December 2024 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: fix encoding of IMEISV in Auth and Ciphering Response

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38414?usp=email ) ( 7 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: fix encoding of IMEISV in Auth and Ciphering Response ...................................................................... SGSN: fix encoding of IMEISV in Auth and Ciphering Response According to 24.008 the IMEISV field is exact 11 bytes long and must contain a IMEI + SV which is exact 16 digits long, not 15. Change-Id: I79dd79840de58f450c1a05e704fd9bd831455716 --- M sgsn/BSSGP_ConnHdlr.ttcn 1 file changed, 3 insertions(+), 3 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, but someone else must approve daniel: Looks good to me, approved Jenkins Builder: Verified diff --git a/sgsn/BSSGP_ConnHdlr.ttcn b/sgsn/BSSGP_ConnHdlr.ttcn index 40cb6b6..1b2e5a0 100644 --- a/sgsn/BSSGP_ConnHdlr.ttcn +++ b/sgsn/BSSGP_ConnHdlr.ttcn @@ -354,9 +354,9 @@ l3_mo := valueof(auth_ciph_resp); if (ispresent(l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest) and - l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) { + l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) { l3_mo.msgs.gprs_mm.authenticationAndCipheringResponse.imeisv := - valueof(ts_MI_IMEISV_TLV(g_pars.imei & '0'H)); + valueof(ts_MI_IMEISV_TLV(g_pars.imei & '00'H)); } f_send_l3(l3_mo, ran_index); } @@ -448,7 +448,7 @@ if (ispresent(l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest) and l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) { l3_mo.msgs.gprs_mm.authenticationAndCipheringResponse.imeisv := - valueof(ts_MI_IMEISV_TLV(g_pars.imei & '0'H)); + valueof(ts_MI_IMEISV_TLV(g_pars.imei & '00'H)); } f_send_l3(l3_mo, ran_index); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38414?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I79dd79840de58f450c1a05e704fd9bd831455716 Gerrit-Change-Number: 38414 Gerrit-PatchSet: 11 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: TC_attach_pdp_act_pmm_idle: use correct Service Request type

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38416?usp=email ) ( 1 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: TC_attach_pdp_act_pmm_idle: use correct Service Request type ...................................................................... SGSN: TC_attach_pdp_act_pmm_idle: use correct Service Request type When the UE requests data service, it must use the data service request type. Change-Id: I9301e7a37d96c3f93e77f7618d6c13dfa1fbe46b --- M sgsn/SGSN_Tests_Iu.ttcn 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: laforge: Looks good to me, but someone else must approve fixeria: Looks good to me, but someone else must approve Jenkins Builder: Verified pespin: Looks good to me, approved diff --git a/sgsn/SGSN_Tests_Iu.ttcn b/sgsn/SGSN_Tests_Iu.ttcn index 400b717..53a1080 100644 --- a/sgsn/SGSN_Tests_Iu.ttcn +++ b/sgsn/SGSN_Tests_Iu.ttcn @@ -258,7 +258,7 @@ /* Now UE tries to send new data after a while of being IDLE. * SGSN recreates the Iu ctx and recovers the Direct Tunnel RNC<->GGSN: */ - f_service_request(apars, pdp_status := '2000'O /*NSAPI=5*/, ran_index := 3); + f_service_request(apars, service_type := SERVICE_TYPE_Data, pdp_status := '2000'O /*NSAPI=5*/, ran_index := 3); as_ranap_rab_ass_req(apars); as_ggsn_gtp_ctx_upd_req(apars, exp_dir_tun := true, ran_index := 3); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38416?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9301e7a37d96c3f93e77f7618d6c13dfa1fbe46b Gerrit-Change-Number: 38416 Gerrit-PatchSet: 11 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: Context Req In: use correct TEID-C

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38920?usp=email ) Change subject: SGSN: Context Req In: use correct TEID-C ...................................................................... SGSN: Context Req In: use correct TEID-C For a MS/UE moving from 2G to 4G, the Ctx Acks need to transmit with the correct TEID-C which the SGSN chose in the Context Response. Change-Id: I84dc7dda8ee1227edd68d1482a4c5bf267c16418 --- M sgsn/SGSN_Tests.ttcn 1 file changed, 6 insertions(+), 2 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn index 03a0ebb..2ddeaff 100644 --- a/sgsn/SGSN_Tests.ttcn +++ b/sgsn/SGSN_Tests.ttcn @@ -3082,12 +3082,16 @@ T.start(2.0); alt { [] GTP[GTP_GGSN_IDX].receive(tr_GTPC_SGSNContextResp(?, ?, ctx_rsp)) -> value gtpc_ud { + var OCT4 remote_teidc := gtpc_ud.gtpc.gtpc_pdu.sgsn_ContextResponse.teidControlPlane.teidControlPlane; + log("Rx SGSN Context Resp from SGSN, sending Ack"); - GTP[GTP_GGSN_IDX].send(ts_GTPC_SGSNContextAck(gtpc_ud.peer, '12345678'O, seq_nr)); + GTP[GTP_GGSN_IDX].send(ts_GTPC_SGSNContextAck(gtpc_ud.peer, remote_teidc, seq_nr)); setverdict(pass); } [] GTP[GTP_GGSN_IDX].receive(tr_GTPC_SGSNContextResp) -> value gtpc_ud { - GTP[GTP_GGSN_IDX].send(ts_GTPC_SGSNContextAck(gtpc_ud.peer, '12345678'O, seq_nr, + var OCT4 remote_teidc := gtpc_ud.gtpc.gtpc_pdu.sgsn_ContextResponse.teidControlPlane.teidControlPlane; + + GTP[GTP_GGSN_IDX].send(ts_GTPC_SGSNContextAck(gtpc_ud.peer, remote_teidc, seq_nr, ts_SGSNContextAckPDU(GTP_CAUSE_INVALID_MSG_FORMAT))); setverdict(fail, "Rx unexpected SGSN Context Resp"); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38920?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I84dc7dda8ee1227edd68d1482a4c5bf267c16418 Gerrit-Change-Number: 38920 Gerrit-PatchSet: 6 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[M] Change in osmo-ttcn3-hacks[master]: SGSN: BSSGP_ConnHdlr: f_gmm_attach(): allow the SGSN to request the IMEI

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38398?usp=email ) ( 8 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: BSSGP_ConnHdlr: f_gmm_attach(): allow the SGSN to request the IMEI ...................................................................... SGSN: BSSGP_ConnHdlr: f_gmm_attach(): allow the SGSN to request the IMEI The IMEI might be requested when the GMM Attach happen. Change-Id: Id49c9e6ef7517a6a831315ac1f9915c50b88beb6 --- M sgsn/BSSGP_ConnHdlr.ttcn 1 file changed, 31 insertions(+), 21 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/sgsn/BSSGP_ConnHdlr.ttcn b/sgsn/BSSGP_ConnHdlr.ttcn index c5501aa..40cb6b6 100644 --- a/sgsn/BSSGP_ConnHdlr.ttcn +++ b/sgsn/BSSGP_ConnHdlr.ttcn @@ -237,18 +237,8 @@ } } -altstep as_mm_identity(integer ran_index := 0) runs on BSSGP_ConnHdlr { +altstep as_mm_identity_imei(integer ran_index := 0) runs on BSSGP_ConnHdlr { var MobileIdentityLV mi; - [is_gb(ran_index)] BSSGP[ran_index].receive(tr_GMM_ID_REQ('001'B)) { - mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); - f_send_l3(ts_GMM_ID_RESP(mi), ran_index); - repeat; - } - [is_iu(ran_index)] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_ID_REQ('001'B))) { - mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); - f_send_l3(ts_GMM_ID_RESP(mi), ran_index); - repeat; - } [is_gb(ran_index)] BSSGP[ran_index].receive(tr_GMM_ID_REQ('010'B)) { mi := valueof(ts_MI_IMEI_LV(g_pars.imei)); f_send_l3(ts_GMM_ID_RESP(mi), ran_index); @@ -261,18 +251,33 @@ } } +altstep as_mm_identity_imsi(integer ran_index := 0) runs on BSSGP_ConnHdlr { + var MobileIdentityLV mi; + [is_gb(ran_index)] BSSGP[ran_index].receive(tr_GMM_ID_REQ('001'B)) { + mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); + f_send_l3(ts_GMM_ID_RESP(mi), ran_index); + repeat; + } + [is_iu(ran_index)] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_ID_REQ('001'B))) { + mi := valueof(ts_MI_IMSI_LV(g_pars.imsi)); + f_send_l3(ts_GMM_ID_RESP(mi), ran_index); + repeat; + } +} + +altstep as_mm_identity(integer ran_index := 0) runs on BSSGP_ConnHdlr { + [] as_mm_identity_imsi(ran_index); + [] as_mm_identity_imei(ran_index); +} + /* receive a L3 (GMM/SM) message over whatever is the appropriate lower-layer bearer */ -function f_receive_l3(template PDU_L3_SGSN_MS rx_tpl := ?, integer ran_index := 0) -runs on BSSGP_ConnHdlr return PDU_L3_SGSN_MS { +altstep as_receive_l3(template PDU_L3_SGSN_MS rx_tpl, inout PDU_L3_SGSN_MS l3_mt, integer ran_index := 0) +runs on BSSGP_ConnHdlr { var PDU_DTAP_PS_MT mt; - var PDU_L3_SGSN_MS l3_mt; - alt { [is_gb(ran_index)] BSSGP[ran_index].receive(rx_tpl) -> value l3_mt { } [is_iu(ran_index)] BSSAP.receive(tr_PDU_DTAP_PS_MT(rx_tpl)) -> value mt { l3_mt := mt.dtap; - } } - return l3_mt; } /* (copied from msc/BSC_ConnectionHandler.ttcn) */ @@ -423,7 +428,7 @@ var template PDU_L3_SGSN_MS auth_ciph_req := tr_GMM_AUTH_REQ(g_pars.vec.rand); auth_ciph_req.msgs.gprs_mm.authenticationAndCipheringRequest.authenticationParameterAUTN := autn; - l3_mt := f_receive_l3(auth_ciph_req, ran_index); + as_receive_l3(auth_ciph_req, l3_mt, ran_index); var BIT4 ac_ref := l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.acReferenceNumber.valueField; var template (value) PDU_L3_MS_SGSN auth_ciph_resp := ts_GMM_AUTH_RESP_2G(ac_ref, g_pars.vec.sres); @@ -550,7 +555,8 @@ } function f_gmm_attach(boolean umts_aka_challenge, boolean force_gsm_sres, integer ran_index := 0, - template (omit) RoutingAreaIdentificationV old_ra := omit) runs on BSSGP_ConnHdlr { + template (omit) RoutingAreaIdentificationV old_ra := omit, + boolean allow_id_imei_req := false) runs on BSSGP_ConnHdlr { var RoutingAreaIdentificationV old_ra_val; var template (value) PDU_L3_MS_SGSN attach_req; var PDU_L3_SGSN_MS l3_mt; @@ -574,8 +580,12 @@ /* Expect SGSN to perform LU with HLR */ as_gmm_gsup_lu_isd(); - l3_mt := f_receive_l3(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?), ran_index); - f_process_attach_accept(l3_mt.msgs.gprs_mm.attachAccept, ran_index); + alt { + [allow_id_imei_req] as_mm_identity_imei(ran_index) { repeat; } + [] as_receive_l3(tr_GMM_ATTACH_ACCEPT('001'B, ?, ?), l3_mt, ran_index) { + f_process_attach_accept(l3_mt.msgs.gprs_mm.attachAccept, ran_index) + } + } /* FIXME: Extract P-TMSI, if any. Only send Complete if necessary */ f_send_l3(ts_GMM_ATTACH_COMPL, ran_index); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38398?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Id49c9e6ef7517a6a831315ac1f9915c50b88beb6 Gerrit-Change-Number: 38398 Gerrit-PatchSet: 11 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: SGSN: BSSGP_ConnHdlr: GMM Service Request: handle PMM IDLE UE correct

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38397?usp=email ) Change subject: SGSN: BSSGP_ConnHdlr: GMM Service Request: handle PMM IDLE UE correct ...................................................................... SGSN: BSSGP_ConnHdlr: GMM Service Request: handle PMM IDLE UE correct 24.008: 4.7.13.3: explicitly mention the completion of the low layer security to be an implicit Security Command Accept if the UE is in PMM Idle. Extend the as_service_request() to handle both cases when UE is in PMM-IDLE as well in PMM-CONNECTED. Change-Id: I29237997e414aea80f254247da54f909410a4b36 --- M sgsn/BSSGP_ConnHdlr.ttcn 1 file changed, 30 insertions(+), 6 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve laforge: Looks good to me, approved Jenkins Builder: Verified diff --git a/sgsn/BSSGP_ConnHdlr.ttcn b/sgsn/BSSGP_ConnHdlr.ttcn index 2a434aa..82788f5 100644 --- a/sgsn/BSSGP_ConnHdlr.ttcn +++ b/sgsn/BSSGP_ConnHdlr.ttcn @@ -618,24 +618,48 @@ } } -/* Iu only */ -altstep as_service_request(integer ran_index := 0) runs on BSSGP_ConnHdlr { +/* Iu only + * + * Handle a service request for a UE in PMM_IDLE or PMM_CONNECTED depending on exp_service_acc + * Depending on the PMM state: + * a) PMM_IDLE: The network will do a SecurityModeCommand on Iu, which the UE will treat as an implicit Service Accept + * b) PMM_CONNECTED: The Iu connection is already secured, do an explicit Service Accept + * + * NOTE: The old osmo-sgsn will always respond with a ServiceAccept even when the spec is clear this is not needed. + */ +altstep as_service_request(boolean exp_service_acc := true, integer ran_index := 0) runs on BSSGP_ConnHdlr { var PDU_DTAP_PS_MT mt; - [] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_SERVICE_ACC)) -> value mt { + [exp_service_acc] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_SERVICE_ACC)) -> value mt { setverdict(pass); } + [not exp_service_acc] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_SERVICE_ACC)) -> value mt { + setverdict(fail, "Unexpected Service Accept"); + mtc.stop; + } [] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_SERVICE_REJ)) { setverdict(fail, "Unexpected Service Reject"); mtc.stop; } + /* 24.008 4.7.13.3: a SecurityModeCommand is an implicit Service Accept if UE was in PMM-IDLE */ [] BSSAP.receive(tr_RANAP_SecurityModeCmd(uia_algs := ?, uia_key := oct2bit(g_pars.vec.ik), key_sts := ?)) { var IntegrityProtectionAlgorithm uia_chosen := 0; /* 0 = standard_UMTS_integrity_algorithm_UIA1 */ BSSAP.send(ts_RANAP_SecurityModeComplete(uia_chosen)); - BSSAP.receive(tr_RANAP_CommonId(imsi_hex2oct(g_pars.imsi))) - repeat; + if (not exp_service_acc) { + /* Because we stop processing early, we need to consume the CommonID */ + BSSAP.receive(tr_RANAP_CommonId(imsi_hex2oct(g_pars.imsi))); + setverdict(pass); + } else { + /* This repeat would be wrong if you follow the spec correct. Because: + * a) the UE is in PMM Idle and in this case the exp_service_acc would be true + * b) the UE is in PMM Connected and in this case the Iu Connection should be already secure and this would fail. + * The old osmo-sgsn is doing for UE in PMM Idle both a Security Command and a Service Accept, after the VLR change, the + * osmo-sgsn will follow the spec correct. + */ + repeat; + } } } @@ -671,7 +695,7 @@ } alt { - [] as_service_request(ran_index) { setverdict(pass); } + [] as_service_request(exp_service_acc := true, ran_index := ran_index) { setverdict(pass); } [] BSSAP.receive { repeat; } [] T.timeout { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38397?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I29237997e414aea80f254247da54f909410a4b36 Gerrit-Change-Number: 38397 Gerrit-PatchSet: 8 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[M] Change in osmo-ttcn3-hacks[master]: SGSN: BSSGP_ConnHdlr: GMM Service Request: add support to expect auth...

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38396?usp=email ) Change subject: SGSN: BSSGP_ConnHdlr: GMM Service Request: add support to expect authentication ...................................................................... SGSN: BSSGP_ConnHdlr: GMM Service Request: add support to expect authentication On a Service Request, the authentication is optional. Either an authentication must happen or the key material from the previous authentication has to be used. The default behavior is still the same. Change-Id: I9ed08160bf5413e3a30d6e90eb947d4d799e1058 --- M sgsn/BSSGP_ConnHdlr.ttcn 1 file changed, 93 insertions(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved laforge: Looks good to me, but someone else must approve Jenkins Builder: Verified diff --git a/sgsn/BSSGP_ConnHdlr.ttcn b/sgsn/BSSGP_ConnHdlr.ttcn index 82788f5..c5501aa 100644 --- a/sgsn/BSSGP_ConnHdlr.ttcn +++ b/sgsn/BSSGP_ConnHdlr.ttcn @@ -303,9 +303,88 @@ } } +/* expect a GSUP Send Auth Information */ +altstep as_gsup_sai(boolean umts_aka_challenge := false) runs on BSSGP_ConnHdlr +{ + [g_pars.net.expect_auth] GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)) { + var GSUP_IE auth_tuple; + + if (umts_aka_challenge) { + g_pars.vec := f_gen_auth_vec_3g(); + auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G3G(g_pars.vec.rand, + g_pars.vec.sres, + g_pars.vec.kc, + g_pars.vec.ik, + g_pars.vec.ck, + g_pars.vec.autn, + g_pars.vec.res)); + } else { + g_pars.vec := f_gen_auth_vec_2g(); + auth_tuple := valueof(ts_GSUP_IE_AuthTuple2G(g_pars.vec.rand, + g_pars.vec.sres, + g_pars.vec.kc)); + } + + GSUP.send(ts_GSUP_SAI_RES(g_pars.imsi, auth_tuple)); + } +} + +/* Only used by as_gmm_auth to support same code path for Gb and Iu */ +private function f_gmm_auth_as(PDU_L3_SGSN_MS l3_mt, boolean umts_aka_challenge := true, boolean force_gsm_sres := false, integer ran_index := 0) runs on BSSGP_ConnHdlr { + var PDU_L3_MS_SGSN l3_mo; + var BIT4 ac_ref := l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.acReferenceNumber.valueField; + var template (value) PDU_L3_MS_SGSN auth_ciph_resp := ts_GMM_AUTH_RESP_2G(ac_ref, g_pars.vec.sres); + + if (umts_aka_challenge and not force_gsm_sres) { + /* set UMTS response instead */ + auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationParResp := { + valueField := substr(g_pars.vec.res, 0, 4) + }; + auth_ciph_resp.msgs.gprs_mm.authenticationAndCipheringResponse.authenticationRespParExt := { + elementIdentifier := '21'O, + lengthIndicator := lengthof(g_pars.vec.res) - 4, + valueField := substr(g_pars.vec.res, 4, lengthof(g_pars.vec.res) - 4) + }; + } + + l3_mo := valueof(auth_ciph_resp); + if (ispresent(l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest) and + l3_mt.msgs.gprs_mm.authenticationAndCipheringRequest.imeisvRequest.valueField == '001'B) { + l3_mo.msgs.gprs_mm.authenticationAndCipheringResponse.imeisv := + valueof(ts_MI_IMEISV_TLV(g_pars.imei & '0'H)); + } + f_send_l3(l3_mo, ran_index); +} + +/* Handles GMM Auth and supplies auth tuples via GSUP if expect_sai is true. */ +altstep as_gmm_auth(boolean umts_aka_challenge := false, boolean force_gsm_sres := false, integer ran_index := 0, + boolean expect_sai := false) runs on BSSGP_ConnHdlr { + var PDU_DTAP_PS_MT mt; + var PDU_L3_SGSN_MS l3_mt; + + /* Ignoring autn for now */ + [is_gb(ran_index)] BSSGP[ran_index].receive(tr_GMM_AUTH_REQ(g_pars.vec.rand)) -> value l3_mt { + f_gmm_auth_as(l3_mt, umts_aka_challenge, force_gsm_sres, ran_index); + } + [is_iu(ran_index)] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_AUTH_REQ(g_pars.vec.rand))) -> value mt { + l3_mt := mt.dtap; + f_gmm_auth_as(l3_mt, umts_aka_challenge, force_gsm_sres, ran_index); + } + [expect_sai] as_gsup_sai(umts_aka_challenge := umts_aka_challenge) { repeat; }; +} + /* perform GMM authentication (if expected). * Note, for umts_aka_challenge to work, the revisionLevelIndicatior needs to - * be 1 to mark R99 capability, in the GMM Attach Request, see f_gmm_attach(). */ + * be 1 to mark R99 capability, in the GMM Attach Request, see f_gmm_attach(). + * + * Requires the order to be: + * SAI Req + * SAI Resp + * Auth Req + * Auth Resp + * CommonId + * (out of order: GMM ID Req) + */ function f_gmm_auth (boolean umts_aka_challenge := false, boolean force_gsm_sres := false, integer ran_index := 0) runs on BSSGP_ConnHdlr { var PDU_L3_MS_SGSN l3_mo; var PDU_L3_SGSN_MS l3_mt; @@ -667,6 +746,7 @@ ServiceType service_type := SERVICE_TYPE_Signalling, template (value) OCT2 pdp_status := '0000'O, boolean exp_ggsn_pdp_del := false, + boolean expect_auth := false, integer ran_index := 0, float Tval := 5.0) runs on BSSGP_ConnHdlr { timer T := Tval; @@ -694,8 +774,20 @@ } } + if (expect_auth) { + f_gmm_auth(umts_aka_challenge := true, ran_index := ran_index); + } + alt { [] as_service_request(exp_service_acc := true, ran_index := ran_index) { setverdict(pass); } + [not expect_auth] BSSAP.receive(tr_PDU_DTAP_PS_MT(tr_GMM_AUTH_REQ)) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + "Service Request: Unexpected GMM Auth Req"); + } + [not expect_auth] GSUP.receive(tr_GSUP_SAI_REQ(*)) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + "Service Request: Unexpected GSUP SAI Req"); + } [] BSSAP.receive { repeat; } [] T.timeout { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38396?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I9ed08160bf5413e3a30d6e90eb947d4d799e1058 Gerrit-Change-Number: 38396 Gerrit-PatchSet: 8 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: f_TC_attach_timeout_after_pdp_act: allow authentication

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38399?usp=email ) ( 7 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: f_TC_attach_timeout_after_pdp_act: allow authentication ...................................................................... SGSN: f_TC_attach_timeout_after_pdp_act: allow authentication While testing, allow the SGSN to authenticate the UE. The new VLR code will authenticate the UE, while the old code doesn't. Change-Id: I11c628ecebbe7c4c1b2c28e63133a33cfc171e12 --- M sgsn/SGSN_Tests.ttcn 1 file changed, 2 insertions(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn index 0f5da29..116c03d 100644 --- a/sgsn/SGSN_Tests.ttcn +++ b/sgsn/SGSN_Tests.ttcn @@ -604,7 +604,7 @@ f_TC_attach(id); f_pdp_ctx_act(apars); - /* Now, try another GPRS attach procedure. Note that osmo-sgsn does not require + /* Now, try another GPRS attach procedure. Note that older osmo-sgsn skip a required * authentication for the second GMM ATTACH REQUEST, so we expect GSUP UPDATE * LOCATION REQUEST and optionally a GMM IDENTITY REQUEST (IMEI). */ attach_req := ts_GMM_ATTACH_REQ(f_mi_get_lv(), rai, false, false, omit, omit); @@ -612,6 +612,7 @@ T.start(1.0); alt { + [] as_gmm_auth(ran_index := ran_index) { repeat; }; [] as_gmm_gsup_lu_isd(); [] as_mm_identity(ran_index); [] as_xid(apars, ran_index); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38399?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I11c628ecebbe7c4c1b2c28e63133a33cfc171e12 Gerrit-Change-Number: 38399 Gerrit-PatchSet: 11 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: f_TC_attach_rau: do a periodic RA update instead of RA change

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38400?usp=email ) ( 2 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: f_TC_attach_rau: do a periodic RA update instead of RA change ...................................................................... SGSN: f_TC_attach_rau: do a periodic RA update instead of RA change After an attach, the periodic RA would be the correct. Change-Id: Ic33687c55915d883b6d9a9a0d640a11588e1d1a0 --- M sgsn/SGSN_Tests.ttcn 1 file changed, 2 insertions(+), 2 deletions(-) Approvals: fixeria: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn index 116c03d..aca2979 100644 --- a/sgsn/SGSN_Tests.ttcn +++ b/sgsn/SGSN_Tests.ttcn @@ -904,9 +904,9 @@ /* first perform regular attach */ f_TC_attach(id); - f_routing_area_update(g_pars.ra); - + f_routing_area_update(g_pars.ra, GPRS_UPD_T_PERIODIC, Tval := 10.0); } + testcase TC_attach_rau() runs on test_CT { var BSSGP_ConnHdlr vc_conn; f_init(); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38400?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ic33687c55915d883b6d9a9a0d640a11588e1d1a0 Gerrit-Change-Number: 38400 Gerrit-PatchSet: 11 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[XS] Change in osmo-ttcn3-hacks[master]: SGSN: TC_attach_auth_id_timeout: set TMSI to provoke a ID Request

by lynxis lazus

lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38401?usp=email ) ( 7 is the latest approved patch-set. No files were changed between the latest approved patch-set and the submitted one. )Change subject: SGSN: TC_attach_auth_id_timeout: set TMSI to provoke a ID Request ...................................................................... SGSN: TC_attach_auth_id_timeout: set TMSI to provoke a ID Request This test case simulates a MS which ignores Identity Requests. To ensure the SGSN will ask for the IMSI, do an Attach Request with id TMSI. Later this ID Request (type IMSI) will be ignored and the test case expect a Attach Reject. Change-Id: I5a860582aa57ebc073e4c33f3f2f8884e360edef --- M sgsn/SGSN_Tests.ttcn 1 file changed, 3 insertions(+), 0 deletions(-) Approvals: fixeria: Looks good to me, approved Jenkins Builder: Verified diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn index aca2979..1bb8576 100644 --- a/sgsn/SGSN_Tests.ttcn +++ b/sgsn/SGSN_Tests.ttcn @@ -661,6 +661,9 @@ private function f_TC_attach_auth_id_timeout(charstring id) runs on BSSGP_ConnHdlr { var RoutingAreaIdentificationV old_ra := f_random_RAI(); + /* Attach via P-TMSI to force Id Request (IMSI) which times out */ + g_pars.p_tmsi := 'c000004a'O; + f_send_l3(ts_GMM_ATTACH_REQ(f_mi_get_lv(), old_ra, false, false, omit, omit)); alt { [] BSSGP[0].receive(tr_GMM_ID_REQ(?)) { -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/38401?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I5a860582aa57ebc073e4c33f3f2f8884e360edef Gerrit-Change-Number: 38401 Gerrit-PatchSet: 12 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-CC: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

[M] Change in libosmo-abis[master]: input: Move ipaccess_bts_handle_ccm() ipaccess.c -> ipa.c

by pespin

pespin has submitted this change. ( https://gerrit.osmocom.org/c/libosmo-abis/+/39041?usp=email ) Change subject: input: Move ipaccess_bts_handle_ccm() ipaccess.c -> ipa.c ...................................................................... input: Move ipaccess_bts_handle_ccm() ipaccess.c -> ipa.c This function is no longer used in ipaccess.c, and actually relates to IPA generic code which still exists in ipa.c, hence move it there. Moreover, the function is declared in the "abis/ipa.h" public header, not the "abis/ipaccess.h" header (which was already deprecated). Once moved and it becomes clear this is not used in the e1_line ipaccess driver and hence the "if (line) { ... ipa pong ... } code branch in the function can be dropped, since it won't ever be executed. Change-Id: I2378227515315e7fc0bd0844a1dc4f85e54b455a --- M src/input/ipa.c M src/input/ipaccess.c 2 files changed, 66 insertions(+), 72 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve Jenkins Builder: Verified pespin: Looks good to me, approved diff --git a/src/input/ipa.c b/src/input/ipa.c index f49d0dc..073c1ff 100644 --- a/src/input/ipa.c +++ b/src/input/ipa.c @@ -582,3 +582,69 @@ msgb_enqueue(&conn->tx_queue, msg); osmo_fd_write_enable(&conn->ofd); } + +/* Kept for bacward compat since this is a public API. Will be deprecated at + * some point withthe rest of ipa_client_conn. */ +int ipaccess_bts_handle_ccm(struct ipa_client_conn *link, + struct ipaccess_unit *dev, struct msgb *msg) +{ + struct ipaccess_head *hh = (struct ipaccess_head *) msg->data; + + /* special handling for IPA CCM. */ + if (hh->proto != IPAC_PROTO_IPACCESS) + return 0; + + int ret = 0; + uint8_t *data = msgb_l2(msg); + int len = msgb_l2len(msg); + OSMO_ASSERT(len > 0); + uint8_t msg_type = *data; + + /* ping, pong and acknowledgment cases. */ + ret = ipa_ccm_rcvmsg_bts_base(msg, link->ofd); + if (ret < 0) + goto err; + + /* this is a request for identification from the BSC. */ + if (msg_type == IPAC_MSGT_ID_GET) { + struct msgb *rmsg; + /* The ipaccess_unit dev holds generic identity for the whole + * line, hence no trx_id. Patch ipaccess_unit during call to + * ipa_ccm_make_id_resp_from_req() to identify this TRX: */ + int store_trx_nr = dev->trx_id; + if (link->ofd->priv_nr >= E1INP_SIGN_RSL) + dev->trx_id = link->ofd->priv_nr - E1INP_SIGN_RSL; + else + dev->trx_id = 0; + LOGP(DLINP, LOGL_NOTICE, "received ID_GET for unit ID %u/%u/%u\n", + dev->site_id, dev->bts_id, dev->trx_id); + rmsg = ipa_ccm_make_id_resp_from_req(dev, data + 1, len - 1); + dev->trx_id = store_trx_nr; + if (!rmsg) { + LOGP(DLINP, LOGL_ERROR, "Failed parsing ID_GET message.\n"); + goto err; + } + + ret = ipa_send(link->ofd->fd, rmsg->data, rmsg->len); + if (ret != rmsg->len) { + LOGP(DLINP, LOGL_ERROR, "cannot send ID_RESP message. Reason: %s\n", + strerror(errno)); + msgb_free(rmsg); + goto err; + } + msgb_free(rmsg); + + /* send ID_ACK. */ + ret = ipa_ccm_send_id_ack(link->ofd->fd); + if (ret <= 0) { + LOGP(DLINP, LOGL_ERROR, "cannot send ID_ACK message. Reason: %s\n", + strerror(errno)); + goto err; + } + } + return 1; + +err: + ipa_client_conn_close(link); + return -1; +} diff --git a/src/input/ipaccess.c b/src/input/ipaccess.c index 6110004..c47c6fb 100644 --- a/src/input/ipaccess.c +++ b/src/input/ipaccess.c @@ -772,78 +772,6 @@ return 0; } -int ipaccess_bts_handle_ccm(struct ipa_client_conn *link, - struct ipaccess_unit *dev, struct msgb *msg) -{ - struct ipaccess_head *hh = (struct ipaccess_head *) msg->data; - - /* special handling for IPA CCM. */ - if (hh->proto != IPAC_PROTO_IPACCESS) - return 0; - - int ret = 0; - uint8_t *data = msgb_l2(msg); - int len = msgb_l2len(msg); - OSMO_ASSERT(len > 0); - uint8_t msg_type = *data; - /* line might not exist if != bsc||bts */ - struct e1inp_line *line = link->line; - - /* peek the pong for our keepalive fsm */ - if (line && msg_type == IPAC_MSGT_PONG) { - struct osmo_fsm_inst *ka_fsm = ipaccess_line_ts(link->ofd, line)->driver.ipaccess.ka_fsm; - ipa_keepalive_fsm_pong_received(ka_fsm); - } - - /* ping, pong and acknowledgment cases. */ - ret = ipa_ccm_rcvmsg_bts_base(msg, link->ofd); - if (ret < 0) - goto err; - - /* this is a request for identification from the BSC. */ - if (msg_type == IPAC_MSGT_ID_GET) { - struct msgb *rmsg; - /* The ipaccess_unit dev holds generic identity for the whole - * line, hence no trx_id. Patch ipaccess_unit during call to - * ipa_ccm_make_id_resp_from_req() to identify this TRX: */ - int store_trx_nr = dev->trx_id; - if (link->ofd->priv_nr >= E1INP_SIGN_RSL) - dev->trx_id = link->ofd->priv_nr - E1INP_SIGN_RSL; - else - dev->trx_id = 0; - LOGP(DLINP, LOGL_NOTICE, "received ID_GET for unit ID %u/%u/%u\n", - dev->site_id, dev->bts_id, dev->trx_id); - rmsg = ipa_ccm_make_id_resp_from_req(dev, data + 1, len - 1); - dev->trx_id = store_trx_nr; - if (!rmsg) { - LOGP(DLINP, LOGL_ERROR, "Failed parsing ID_GET message.\n"); - goto err; - } - - ret = ipa_send(link->ofd->fd, rmsg->data, rmsg->len); - if (ret != rmsg->len) { - LOGP(DLINP, LOGL_ERROR, "cannot send ID_RESP message. Reason: %s\n", - strerror(errno)); - msgb_free(rmsg); - goto err; - } - msgb_free(rmsg); - - /* send ID_ACK. */ - ret = ipa_ccm_send_id_ack(link->ofd->fd); - if (ret <= 0) { - LOGP(DLINP, LOGL_ERROR, "cannot send ID_ACK message. Reason: %s\n", - strerror(errno)); - goto err; - } - } - return 1; - -err: - ipa_client_conn_close(link); - return -1; -} - static struct msgb *ipa_bts_id_ack(void) { struct msgb *nmsg2; -- To view, visit https://gerrit.osmocom.org/c/libosmo-abis/+/39041?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: libosmo-abis Gerrit-Branch: master Gerrit-Change-Id: I2378227515315e7fc0bd0844a1dc4f85e54b455a Gerrit-Change-Number: 39041 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

6 months, 2 weeks

1
0
0 0

2025

2024

2023

2022

gerrit-log December 2024