August 2024 - gerrit-log - lists.osmocom.org

[M] Change in osmo-ttcn3-hacks[master]: S1AP_Emulation: Fix building security headers for Integrity and Ciphe...

by daniel

Attention is currently required from: lynxis lazus, pespin. daniel has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email ) Change subject: S1AP_Emulation: Fix building security headers for Integrity and Ciphering ...................................................................... Patch Set 1: (3 comments) Patchset: PS1: minor spelling Commit Message: https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891/comment/c54f9d10_c2aa… : PS1, Line 9: insturcts instructs https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891/comment/d792551a_f894… : PS1, Line 12: outter outer -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ifd4fe83e7b5aefdaafe7ce1c8b1ec6a67c65819c Gerrit-Change-Number: 37891 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:34:52 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 year

1
0
0 0

[M] Change in osmo-ttcn3-hacks[master]: S1AP_Emulation: Fix building security headers for Integrity and Ciphe...

by daniel

Attention is currently required from: lynxis lazus, pespin. daniel has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email ) Change subject: S1AP_Emulation: Fix building security headers for Integrity and Ciphering ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ifd4fe83e7b5aefdaafe7ce1c8b1ec6a67c65819c Gerrit-Change-Number: 37891 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:34:01 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: mme: expect authentication during 2g->4G TAU procedure

by daniel

Attention is currently required from: lynxis lazus, pespin. daniel has posted comments on this change by pespin. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37892?usp=email ) Change subject: mme: expect authentication during 2g->4G TAU procedure ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37892?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I5ebcaf23a643b6cb97534328737257d26d3981fe Gerrit-Change-Number: 37892 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:31:34 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: mme: Fix order in eutran_to_geran testcase

by pespin

Attention is currently required from: daniel. pespin has posted comments on this change by daniel. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37893?usp=email ) Change subject: mme: Fix order in eutran_to_geran testcase ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37893?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I0d7a388dc8b1a1c13de8f7e3fe7781423fc90868 Gerrit-Change-Number: 37893 Gerrit-PatchSet: 1 Gerrit-Owner: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: Jenkins Builder Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:30:40 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: mme: Fix order in eutran_to_geran testcase

by daniel

daniel has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37893?usp=email ) Change subject: mme: Fix order in eutran_to_geran testcase ...................................................................... mme: Fix order in eutran_to_geran testcase The diagram shows that the S1-AP release should happen after the Delete Session Request/Response (even though all a numbered 13). The test started failing because a newer open5gs would check/require a resource that was freed due to an S1 release. Change-Id: I0d7a388dc8b1a1c13de8f7e3fe7781423fc90868 --- M mme/MME_Tests.ttcn 1 file changed, 6 insertions(+), 4 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/93/37893/1 diff --git a/mme/MME_Tests.ttcn b/mme/MME_Tests.ttcn index 7a6b34c..e607543 100644 --- a/mme/MME_Tests.ttcn +++ b/mme/MME_Tests.ttcn @@ -1433,16 +1433,18 @@ /* TS 23.401 Figure D.3.5-1 Step 8: */ f_DIA_CancelLocation(); - /* TS 23.401 Figure D.3.5-1 Step 13: - * Upon rx of SGSN Context Acknowledge, MME released the ENB/UE context: - */ - as_s1ap_handle_UeContextReleaseCmd(); /* TS 23.401 Figure D.3.5-1 Step 13: * After Gn timer triggers, the SGW session is deleted. * Make sure Operation Indication is set to 0, to tell the SGW to keep the Session up at the PGW. */ as_GTP2C_DeleteSession_success(tr_GTP2C_Indication(oI := '0'B)); + + /* TS 23.401 Figure D.3.5-1 Step 13: + * Upon rx of SGSN Context Acknowledge, MME released the ENB/UE context: + */ + as_s1ap_handle_UeContextReleaseCmd(); + /* Let MME some time to handle the Create Session Response: */ f_sleep(3.0); } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37893?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I0d7a388dc8b1a1c13de8f7e3fe7781423fc90868 Gerrit-Change-Number: 37893 Gerrit-PatchSet: 1 Gerrit-Owner: daniel <dwillmann(a)sysmocom.de>

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: S1AP_Emulation: Fix new_ctx never set when building security header

by pespin

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37890?usp=email ) Change subject: S1AP_Emulation: Fix new_ctx never set when building security header ...................................................................... S1AP_Emulation: Fix new_ctx never set when building security header The flag was never set to true. It needs to be set to true when building the secutiry head of Security Mode Complete after recieving Security Mode Command with a new EPS security context. TS 24.301 5.4.3.3 Change-Id: I76ad46f7ee5f49698e41da729cb6422866202951 --- M library/S1AP_Emulation.ttcn M mme/LTE_CryptoFunctions.ttcn 2 files changed, 12 insertions(+), 6 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/90/37890/1 diff --git a/library/S1AP_Emulation.ttcn b/library/S1AP_Emulation.ttcn index 3cce091..bc117ac 100644 --- a/library/S1AP_Emulation.ttcn +++ b/library/S1AP_Emulation.ttcn @@ -458,7 +458,7 @@ [] S1AP_CLIENT.receive(PDU_NAS_EPS:?) -> value nas sender vc_conn { var integer assoc_id := f_assoc_id_by_comp(vc_conn); var AssociationData ad := S1apAssociationTable[assoc_id]; - nas := f_nas_encaps(S1apAssociationTable[assoc_id].nus, nas, new_ctx := false); + nas := f_nas_encaps(S1apAssociationTable[assoc_id].nus, nas); var octetstring nas_enc := enc_PDU_NAS_EPS(nas); S1AP.send(t_S1AP_Send(g_s1ap_conn_id, ts_S1AP_UlNasTransport(ad.mme_ue_s1ap_id, diff --git a/mme/LTE_CryptoFunctions.ttcn b/mme/LTE_CryptoFunctions.ttcn index f0ea990..c223409 100644 --- a/mme/LTE_CryptoFunctions.ttcn +++ b/mme/LTE_CryptoFunctions.ttcn @@ -88,7 +88,8 @@ NAS_ALG_ENC alg_enc, /* NAS Encryption Algorithm */ octetstring k_nas_enc, /* NAS Encryption Key */ integer rx_count, /* frame counter (ATS rx side) */ - integer tx_count /* frame counter (ATS tx side) */ + integer tx_count, /* frame counter (ATS tx side) */ + boolean new_ctx /* Use "New EPS Security Context" when building next sec_hdr_t */ }; template (value) NAS_UE_State t_NAS_UE_State(NAS_Role role) := { @@ -98,7 +99,8 @@ alg_enc := NAS_ALG_ENC_EEA0, k_nas_enc := ''O, rx_count := 0, - tx_count := 0 + tx_count := 0, + new_ctx := false }; type enumerated NAS_Role { @@ -173,6 +175,7 @@ secp_nas := nas.ePS_messages.ePS_MobilityManagement.pDU_NAS_EPS_SecurityProtectedNASMessage; select (secp_nas.securityHeaderType) { case ('0011'B) { /* IP with new EPS security context */ + nus.new_ctx := true; nus.rx_count := 0; nus.alg_int := NAS_ALG_IP_EIA1; /* FIXME: from decoded inner message! */ if (not f_nas_check_ip(nus, secp_nas)) { @@ -182,6 +185,7 @@ return dec_PDU_NAS_EPS(secp_nas.nAS_Message); } case ('0001'B) { /* IP only */ + nus.new_ctx := false; if (not f_nas_check_ip(nus, secp_nas)) { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "f_nas_check_ip() failed"); } @@ -189,6 +193,7 @@ return dec_PDU_NAS_EPS(secp_nas.nAS_Message); } case ('0010'B) { /* IP + ciphered */ + nus.new_ctx := false; if (not f_nas_check_ip(nus, secp_nas)) { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "f_nas_check_ip() failed"); } @@ -198,6 +203,7 @@ return dec_PDU_NAS_EPS(secp_nas.nAS_Message); } case ('0100'B) { /* IP + ciphered; new EPS security context */ + nus.new_ctx := true; nus.rx_count := 0; if (not f_nas_check_ip(nus, secp_nas)) { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "f_nas_check_ip() failed"); @@ -236,7 +242,7 @@ } /* encapsulate a NAS message (encrypt, MAC) */ -function f_nas_encaps(inout NAS_UE_State nus, PDU_NAS_EPS nas_in, boolean new_ctx := false) +function f_nas_encaps(inout NAS_UE_State nus, PDU_NAS_EPS nas_in) return PDU_NAS_EPS { var boolean encrypt := false; @@ -252,11 +258,11 @@ return nas_in; } - if (new_ctx) { + if (nus.new_ctx) { nus.tx_count := 0; } - var BIT4 sec_hdr_t := f_nas_determine_sec_hdr_t(encrypt, authenticate, new_ctx); + var BIT4 sec_hdr_t := f_nas_determine_sec_hdr_t(encrypt, authenticate, nus.new_ctx); var octetstring nas_enc := enc_PDU_NAS_EPS(nas_in); if (encrypt) { f_nas_encrypt(nus.alg_enc, nus.k_nas_enc, nus.tx_count, 0, -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37890?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I76ad46f7ee5f49698e41da729cb6422866202951 Gerrit-Change-Number: 37890 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: mme: expect authentication during 2g->4G TAU procedure

by pespin

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37892?usp=email ) Change subject: mme: expect authentication during 2g->4G TAU procedure ...................................................................... mme: expect authentication during 2g->4G TAU procedure If TAU happens with an existing security context, network for sure wants to authenticate the UE. This is the scenario being tested here. If there was a security context (eg. from a previous 4G Attach), then it's up to the network to decide (or be capable) to implicitly authenticate the UE. Change-Id: I5ebcaf23a643b6cb97534328737257d26d3981fe --- M library/NAS_Templates.ttcn M mme/MME_Tests.ttcn 2 files changed, 28 insertions(+), 10 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/92/37892/1 diff --git a/library/NAS_Templates.ttcn b/library/NAS_Templates.ttcn index d45dc7d..bae7d6f 100644 --- a/library/NAS_Templates.ttcn +++ b/library/NAS_Templates.ttcn @@ -211,6 +211,18 @@ valueField := ptmsi_sig } +/* 9.9.3.34 UE network capability */ +template (value) UENetworkCapabilityLV +ts_UENetworkCapabilityLV(template (value) UENetworkCapabilityV ue_net_cap) := { + lengthIndicator := 0, /* overwritten */ + uENetworkCapabilityV := ue_net_cap +} +template (value) UENetworkCapabilityTLV +ts_UENetworkCapabilityTLV(template (value) UENetworkCapabilityV ue_net_cap) := { + elementIdentifier := '58'O, + uENetworkCapabilityLV := ts_UENetworkCapabilityLV(ue_net_cap) +} + /* 9.9.3.45 GUTI Type */ const BIT1 GUTI_TYPE_NATIVE := '0'B; const BIT1 GUTI_TYPE_MAPPED := '1'B; @@ -471,7 +483,8 @@ template (omit) P_TMSISignatureTV old_ptmsi_sig := omit, template (omit) GUTI_TypeTV old_guti_type := omit, template (omit) NonceTV nonce_ue := omit, - template (omit) CipheringKeySequenceNumberTV gprs_cksn := omit) := { + template (omit) CipheringKeySequenceNumberTV gprs_cksn := omit, + template (omit) UENetworkCapabilityTLV ue_net_cap := omit) := { protocolDiscriminator := c_EPS_NAS_PD_EMM, ePS_messages := { ePS_MobilityManagement := { @@ -486,7 +499,7 @@ old_P_TMSISignature := old_ptmsi_sig, additionalGUTI := omit, nonce := nonce_ue, - uENetworkCapability := omit, + uENetworkCapability := ue_net_cap, lastVisitedRegisteredTAI := omit, dRXParameter := omit, uE_RadioCapabilityInfoUpdateNeeded := omit, @@ -1286,8 +1299,4 @@ } } - - - - -} +} with { encode "RAW"} diff --git a/mme/MME_Tests.ttcn b/mme/MME_Tests.ttcn index 4edeb99..ca36e24 100644 --- a/mme/MME_Tests.ttcn +++ b/mme/MME_Tests.ttcn @@ -980,7 +980,8 @@ private altstep as_gtp_sgsn_context_2g_to_4g(OCT4 new_sgsn_teid := 'ABABABAB'O, GTPv1C_Templates.GTP_RATType rat_type := GTP_RAT_TYPE_EUTRAN, RoutingAreaIdentity rai, OCT4 ptmsi, - OCT3 ptmsi_sig + OCT3 ptmsi_sig, + boolean exp_auth := false ) runs on ConnHdlr { var Gtp1cUnitdata gtpc_pdu; @@ -1009,6 +1010,12 @@ oct2int(gtpc_pdu.gtpc.opt_part.sequenceNumber), SGSNContextRespPDU)); + if (exp_auth) { + as_DIA_AuthInfo(); + as_s1ap_handle_auth(); + as_s1ap_handle_sec_mode(); + } + GTP[0].receive(tr_GTPC_SGSNContextAck(g_gn_iface_peer, new_sgsn_teid, tr_SGSNContextAckPDU(GTP_CAUSE_REQUEST_ACCEPTED))) -> value gtpc_pdu; setverdict(pass); @@ -1517,6 +1524,7 @@ timer T := 5.0; var bitstring ptmsi_bits := oct2bit(ptmsi); var OCT4 ptmsi_exp := bit2oct('11'B & substr(ptmsi_bits, 2, 30)); + var template (value) UENetworkCapabilityTLV ue_net_cap := ts_UENetworkCapabilityTLV(c_NAS_defaultUeNetCap); rai := valueof(ts_RoutingAreaIdentity(mp_gn_local_mcc, mp_gn_local_mnc, int2oct(mp_gn_local_lac, 2), int2oct(mp_gn_local_rac, 1))); @@ -1527,7 +1535,8 @@ ts_PTMSI_SignatureTV(ptmsi_sig), ts_GUTI_TypeTV(GUTI_TYPE_MAPPED), ts_NonceTV('12345678'O), - ts_CipheringKeySequenceNumberTV('000'B)); + ts_CipheringKeySequenceNumberTV('000'B), + ue_net_cap := ue_net_cap); tx := ts_S1AP_InitialUE(p_eNB_value := 0, p_nasPdu := enc_PDU_NAS_EPS(valueof(nas_tau)), p_tAI := ts_enb_S1AP_TAI(g_pars.enb_pars[g_pars.mme_idx]), p_eUTRAN_CGI := ts_enb_S1AP_CGI(g_pars.enb_pars[g_pars.mme_idx]), @@ -1541,7 +1550,7 @@ }; S1AP.send(cfg); - as_gtp_sgsn_context_2g_to_4g(new_sgsn_teid, GTP_RAT_TYPE_EUTRAN, rai, ptmsi_exp, ptmsi_sig); + as_gtp_sgsn_context_2g_to_4g(new_sgsn_teid, GTP_RAT_TYPE_EUTRAN, rai, ptmsi_exp, ptmsi_sig, exp_auth := true); /* We now expect the MME to send a Create Session Request to the SGW-C */ T.start; -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37892?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I5ebcaf23a643b6cb97534328737257d26d3981fe Gerrit-Change-Number: 37892 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 year

1
0
0 0

[M] Change in osmo-ttcn3-hacks[master]: S1AP_Emulation: Fix building security headers for Integrity and Ciphe...

by pespin

pespin has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email ) Change subject: S1AP_Emulation: Fix building security headers for Integrity and Ciphering ...................................................................... S1AP_Emulation: Fix building security headers for Integrity and Ciphering The fact that the network insturcts the UE to use EEA0 encryption (null algo) doesn't mean the UE should mark the NAS frames in the security header as non-ciphered. They need to be marked as IP+ciphered in the outter header, and as plain in the inner one. Now TTCN3 behaves like a UE recorded while executing a similar test case. Moreover, wireshark is now happy decoding the messages. Change-Id: Ifd4fe83e7b5aefdaafe7ce1c8b1ec6a67c65819c --- M library/S1AP_Emulation.ttcn M mme/LTE_CryptoFunctions.ttcn M mme/MME_Tests.ttcn 3 files changed, 41 insertions(+), 18 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/91/37891/1 diff --git a/library/S1AP_Emulation.ttcn b/library/S1AP_Emulation.ttcn index bc117ac..f81441f 100644 --- a/library/S1AP_Emulation.ttcn +++ b/library/S1AP_Emulation.ttcn @@ -74,7 +74,8 @@ type union S1APEM_Config { NAS_Keys set_nas_keys, ResetNAScounts reset_nas_counts, - NAS_ALG_INT set_nas_alg_int + NAS_ALG_INT set_nas_alg_int, + NAS_ALG_ENC set_nas_alg_enc }; type enumerated S1APEM_EventUpDown { @@ -443,6 +444,15 @@ [] S1AP_CLIENT.receive(S1APEM_Config:{set_nas_alg_int:=?}) -> value s1cfg sender vc_conn { var integer assoc_id := f_assoc_id_by_comp(vc_conn); S1apAssociationTable[assoc_id].nus.alg_int := s1cfg.set_nas_alg_int; + /* Mark ciphering even if using EIA0: */ + S1apAssociationTable[assoc_id].nus.use_int := true; + } + /* Configuration primitive from client */ + [] S1AP_CLIENT.receive(S1APEM_Config:{set_nas_alg_enc:=?}) -> value s1cfg sender vc_conn { + var integer assoc_id := f_assoc_id_by_comp(vc_conn); + S1apAssociationTable[assoc_id].nus.alg_enc := s1cfg.set_nas_alg_enc; + /* Mark ciphering even if using EEA0: */ + S1apAssociationTable[assoc_id].nus.use_enc := true; } /* S1AP from client: InitialUE */ [] S1AP_CLIENT.receive(tr_S1AP_InitialUE) -> value msg sender vc_conn { diff --git a/mme/LTE_CryptoFunctions.ttcn b/mme/LTE_CryptoFunctions.ttcn index c223409..48b5a07 100644 --- a/mme/LTE_CryptoFunctions.ttcn +++ b/mme/LTE_CryptoFunctions.ttcn @@ -89,7 +89,9 @@ octetstring k_nas_enc, /* NAS Encryption Key */ integer rx_count, /* frame counter (ATS rx side) */ integer tx_count, /* frame counter (ATS tx side) */ - boolean new_ctx /* Use "New EPS Security Context" when building next sec_hdr_t */ + boolean new_ctx, /* Use "New EPS Security Context" when building next sec_hdr_t */ + boolean use_int, /* Whether to use "Integrity" in sec_hdr_t */ + boolean use_enc /* Whether to use "Ciphering" in sec_hdr_t */ }; template (value) NAS_UE_State t_NAS_UE_State(NAS_Role role) := { @@ -100,7 +102,9 @@ k_nas_enc := ''O, rx_count := 0, tx_count := 0, - new_ctx := false + new_ctx := false, + use_int := false, + use_enc := false }; type enumerated NAS_Role { @@ -245,16 +249,10 @@ function f_nas_encaps(inout NAS_UE_State nus, PDU_NAS_EPS nas_in) return PDU_NAS_EPS { - var boolean encrypt := false; - var boolean authenticate := false; - if (nus.alg_int != NAS_ALG_IP_EIA0) { - authenticate := true; - } - if (nus.alg_enc != NAS_ALG_ENC_EEA0) { - encrypt := true; - } + var BIT4 sec_hdr_t; + var PDU_NAS_EPS nas_out; - if (encrypt == false and authenticate == false) { + if (nus.use_enc == false and nus.use_int == false) { return nas_in; } @@ -262,15 +260,15 @@ nus.tx_count := 0; } - var BIT4 sec_hdr_t := f_nas_determine_sec_hdr_t(encrypt, authenticate, nus.new_ctx); var octetstring nas_enc := enc_PDU_NAS_EPS(nas_in); - if (encrypt) { + if (nus.use_enc) { f_nas_encrypt(nus.alg_enc, nus.k_nas_enc, nus.tx_count, 0, f_tx_is_downlink(nus), nas_enc); } - var PDU_NAS_EPS nas_out; + + sec_hdr_t := f_nas_determine_sec_hdr_t(nus.use_enc, nus.use_int, nus.new_ctx); nas_out := valueof(ts_NAS_EMM_SecurityProtected(sec_hdr_t, nus.tx_count, nas_enc)); - if (authenticate) { + if (nus.use_int) { var OCT4 mac := f_nas_mac_calc(nus.alg_int, nus.k_nas_int, nus.tx_count, 0, f_tx_is_downlink(nus), '00'O & nas_enc); nas_out.ePS_messages.ePS_MobilityManagement.pDU_NAS_EPS_SecurityProtectedNASMessage.messageAuthenticationCode := mac; diff --git a/mme/MME_Tests.ttcn b/mme/MME_Tests.ttcn index 7a6b34c..4edeb99 100644 --- a/mme/MME_Tests.ttcn +++ b/mme/MME_Tests.ttcn @@ -602,6 +602,7 @@ } private altstep as_s1ap_handle_sec_mode() runs on ConnHdlr { + var S1APEM_Config cfg; var PDU_NAS_EPS rx_nas; var NAS_SecurityAlgorithmsV alg := { typeOfIntegrityProtection := '001'B, @@ -614,6 +615,20 @@ tSC := '0'B }; [] S1AP.receive(tr_NAS_SecModeCmd(alg, kset_id, ?)) { + /* TODO: apply below integrity and ciphering based on + * Security Mode Command field "NAS security algorithms - Selected NAS security algorithms"*/ + + /* Configure integrity protection: */ + cfg := { + set_nas_alg_int := NAS_ALG_IP_EIA1 + }; + S1AP.send(cfg); + /* Configure Ciphering: */ + cfg := { + set_nas_alg_enc := NAS_ALG_ENC_EEA0 + }; + S1AP.send(cfg); + S1AP.send(ts_NAS_SecModeCmpl); } } @@ -682,8 +697,8 @@ S1AP.send(ts_S1AP_InitialCtxSetupResp(valueof(mme_ue_id), valueof(enb_ue_id), rab_setup_items)); /* 3GPP TS 23.401 D.3.6 step 23: */ - /* Integrity Protection: TS 24.301 Section 4.4.4.3*/ - S1AP.send(ts_PDU_NAS_EPS_TrackingAreaUpdateComplete(c_EPS_SEC_IP)); + /* Integrity Protection and Ciphering implemented by S1AP_Emulation: */ + S1AP.send(ts_PDU_NAS_EPS_TrackingAreaUpdateComplete(c_EPS_SEC_NONE)); } [] S1AP.receive(PDU_NAS_EPS:?) -> value rx_nas { Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, log2str("Rx Unexpected NAS PDU msg: ", rx_nas)); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37891?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ifd4fe83e7b5aefdaafe7ce1c8b1ec6a67c65819c Gerrit-Change-Number: 37891 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de>

1 year

1
0
0 0

[S] Change in osmo-dev[master]: gen_makefile: support symlinks for src + src_proj

by pespin

Attention is currently required from: osmith. pespin has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-dev/+/37888?usp=email ) Change subject: gen_makefile: support symlinks for src + src_proj ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-dev/+/37888?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-dev Gerrit-Branch: master Gerrit-Change-Id: Ic5ffa132b29e0a2ca78b02e4c8c05492471b3966 Gerrit-Change-Number: 37888 Gerrit-PatchSet: 2 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:14:44 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 year

1
0
0 0

[S] Change in osmo-ttcn3-hacks[master]: testenv/README: update

by pespin

Attention is currently required from: osmith. pespin has posted comments on this change by osmith. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37886?usp=email ) Change subject: testenv/README: update ...................................................................... Patch Set 2: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/37886?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: Ie9eee8cf14ba2069c1cd5bd6ab703f3f6ccdc100 Gerrit-Change-Number: 37886 Gerrit-PatchSet: 2 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Comment-Date: Wed, 21 Aug 2024 16:14:13 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 year

1
0
0 0

2025

2024

2023

2022

gerrit-log August 2024