_s1ap_handle_IntialCtxSetupReq_TAU_Accept() runs on ConnHdlr { + var S1AP_PDU rx_msg; + var PDU_NAS_EPS rx_nas; + [] S1AP.receive(tr_S1AP_IntialCtxSetupReq) -> value rx_msg { + /* 3GPP TS 23.401 D.3.6 step 22: */ + var template (omit) MME_UE_S1AP_ID mme_ue_id := f_S1AP_get_MME_UE_S1AP_ID(rx_msg); + var template (omit) ENB_UE_S1AP_ID enb_ue_id := f_S1AP_get_ENB_UE_S1AP_ID(rx_msg); + var template (value) E_RABSetupItemCtxtSURes rab_setup_it; + var template (value) E_RABSetupListCtxtSURes rab_setup_items; + var S1APEM_Config cfg; + + S1AP.receive(tr_PDU_NAS_EPS_TrackingAreaUpdateAccept)-> value rx_nas; + + /* Configure integrity protection: */ + cfg := { + set_nas_alg_int := NAS_ALG_IP_EIA1 + }; + S1AP.send(cfg); + + rab_setup_it := ts_S1AP_RABSetupItemCtxtSURes(rab_id := 5, + tla := oct2bit(f_inet_addr(mp_mme_ip)), + gtp_teid := '00000002'O); + rab_setup_items := ts_S1AP_RABSetupListCtxtSURes(rab_setup_it); + S1AP.send(ts_S1AP_InitialCtxSetupResp(valueof(mme_ue_id), valueof(enb_ue_id), rab_setup_items)); + + /* 3GPP TS 23.401 D.3.6 step 23: */ + /* Integrity Protection: TS 24.301 Section 4.4.4.3*/ + S1AP.send(ts_PDU_NAS_EPS_TrackingAreaUpdateComplete(c_EPS_SEC_IP)); + } + [] S1AP.receive(PDU_NAS_EPS:?) -> value rx_nas { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Rx Unexpected NAS PDU msg: ", rx_nas)); + } +} + private altstep as_s1ap_handle_UeContextReleaseCmd(template S1AP_IEs.Cause cause := ?) runs on ConnHdlr { var S1AP_PDU rx_msg; var PDU_NAS_EPS rx_nas; @@ -925,6 +959,43 @@ } +private altstep as_gtp_sgsn_context_2g_to_4g(OCT4 new_sgsn_teid := 'ABABABAB'O, GTP_Templates.GTP_RATType rat_type := GTP_RAT_TYPE_EUTRAN) runs on ConnHdlr { + var Gtp1cUnitdata gtpc_pdu; + + [] GTP.receive(tr_GTPC_SGSNContextReq(g_gn_iface_peer, tr_SGSNContextReqPDU(rat_type := int2oct(enum2int(rat_type), 1)))) -> value gtpc_pdu { + var template (value) PDP_Context_GTPC pdp_ctx; + var template (value) GTPC_PDUs SGSNContextRespPDU; + var Gtp1cUnitdata gtpc_pdu_ack; + var OCT4 old_mme_remote_teid := gtpc_pdu.gtpc.gtpc_pdu.sgsn_ContextRequest.teidControlPlane.teidControlPlane; + + const OCT16 ck := '740d62df9803eebde5120acf358433d0'O; + const OCT16 ik := '11329aae8e8d2941bb226b2061137c58'O; + + pdp_ctx := ts_PDP_Context_GTPC(f_inet_addr(g_pars.ue_pars.ue_ip), + f_inet_addr(mp_gn_local_ip), + c_NAS_defaultAPN, + ggsn_teic := '12345678'O, + ggsn_teid := '87654321'O); + SGSNContextRespPDU := ts_SGSNContextRespPDU(GTP_CAUSE_REQUEST_ACCEPTED, + g_pars.ue_pars.imsi, + new_sgsn_teid, + f_inet_addr(mp_gn_local_ip), + ts_MM_ContextUMTS(ck, ik), + { pdp_ctx }); + GTP.send(ts_GTPC_SGSNContextResp(g_gn_iface_peer, + old_mme_remote_teid, + oct2int(gtpc_pdu.gtpc.opt_part.sequenceNumber), + SGSNContextRespPDU)); + + GTP.receive(tr_GTPC_SGSNContextAck(g_gn_iface_peer, new_sgsn_teid, + tr_SGSNContextAckPDU(GTP_CAUSE_REQUEST_ACCEPTED))) -> value gtpc_pdu; + setverdict(pass); + } + [] GTP.receive { + setverdict(fail, "unexpected GTPC message from MME"); + } +} + private function f_attach() runs on ConnHdlr { var template (value) EPS_MobileIdentityV mi := ts_NAS_MobileId_IMSI(g_pars.ue_pars.imsi); var template (value) PDU_NAS_EPS nas_esm, nas_emm; @@ -963,7 +1034,7 @@ T.start; alt { - [] as_s1ap_handle_IntialCtxSetupReq(); + [] as_s1ap_handle_IntialCtxSetupReq_Attach_Accept(); [] T.timeout { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("No message from MME")); } } @@ -1383,6 +1454,109 @@ vc_conn.done; } +/* 3GPP TS 23.401 D.3.6, TS 23.003 2.8.2.2 */ +private function rai_ptmsi2_guti(in RoutingAreaIdentity rai, in OCT4 ptmsi, in OCT3 ptmsi_sig, out NAS_EPS_Types.GUTI guti) runs on ConnHdlr { + + + var bitstring ptmsi_bits := oct2bit(ptmsi); + var bitstring ptmsi_sig_bits := oct2bit(ptmsi_sig); + var bitstring mtmsi_bits := '11'B & + substr(ptmsi_bits, 2, 6) & + substr(ptmsi_sig_bits, 0, 8) & + substr(ptmsi_bits, 16, 16); + guti := valueof(ts_NAS_GUTI(mcc_mnc := rai.mcc_digits & rai.mnc_digits, + mmegi := rai.lac, + mmec := rai.rac, + tmsi := bit2oct(mtmsi_bits))); +} +/* Test UE attached to GERAN reselecting a EUTRAN cell. In this scenario, the + * new MME will attempt to obtain information of the UE from the old SGSN + * through Gn interface using SGSN Context Request/Response procedure (OS#6294). */ +/* 3GPP TS 23.401 D.3.6, TS 23.003 2.8.2.1 */ +private function f_TC_ue_cell_reselect_geran_to_eutran(ConnHdlrPars pars) runs on ConnHdlr { + f_init_handler(pars); + f_gtp_register_imsi(g_pars.ue_pars.imsi); + f_gtp2_register_imsi(g_pars.ue_pars.imsi); + /* SGSN Context Req doesn't necessarily contain IMSI, hence expect it through TEID=0 */ + f_gtp_register_teid('00000000'O); + /* passed in SGSN Context Resp to MME, will be used by MME when answering with SGSN Context Ack: */ + const OCT4 new_sgsn_teid := 'ABABABAB'O; + f_gtp_register_teid(new_sgsn_teid); + + var template (value) EPS_MobileIdentityV mi := ts_NAS_MobileId_IMSI(pars.ue_pars.imsi); + var template (value) S1AP_PDU tx; + var template (value) PDU_NAS_EPS nas_tau; + var RoutingAreaIdentity rai; + var OCT4 ptmsi := f_gen_tmsi(suffix := 0, nri_v := 0, nri_bitlen := 8); + var OCT3 ptmsi_sig := f_rnd_octstring(3); + var NAS_EPS_Types.GUTI guti_val; + var template (value) EPS_MobileIdentityLV old_guti; + var S1APEM_Config cfg; + timer T := 5.0; + + rai := valueof(ts_RoutingAreaIdentity(mp_gn_local_mcc, mp_gn_local_mnc, + int2oct(mp_gn_local_lac, 2), int2oct(mp_gn_local_rac, 1))); + rai_ptmsi2_guti(rai, ptmsi, ptmsi_sig, guti_val); + old_guti := ts_EPS_MobileId_GUTI_(guti_val); + + nas_tau := ts_PDU_NAS_EPS_TrackingAreaUpdateRequest(old_guti, + ts_PTMSI_SignatureTV(ptmsi_sig), + ts_GUTI_TypeTV(GUTI_TYPE_MAPPED), + ts_NonceTV('12345678'O), + ts_CipheringKeySequenceNumberTV('000'B)); + tx := ts_S1AP_InitialUE(p_eNB_value := 0, p_nasPdu := enc_PDU_NAS_EPS(valueof(nas_tau)), + p_tAI := ts_enb_S1AP_TAI(g_pars.enb_pars[g_pars.mme_idx]), + p_eUTRAN_CGI := ts_enb_S1AP_CGI(g_pars.enb_pars[g_pars.mme_idx]), + p_rrcCause := mo_Signalling); + + S1AP.send(tx); + + /* NAS counts are reset to zero when a mapped security context is created. */ + cfg := { + reset_nas_counts := {} + }; + S1AP.send(cfg); + + as_gtp_sgsn_context_2g_to_4g(new_sgsn_teid); + + /* We now expect the MME to send a Create Session Request to the SGW-C */ + T.start; + alt { + [] as_GTP2C_CreateSession_success(); + [] T.timeout { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("No message from MME")); } + } + + /* 3GPP TS 23.401 D.3.6 steps 14-21: */ + as_DIA_UpdLoc(); + + /* 3GPP TS 23.401 D.3.6 step 22, 23: */ + as_s1ap_handle_IntialCtxSetupReq_TAU_Accept(); + + /* We now expect the MME to send a Modify Bearer Request to the SGW-C */ + T.start; + alt { + [] as_GTP2C_ModifyBearer_success(); + [] T.timeout { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("No message from MME")); } + } + + /* Leave some time for MME to handle Modify Bearer Response: */ + f_sleep(1.0); +} +testcase TC_ue_cell_reselect_geran_to_eutran() runs on MTC_CT { + var charstring id := testcasename(); + + f_init_diameter(id); + f_init_s1ap(id, 7); + f_init_gtpv2_s11(id); + f_s1ap_setup(0); + f_init_gtp(id); + + var ConnHdlrPars pars := f_init_pars(ue_idx := 0); + var ConnHdlr vc_conn; + vc_conn := f_start_handler_with_pars(refers(f_TC_ue_cell_reselect_geran_to_eutran), pars); + vc_conn.done; +} + control { execute( TC_s1ap_setup_wrong_plmn() ); execute( TC_s1ap_setup_wrong_tac() ); @@ -1393,6 +1567,7 @@ execute( TC_RIM_RAN_INF() ); execute( TC_s1ap_reset() ); execute( TC_ue_cell_reselect_eutran_to_geran() ); + execute( TC_ue_cell_reselect_geran_to_eutran() ); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/35513?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I6f8f077b99e83e6467d2b0c05148b81dbcf2ede4 Gerrit-Change-Number: 35513 Gerrit-PatchSet: 4 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

1 0

[S] Change in docker-playground[master]: ttcn3-epdg: Update renamed config fields
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/docker-playground/+/35599?usp=email ) Change subject: ttcn3-epdg: Update renamed config fields ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/docker-playground/+/35599?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: docker-playground Gerrit-Branch: master Gerrit-Change-Id: Ic9f2f33b8ffae7b4273e6fac8a42b6e9e1e38ed8 Gerrit-Change-Number: 35599 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:50:11 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in docker-playground[master]: ttcn3-epdg: Set new osmo-epdg diameter connect/wathdog configs
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: lynxis lazus, pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/docker-playground/+/35594?usp=email ) Change subject: ttcn3-epdg: Set new osmo-epdg diameter connect/wathdog configs ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/docker-playground/+/35594?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: docker-playground Gerrit-Branch: master Gerrit-Change-Id: I3632abb8b33d5f2636f443573196d73ea8d3c818 Gerrit-Change-Number: 35594 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:50:08 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in ...osmo-epdg[master]: swx: Rename diameter related parameters
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35598?usp=email ) Change subject: swx: Rename diameter related parameters ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35598?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I63fe4c7acc7460575a921b254adf066134c0527f Gerrit-Change-Number: 35598 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:49:25 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in ...osmo-epdg[master]: diameter: Make diameter_watchdog_config configurable
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35591?usp=email ) Change subject: diameter: Make diameter_watchdog_config configurable ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35591?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I99b5e02264c2c35a3fbfcd2d6083a07e2cfea566 Gerrit-Change-Number: 35591 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:49:03 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[M] Change in ...osmo-epdg[master]: diameter: Allow configuring (re)connect timer in s6b and swx
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: lynxis lazus, pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35588?usp=email ) Change subject: diameter: Allow configuring (re)connect timer in s6b and swx ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35588?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I7d280f83f4f375eaf34ea3b69a421372af54ffdb Gerrit-Change-Number: 35588 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:48:57 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in ...osmo-epdg[master]: gsup_server: Improve log line when listening on gsup
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35590?usp=email ) Change subject: gsup_server: Improve log line when listening on gsup ...................................................................... Patch Set 3: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35590?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I7dccc20b6c2c0f58cdd3a43469053624927c9acd Gerrit-Change-Number: 35590 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:46:24 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[S] Change in ...osmo-epdg[master]: gsup_server: Remove incorrect log about reconnecting
by daniel 17 Jan '24

17 Jan '24

Attention is currently required from: pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35589?usp=email ) Change subject: gsup_server: Remove incorrect log about reconnecting ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/35589?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: Ib5a8f1eb6d873f85d526222f76768d2b81f08d90 Gerrit-Change-Number: 35589 Gerrit-PatchSet: 2 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Wed, 17 Jan 2024 15:46:15 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0