June 2025 - gerrit-log - lists.osmocom.org

[L] Change in osmo-ttcn3-hacks[master]: 5gc: Implement AKA authentication

by pespin

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40413?usp=email ) Change subject: 5gc: Implement AKA authentication ...................................................................... 5gc: Implement AKA authentication deps/nas.git already has some Auth related functionaltities to calculate XRES*, but I couldn't get them to generate proper output. Furthermore, using them directly would include a lot of churn we don't want: * ttcn: Otherwise ttcn/Lib_NG_NAS/LIB_NG_NAS_Functions.ttcn brings in tons of dependencies about Emulation stuff which is not interesting for us. * .cc: We want to implement our own low level functions using our eclipse Titan API, as well as our own C lib dependencies (because some code for those dependencies is not really available in the repo). Hence, instead use our own milenage.c implementation imported from libosmocore (actually from a slightly modified self-contained copy we already ported to some development branch of asterisk VoLTE project). With this patch it is already possible to detect SQN Out-of-sync and answer with an Auth Failure, then get a new Auth Req from network and properly answer with an Auth Resp which the network likes and hence answers with a Security Mode Command. Change-Id: I11527f47e4310863124f3f02148e3f71da7d911e --- M 5gc/C5G_Tests.cfg M 5gc/C5G_Tests.ttcn M 5gc/gen_links.sh M 5gc/regen_makefile.sh M deps/Makefile M library/General_Types.ttcn A library/NG_CryptoFunctionDefs.cc A library/NG_CryptoFunctions.ttcn M library/NG_NAS_Osmo_Templates.ttcn A library/milenage/Milenage_FunctionDefs.cc A library/milenage/Milenage_Functions.ttcn A library/milenage/milenage.c A library/milenage/milenage.h A library/ng_crypto/key_derivation.c A library/ng_crypto/key_derivation.h 15 files changed, 837 insertions(+), 17 deletions(-) Approvals: jolly: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved diff --git a/5gc/C5G_Tests.cfg b/5gc/C5G_Tests.cfg index 85ad9a3..d45b963 100644 --- a/5gc/C5G_Tests.cfg +++ b/5gc/C5G_Tests.cfg @@ -16,6 +16,9 @@ mp_5gc_ngap_port := 38412; mp_local_ngap_ip := "127.0.0.202"; mp_local_ngap_port := 50000; +mp_imsi := '999700000000000'H; +mp_usim_key := '762a2206fe0b4151ace403c86a11e479'O; +mp_usim_opc := '3c6e0b8a9c15224a8228b9a98ca1531d'O; [MAIN_CONTROLLER] diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn index 9b45298..9cf5ec3 100644 --- a/5gc/C5G_Tests.ttcn +++ b/5gc/C5G_Tests.ttcn @@ -19,6 +19,8 @@ import from Osmocom_Types all; import from GSM_Types all; +import from Milenage_Functions all; + import from NGAP_PDU_Descriptions all; import from NGAP_IEs all; import from NGAP_PDU_Contents all; @@ -31,14 +33,14 @@ import from NGAP_Emulation all; import from NAS_CommonTypeDefs all; - +import from NAS_CommonTemplates all; import from NG_NAS_Common all; import from NG_NAS_MsgContainers all; -import from NAS_CommonTemplates all; import from NG_NAS_Templates all; import from NG_NAS_Osmo_Templates all; import from NG_NAS_Functions all; +import from NG_CryptoFunctions all; /* (maximum) number of emulated eNBs */ const integer NUM_NGRAN := 1; @@ -56,6 +58,8 @@ GsmMcc mp_mcc := '999'H; GsmMnc mp_mnc := '70'H; hexstring mp_imsi := '999700000000000'H; + octetstring mp_usim_key := '762a2206fe0b4151ace403c86a11e479'O; + octetstring mp_usim_opc := '3c6e0b8a9c15224a8228b9a98ca1531d'O; uint24_t mp_tac := 1; } @@ -69,6 +73,8 @@ /* parameters of emulated UE */ type record UeParams { hexstring imsi, + octetstring usim_key, + octetstring usim_opc, charstring ue_ip } @@ -145,6 +151,8 @@ uep := { imsi := f_concat_pad(lengthof(mp_imsi), substr(mp_imsi, 0, lengthof(mp_imsi) - 6), imsi_suffix), + usim_key := mp_usim_key, + usim_opc := mp_usim_opc, ue_ip := "192.168.123.50" } } @@ -211,12 +219,18 @@ iE_Extensions := omit } -private function f_SUCI_IMSI() runs on ConnHdlr return octetstring { +private function f_imsi_plmn_id() runs on ConnHdlr return PLMNIdentity { var hexstring imsi := g_pars.ue_pars.imsi; var GsmMcc mcc := substr(imsi, 0, 3); var GsmMnc mnc := substr(imsi, 3, 2); - var octetstring imsi_suffix := imsi_hex2oct(substr(imsi, lengthof(imsi)-10, 10)); - return f_enc_mcc_mnc(mcc, mnc) & '21430001'O & imsi_suffix; + return f_enc_mcc_mnc(mcc, mnc); +} + +private function f_SUCI_IMSI() runs on ConnHdlr return octetstring { + var hexstring imsi := g_pars.ue_pars.imsi; + var PLMNIdentity plmn_id := f_imsi_plmn_id(); + var octetstring imsi_suffix := imsi_hex2oct(substr(imsi, lengthof(imsi) - 10, 10)); + return plmn_id & '21430001'O & imsi_suffix; } friend function f_ngap_setup(integer idx := 0, template (omit) NGAP_IEs.Cause cause := omit) runs on MTC_CT { @@ -270,17 +284,60 @@ } } -private altstep as_ngap_handle_auth() runs on ConnHdlr { +/* 3GPP TS 24.501 5.4.1.3.2, 3GPP TS 33.501 6.1.3.2 */ +private altstep as_ngap_handle_auth(boolean allow_resync := true) runs on ConnHdlr { var NG_NAS_DL_Message_Type rx_nas; var template (present) NAS_KeySetIdentifier kset_id := f_tr_ConnHdlr_kset_id(); [] NGAP.receive(cr_NG_AUTHENTICATION_REQUEST) -> value rx_nas { log("Rx NAS message: ", rx_nas); + var integer ret; + var integer my_sqn := 0; /* TODO: move to a ConnHdlr state attribute? */ + var OCT16 rand := bit2oct(rx_nas.authentication_Request.rand.randValue); + var OCT16 autn := bit2oct(rx_nas.authentication_Request.autn.aUTN); + var OCT16 ik; + var OCT16 ck; + var OCT8 res; + var OCT14 auts; g_pars.kset_id := rx_nas.authentication_Request.ngNasKeySetId; - /* TODO: generate proper RES, 3GPP TS 33.501 A.4 */ - const OCT8 res := '6a91970e838fd079'O; - NGAP.send(cs_NG_AUTHENTICATION_RESPONSE(cs_AuthenticationResponseParameter(oct2bit(res)))); + ret := f_milenage_check(g_pars.ue_pars.usim_key, + g_pars.ue_pars.usim_opc, + int2oct(my_sqn, 8), + rand, autn, ik, ck, res, auts); + if (ret == -1) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + log2str("fx_milenage_check() failed! -1")); + } + if (ret == -2) { + if (not allow_resync) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + log2str("fx_milenage_check() unexpected Resync!")); + } + log("Milenage: RX-SQN differs from SIM SQN: Re-Sync! AUTS=", auts); + /* 3GPP TS 24.501 5.4.1.3.6 d) */ + NGAP.send(cs_NG_AUTHENTICATION_FAILURE(cs_GMM_GSM_Cause(omit, int2bit(21, 8)), + cs_AuthFailParam(oct2bit(auts)))); + as_ngap_handle_auth(allow_resync := false); + return; + } + + /* Derive (X)RES* from (X)RES, 3GPP TS 33.501 A.4 */ + var octetstring ssn := f_NG_NAS_ServingNetworkName_OCT(f_imsi_plmn_id(), omit); + var OCT16 res_star := f_kdf_xres_star(ssn, ck, ik, rand, res); + log("Auth Response: RES=", res, ", SSN=", ssn, " / ", oct2char(ssn), ", RES*=", res_star); + + NGAP.send(cs_NG_AUTHENTICATION_RESPONSE(cs_AuthenticationResponseParameter(oct2bit(res_star)))); + } +} + +private altstep as_ngap_handle_sec_mode() runs on ConnHdlr { + var NG_NAS_DL_Message_Type rx_nas; + + [] NGAP.receive(cr_NG_SECURITY_PROTECTED_NAS_MESSAGE) -> value rx_nas { + var NG_NAS_DL_Message_Type in_nas := dec_NG_NAS_DL_Message_Type(rx_nas.security_Protected_Nas_Message.plainNASMessage); + log("PESPIN: Rx inner NAS: ", in_nas); + /* TODO: apply below integrity and ciphering based on Security Mode Command */ } } @@ -320,6 +377,7 @@ } as_ngap_handle_auth(); + as_ngap_handle_sec_mode(); /* TODO: handle Auth, SecurityModeCommand, InitialContextSetup, PDUSessionresource, */ f_sleep(5.0); diff --git a/5gc/gen_links.sh b/5gc/gen_links.sh index 295ca24..9f67736 100755 --- a/5gc/gen_links.sh +++ b/5gc/gen_links.sh @@ -61,12 +61,21 @@ FILES+="NGAP_EncDec.cc NGAP_Types.ttcn NGAP_Pixits.ttcn NGAP_Templates.ttcn " gen_links $DIR $FILES +DIR=../library/milenage +FILES="milenage.c milenage.h Milenage_FunctionDefs.cc Milenage_Functions.ttcn " +gen_links $DIR $FILES + +DIR=../library/ng_crypto +FILES="key_derivation.c key_derivation.h " +gen_links $DIR $FILES + DIR=../library FILES="Misc_Helpers.ttcn General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPCP_Types.ttcn IPCP_Templates.ttcn " FILES+="SCTP_Templates.ttcn " FILES+="DNS_Helpers.ttcn " FILES+="NGAP_CodecPort.ttcn NGAP_CodecPort_CtrlFunctDef.cc NGAP_CodecPort_CtrlFunct.ttcn NGAP_Functions.ttcn NGAP_Emulation.ttcn " FILES+="NG_NAS_Osmo_Templates.ttcn NG_NAS_Functions.ttcn " +FILES+="NG_CryptoFunctionDefs.cc NG_CryptoFunctions.ttcn " gen_links $DIR $FILES gen_links_finish diff --git a/5gc/regen_makefile.sh b/5gc/regen_makefile.sh index 44f7a56..0d53583 100755 --- a/5gc/regen_makefile.sh +++ b/5gc/regen_makefile.sh @@ -4,13 +4,16 @@ FILES=" *.asn + *.c *.ttcn IPL4asp_PT.cc IPL4asp_discovery.cc Native_FunctionDefs.cc common_ext.cc + Milenage_FunctionDefs.cc NGAP_CodecPort_CtrlFunctDef.cc NGAP_EncDec.cc + NG_CryptoFunctionDefs.cc TCCConversion.cc TCCEncoding.cc TCCInterface.cc diff --git a/deps/Makefile b/deps/Makefile index aa2b36c..b7e06cb 100644 --- a/deps/Makefile +++ b/deps/Makefile @@ -85,7 +85,7 @@ # Do not put references to branches here, except for local testing: this breaks the caching # logic of docker containers, which only invalidate their cached ttcn3 dependencies if this # file changed. -nas_commit= 4371752494b7c85cd5a3bc32bc6f498171c7aa13 +nas_commit= f7921c4d88e204e09067f0975957d075be82e800 titan.Libraries.TCCUsefulFunctions_commit= R.35.B-6-gb3687da titan.ProtocolEmulations.M3UA_commit= b58f92046e48a7b1ed531e243a2319ebca53bf4c titan.ProtocolEmulations.SCCP_commit= 750a3e836831e58eae59d4757ef5d0c759f9ca5d diff --git a/library/General_Types.ttcn b/library/General_Types.ttcn index 2daa593..163ec47 100644 --- a/library/General_Types.ttcn +++ b/library/General_Types.ttcn @@ -84,7 +84,11 @@ type bitstring BIT30 length(30) with { variant "FIELDLENGTH(30)" }; type bitstring BIT31 length(31) with { variant "FIELDLENGTH(31)" }; type bitstring BIT32 length(32) with { variant "FIELDLENGTH(32)" }; + type bitstring BIT48 length(48) with { variant "FIELDLENGTH(48)" }; type bitstring BIT56 length(56) with { variant "FIELDLENGTH(56)" }; + type bitstring BIT64 length(64) with { variant "FIELDLENGTH(64)" }; + type bitstring BIT128 length(128) with { variant "FIELDLENGTH(128)" }; + type bitstring BIT256 length(256) with { variant "FIELDLENGTH(256)" }; //**************************************************** // Octetstrings diff --git a/library/NG_CryptoFunctionDefs.cc b/library/NG_CryptoFunctionDefs.cc new file mode 100644 index 0000000..e45e519 --- /dev/null +++ b/library/NG_CryptoFunctionDefs.cc @@ -0,0 +1,40 @@ +/* AKA USIM Utility functions */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <stdint.h> +#include <gnutls/crypto.h> + +#include <Addfunc.hh> +#include <Encdec.hh> +#include <Boolean.hh> +#include <Integer.hh> +#include <Octetstring.hh> +#include <Bitstring.hh> + +#include "key_derivation.h" + +namespace NG__CryptoFunctions { + +/* 3GPP TS 33.501 A.4 RES* and XRES* derivation function */ +OCTETSTRING f__kdf__xres__star(const OCTETSTRING &ssn, const OCTETSTRING& ck, const OCTETSTRING& ik, + const OCTETSTRING& rand, const OCTETSTRING& xres) +{ + TTCN_Buffer ttcn_buf_ssn(ssn); + TTCN_Buffer ttcn_buf_ck(ck); + TTCN_Buffer ttcn_buf_ik(ik); + TTCN_Buffer ttcn_buf_rand(rand); + TTCN_Buffer ttcn_buf_xres(xres); + uint8_t xres_star[16]; + + kdf_xres_star(ttcn_buf_ssn.get_data(), ttcn_buf_ssn.get_len(), + ttcn_buf_ck.get_data(), + ttcn_buf_ik.get_data(), + ttcn_buf_rand.get_data(), + ttcn_buf_xres.get_data(), ttcn_buf_xres.get_len(), + xres_star); + return OCTETSTRING(sizeof(xres_star), xres_star); +} + +} diff --git a/library/NG_CryptoFunctions.ttcn b/library/NG_CryptoFunctions.ttcn new file mode 100644 index 0000000..fbbe57e --- /dev/null +++ b/library/NG_CryptoFunctions.ttcn @@ -0,0 +1,78 @@ +/* Utility crypto functions for NG NAS (5G) + * + * (C) 2025 by sysmocom - s.f.m.c. GmbH <info(a)sysmocom.de> + * Author: Pau Espin Pedrol <pespin(a)sysmocom.de + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +module NG_CryptoFunctions { + +import from General_Types all; +import from Misc_Helpers all; + +import from NAS_CommonTypeDefs all; + +/********************************************************************************* + * low-level API (external C/C++ code) + *********************************************************************************/ + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +external function f_kdf_xres_star(octetstring ssn, OCT16 ck, OCT16 ik, OCT16 rand, + octetstring xres) return OCT16; + +/********************************************************************************* + * mid-level API + *********************************************************************************/ + +function f_NG_NAS_SNN_MNC(NAS_PlmnId plmn_id) return charstring +{ + var charstring mnc := ""; + var hexstring plmn_hex := oct2hex(plmn_id); + + if (plmn_hex[2] == 'F'H) { + mnc := "0"; + } + mnc := mnc & hex2str(plmn_hex[5]) & hex2str(plmn_hex[4]); + if (plmn_hex[2] != 'F'H) { + /* add last digit if not F */ + mnc := mnc & hex2str(plmn_hex[2]); + } + return mnc; +} + +function f_NG_NAS_SNN_MCC(NAS_PlmnId plmn_id) return charstring +{ + var charstring mcc; + var hexstring plmn_hex := oct2hex(plmn_id); + + mcc := hex2str(plmn_hex[1]) & + hex2str(plmn_hex[0]) & + hex2str(plmn_hex[3]); + + return mcc; +} + +function f_NG_NAS_ServingNetworkName(NAS_PlmnId plmn_id, template (omit) hexstring NID := omit) return charstring +{ + var charstring ssn := "5G:mnc" & f_NG_NAS_SNN_MNC(plmn_id) & + ".mcc" & f_NG_NAS_SNN_MCC(plmn_id) & + ".3gppnetwork.org"; + + if (isvalue(NID)) { + ssn := ssn & ":" & hex2str (valueof(NID)); + } + + return ssn; +} + +function f_NG_NAS_ServingNetworkName_OCT(NAS_PlmnId plmn_id, template (omit) hexstring NID := omit) return octetstring +{ + return char2oct(f_NG_NAS_ServingNetworkName(plmn_id, NID)); +} + +} diff --git a/library/NG_NAS_Osmo_Templates.ttcn b/library/NG_NAS_Osmo_Templates.ttcn index 1108947..5887fa6 100644 --- a/library/NG_NAS_Osmo_Templates.ttcn +++ b/library/NG_NAS_Osmo_Templates.ttcn @@ -54,6 +54,13 @@ res := p_ExpectedRES } + template (value) AuthenticationFailureParameter cs_AuthFailParam(template (value) B112_Type auts) := + { + iei := '30'O, // version 110, and value used in GMM + iel := '0E'O, + auts := auts + }; + /* 24.501 cl. 8.2.1 */ template (present) NG_NAS_DL_Message_Type @@ -63,7 +70,7 @@ template AUTN p_AUTN := *, template EAP_Message p_EAP := * ) := -{ /* 24.501 cl. 8.2.1 */ +{ authentication_Request := { protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ @@ -84,13 +91,47 @@ template (omit) EAP_Message p_EAP := omit) := { authentication_Response := { - protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ - spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ - securityHeaderType := tsc_SHT_NoSecurityProtection, - messageType := tsc_MT_NG_AuthenticationResponse, /* cl. 9.7 M V 1 */ - authResponseParam := p_Res, /* cl. 9.11.3.17 O TLV 18 IEI=2D */ - eapMessage := p_EAP /* cl. 9.11.2.2 O TLV-E 7-1503 IEI=78 */ + protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ + spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ + securityHeaderType := tsc_SHT_NoSecurityProtection, + messageType := tsc_MT_NG_AuthenticationResponse, /* cl. 9.7 M V 1 */ + authResponseParam := p_Res, /* cl. 9.11.3.17 O TLV 18 IEI=2D */ + eapMessage := p_EAP /* cl. 9.11.2.2 O TLV-E 7-1503 IEI=78 */ + } } + +/* 24.501 cl. 8.2.4 */ +template (value) NG_NAS_UL_Message_Type cs_NG_AUTHENTICATION_FAILURE(template (value) GMM_GSM_Cause p_Cause, + template (omit) AuthenticationFailureParameter p_AuthFailParam := omit) := +{ + authentication_Failure := { + protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ + spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ + securityHeaderType := tsc_SHT_NoSecurityProtection, + messageType := tsc_MT_NG_AuthenticationFailure, /* cl. 9.7 M V 1 */ + gmmCause := p_Cause, /* cl. 9.11.3.2 M V 1 */ + authFailureParam := p_AuthFailParam /* cl. 9.11.3.12 O TLV 16 IEI=30 */ + } +} + + +/* 24.501 cl. 8.2.28 */ +template (present) NG_NAS_DL_Message_Type +cr_NG_SECURITY_PROTECTED_NAS_MESSAGE(template (present) ExtdProtocolDiscriminator p_protocolDiscriminator := ?, + template (present) SpareHalfOctet p_spareHalfOctet := ?, + template (present) SecurityHeaderType p_securityHeaderType := ?, + template (present) MessageAuthenticationCode p_messageAuthenticationCode := ?, + template (present) NAS_SequenceNumber p_sequenceNumber := ?, + template (present) NG_NAS_Message p_plainNASMessage := ?) := +{ + security_Protected_Nas_Message := { + protocolDiscriminator := p_protocolDiscriminator, /* cl. 9.2 M V 1 */ + spareHalfOctet := p_spareHalfOctet, /* cl. 9.5 M V 1/2 */ + securityHeaderType := p_securityHeaderType, /* cl. 9.3 M V 1/2 */ + messageAuthenticationCode := p_messageAuthenticationCode, /* cl. 9.8 M V 4 */ + sequenceNumber := p_sequenceNumber, /* cl. 9.10 M V 1 */ + plainNASMessage := p_plainNASMessage /* cl. 9.9 M V 3-n */ + } } } diff --git a/library/milenage/Milenage_FunctionDefs.cc b/library/milenage/Milenage_FunctionDefs.cc new file mode 100644 index 0000000..ddd399f --- /dev/null +++ b/library/milenage/Milenage_FunctionDefs.cc @@ -0,0 +1,53 @@ +/* AKA USIM Utility functions */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <stdint.h> + +#include <Addfunc.hh> +#include <Encdec.hh> +#include <Boolean.hh> +#include <Integer.hh> +#include <Octetstring.hh> +#include <Bitstring.hh> + +#include "milenage.h" + +namespace Milenage__Functions { + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +INTEGER f__milenage__check(const OCTETSTRING& opc, const OCTETSTRING& k, + const OCTETSTRING& sqn, const OCTETSTRING& _rand, const OCTETSTRING& autn, + OCTETSTRING& ik, OCTETSTRING& ck, OCTETSTRING& res, OCTETSTRING& auts) +{ + TTCN_Buffer ttcn_buf_opc(opc); + TTCN_Buffer ttcn_buf_k(k); + TTCN_Buffer ttcn_buf_sqn(sqn); + TTCN_Buffer ttcn_buf_rand(_rand); + TTCN_Buffer ttcn_buf_autn(autn); + uint8_t buf_ik[16]; + uint8_t buf_ck[16]; + uint8_t buf_res[8]; + uint8_t buf_auts[14]; + size_t res_len = 0; + int rc; + + rc = milenage_check(ttcn_buf_opc.get_data(), + ttcn_buf_k.get_data(), + ttcn_buf_sqn.get_data(), + ttcn_buf_rand.get_data(), + ttcn_buf_autn.get_data(), + buf_ik, buf_ck, + buf_res, &res_len, + buf_auts); + + ik = OCTETSTRING(16, static_cast<const unsigned char*>(&buf_ik[0])); + ck = OCTETSTRING(16, static_cast<const unsigned char*>(&buf_ck[0])); + res = OCTETSTRING(res_len, static_cast<const unsigned char*>(&buf_res[0])); + auts = OCTETSTRING(14, static_cast<const unsigned char*>(&buf_auts[0])); + + return INTEGER(rc); +} + +} diff --git a/library/milenage/Milenage_Functions.ttcn b/library/milenage/Milenage_Functions.ttcn new file mode 100644 index 0000000..8fb9b04 --- /dev/null +++ b/library/milenage/Milenage_Functions.ttcn @@ -0,0 +1,24 @@ +/* Milenage crypto functions (USIM AKA) + * + * (C) 2025 by sysmocom - s.f.m.c. GmbH <info(a)sysmocom.de> + * Author: Pau Espin Pedrol <pespin(a)sysmocom.de + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +module Milenage_Functions { + +import from General_Types all; + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +external function f_milenage_check(OCT16 opc,OCT16 k, + OCT8 sqn, OCT16 rand, OCT16 autn, + out OCT16 ik, out OCT16 ck, + out OCT8 res, out OCT14 auts) return integer; + + +} diff --git a/library/milenage/milenage.c b/library/milenage/milenage.c new file mode 100644 index 0000000..d079a3d --- /dev/null +++ b/library/milenage/milenage.c @@ -0,0 +1,424 @@ +/* + * 3GPP AKA - Milenage algorithm (3GPP TS 35.205, .206, .207, .208) + * Copyright (c) 2006-2007 <j(a)w1.fi> + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + * + * This file implements an example authentication algorithm defined for 3GPP + * AKA. This can be used to implement a simple HLR/AuC into hlr_auc_gw to allow + * EAP-AKA to be tested properly with real USIM cards. + * + * This implementations assumes that the r1..r5 and c1..c5 constants defined in + * TS 35.206 are used, i.e., r1=64, r2=0, r3=32, r4=64, r5=96, c1=00..00, + * c2=00..01, c3=00..02, c4=00..04, c5=00..08. The block cipher is assumed to + * be AES (Rijndael). + */ + + +#include "milenage.h" + +#include <openssl/err.h> /* for ERR_print_errors_fp */ +#include <openssl/ssl.h> /* for NID_sha1, RSA */ +#include <openssl/evp.h> /* for EVP_PKEY, EVP_sha1(), ... */ +#include <openssl/md5.h> /* for MD5_DIGEST_LENGTH */ +#include <openssl/sha.h> /* for SHA_DIGEST_LENGTH */ + +#define AST_CRYPTO_RSA_KEY_BITS 1024 +#define AST_CRYPTO_AES_BLOCKSIZE 128 + +struct ast_aes { + unsigned char raw[AST_CRYPTO_AES_BLOCKSIZE / 8]; +}; + +int ast_aes_set_encrypt_key(const unsigned char *key, struct ast_aes *ctx) +{ + if (key == NULL || ctx == NULL) + return -1; + + memcpy(ctx->raw, key, AST_CRYPTO_AES_BLOCKSIZE / 8); + return 0; +} + +static int evp_cipher_aes_encrypt(const unsigned char *in, unsigned char *out, unsigned inlen, const struct ast_aes *key) +{ + EVP_CIPHER_CTX *ctx = NULL; + int res, outlen, finallen; + unsigned char final[AST_CRYPTO_AES_BLOCKSIZE / 8]; + + if ((ctx = EVP_CIPHER_CTX_new()) == NULL) + return -1; + + do { + if ((res = EVP_CipherInit(ctx, EVP_aes_128_ecb(), key->raw, NULL, 1)) <= 0) + break; + EVP_CIPHER_CTX_set_padding(ctx, 0); + if ((res = EVP_CipherUpdate(ctx, out, &outlen, in, inlen)) <= 0) + break; + /* for ECB, this is a no-op */ + if ((res = EVP_CipherFinal(ctx, final, &finallen)) <= 0) + break; + res = outlen; + } while (0); + + EVP_CIPHER_CTX_free(ctx); + + return res; +} + +int ast_aes_encrypt(const unsigned char *in, unsigned char *out, const struct ast_aes *key) +{ + int res; + + if ((res = evp_cipher_aes_encrypt(in, out, AST_CRYPTO_AES_BLOCKSIZE / 8, key)) <= 0) { + printf("AES encryption failed\n"); + exit(0); + } + return res; +} + +static int aes_128_encrypt_block(const u8 *key, const u8 *plain, u8 *encr) +{ + struct ast_aes aes_key; + + ast_aes_set_encrypt_key(key, &aes_key); + if (ast_aes_encrypt(plain, encr, &aes_key) <= 0) { + printf("Failed to ecrypt AES 128."); + return -1; + } + + return 0; +} + +#define DEBUG +#ifdef DEBUG +void hexdump(const char *text, const uint8_t *data, int len) +{ + char s[3 * len + 2], *p; + int f; + + for (p = s, f = 0; f < len; f++, p += 3) + sprintf(p, "%02hhX ", (unsigned char)data[f]); + + printf("%s: %s\n", text, s); +} +#endif + + +/** + * milenage_f1 - Milenage f1 and f1* algorithms + * @opc: OPc = 128-bit value derived from OP and K + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @sqn: SQN = 48-bit sequence number + * @amf: AMF = 16-bit authentication management field + * @mac_a: Buffer for MAC-A = 64-bit network authentication code, or %NULL + * @mac_s: Buffer for MAC-S = 64-bit resync authentication code, or %NULL + * Returns: 0 on success, -1 on failure + */ +int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand, + const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s) +{ + u8 tmp1[16], tmp2[16], tmp3[16]; + int i; + + /* tmp1 = TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp1[i] = _rand[i] ^ opc[i]; + if (aes_128_encrypt_block(k, tmp1, tmp1)) + return -1; + + /* tmp2 = IN1 = SQN || AMF || SQN || AMF */ + memcpy(tmp2, sqn, 6); + memcpy(tmp2 + 6, amf, 2); + memcpy(tmp2 + 8, tmp2, 8); + + /* OUT1 = E_K(TEMP XOR rot(IN1 XOR OP_C, r1) XOR c1) XOR OP_C */ + + /* rotate (tmp2 XOR OP_C) by r1 (= 0x40 = 8 bytes) */ + for (i = 0; i < 16; i++) + tmp3[(i + 8) % 16] = tmp2[i] ^ opc[i]; + /* XOR with TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp3[i] ^= tmp1[i]; + /* XOR with c1 (= ..00, i.e., NOP) */ + + /* f1 || f1* = E_K(tmp3) XOR OP_c */ + if (aes_128_encrypt_block(k, tmp3, tmp1)) + return -1; + for (i = 0; i < 16; i++) + tmp1[i] ^= opc[i]; + if (mac_a) + memcpy(mac_a, tmp1, 8); /* f1 */ + if (mac_s) + memcpy(mac_s, tmp1 + 8, 8); /* f1* */ + return 0; +} + + +/** + * milenage_f2345 - Milenage f2, f3, f4, f5, f5* algorithms + * @opc: OPc = 128-bit value derived from OP and K + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ak: Buffer for AK = 48-bit anonymity key (f5), or %NULL + * @akstar: Buffer for AK = 48-bit anonymity key (f5*), or %NULL + * Returns: 0 on success, -1 on failure + */ +int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand, + u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar) +{ + u8 tmp1[16], tmp2[16], tmp3[16]; + int i; + + /* tmp2 = TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp1[i] = _rand[i] ^ opc[i]; + if (aes_128_encrypt_block(k, tmp1, tmp2)) + return -1; + + /* OUT2 = E_K(rot(TEMP XOR OP_C, r2) XOR c2) XOR OP_C */ + /* OUT3 = E_K(rot(TEMP XOR OP_C, r3) XOR c3) XOR OP_C */ + /* OUT4 = E_K(rot(TEMP XOR OP_C, r4) XOR c4) XOR OP_C */ + /* OUT5 = E_K(rot(TEMP XOR OP_C, r5) XOR c5) XOR OP_C */ + + /* f2 and f5 */ + /* rotate by r2 (= 0, i.e., NOP) */ + for (i = 0; i < 16; i++) + tmp1[i] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 1; /* XOR c2 (= ..01) */ + /* f5 || f2 = E_K(tmp1) XOR OP_c */ + if (aes_128_encrypt_block(k, tmp1, tmp3)) + return -1; + for (i = 0; i < 16; i++) + tmp3[i] ^= opc[i]; + if (res) + memcpy(res, tmp3 + 8, 8); /* f2 */ + if (ak) + memcpy(ak, tmp3, 6); /* f5 */ + + /* f3 */ + if (ck) { + /* rotate by r3 = 0x20 = 4 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 12) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 2; /* XOR c3 (= ..02) */ + if (aes_128_encrypt_block(k, tmp1, ck)) + return -1; + for (i = 0; i < 16; i++) + ck[i] ^= opc[i]; + } + + /* f4 */ + if (ik) { + /* rotate by r4 = 0x40 = 8 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 8) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 4; /* XOR c4 (= ..04) */ + if (aes_128_encrypt_block(k, tmp1, ik)) + return -1; + for (i = 0; i < 16; i++) + ik[i] ^= opc[i]; + } + + /* f5* */ + if (akstar) { + /* rotate by r5 = 0x60 = 12 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 4) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 8; /* XOR c5 (= ..08) */ + if (aes_128_encrypt_block(k, tmp1, tmp1)) + return -1; + for (i = 0; i < 6; i++) + akstar[i] = tmp1[i] ^ opc[i]; + } + + return 0; +} + + +/** + * milenage_generate - Generate AKA AUTN,IK,CK,RES + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @amf: AMF = 16-bit authentication management field + * @k: K = 128-bit subscriber key + * @sqn: SQN = 48-bit sequence number + * @_rand: RAND = 128-bit random challenge + * @autn: Buffer for AUTN = 128-bit authentication token + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @res_len: Max length for res; set to used length or 0 on failure + */ +void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k, + const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik, + u8 *ck, u8 *res, size_t *res_len) +{ + int i; + u8 mac_a[8], ak[6]; + + if (*res_len < 8) { + *res_len = 0; + return; + } + if (milenage_f1(opc, k, _rand, sqn, amf, mac_a, NULL) || + milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) { + *res_len = 0; + return; + } + *res_len = 8; + + /* AUTN = (SQN ^ AK) || AMF || MAC */ + for (i = 0; i < 6; i++) + autn[i] = sqn[i] ^ ak[i]; + memcpy(autn + 6, amf, 2); + memcpy(autn + 8, mac_a, 8); +} + + +/** + * milenage_auts - Milenage AUTS validation + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @auts: AUTS = 112-bit authentication token from client + * @sqn: Buffer for SQN = 48-bit sequence number + * Returns: 0 = success (sqn filled), -1 on failure + */ +int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts, + u8 *sqn) +{ + u8 amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ + u8 ak[6], mac_s[8]; + int i; + + if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) + return -1; + for (i = 0; i < 6; i++) + sqn[i] = auts[i] ^ ak[i]; + if (milenage_f1(opc, k, _rand, sqn, amf, NULL, mac_s) || + memcmp(mac_s, auts + 6, 8) != 0) + return -1; + return 0; +} + + +/** + * gsm_milenage - Generate GSM-Milenage (3GPP TS 55.205) authentication triplet + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @sres: Buffer for SRES = 32-bit SRES + * @kc: Buffer for Kc = 64-bit Kc + * Returns: 0 on success, -1 on failure + */ +int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc) +{ + u8 res[8], ck[16], ik[16]; + int i; + + if (milenage_f2345(opc, k, _rand, res, ck, ik, NULL, NULL)) + return -1; + + for (i = 0; i < 8; i++) + kc[i] = ck[i] ^ ck[i + 8] ^ ik[i] ^ ik[i + 8]; + +#ifdef GSM_MILENAGE_ALT_SRES + memcpy(sres, res, 4); +#else /* GSM_MILENAGE_ALT_SRES */ + for (i = 0; i < 4; i++) + sres[i] = res[i] ^ res[i + 4]; +#endif /* GSM_MILENAGE_ALT_SRES */ + return 0; +} + + +/** + * milenage_generate - Generate AKA AUTN,IK,CK,RES + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @sqn: SQN = 48-bit sequence number + * @_rand: RAND = 128-bit random challenge + * @autn: AUTN = 128-bit authentication token + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @res_len: Variable that will be set to RES length + * @auts: 112-bit buffer for AUTS + * Returns: 0 on success, -1 on failure, or -2 on synchronization failure + */ +int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand, + const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len, + u8 *auts) +{ + int i; + u8 mac_a[8], ak[6], rx_sqn[6]; + const u8 *amf; + +#ifdef DEBUG + hexdump("Milenage: OPC", opc, 16); + hexdump("Milenage: K", k, 16); + hexdump("Milenage: AUTN", autn, 16); + hexdump("Milenage: RAND", _rand, 16); +#endif + + if (milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) + return -1; + + *res_len = 8; +#ifdef DEBUG + hexdump("Milenage: RES", res, *res_len); + hexdump("Milenage: CK", ck, 16); + hexdump("Milenage: IK", ik, 16); + hexdump("Milenage: AK", ak, 6); +#endif + + /* AUTN = (SQN ^ AK) || AMF || MAC */ + for (i = 0; i < 6; i++) + rx_sqn[i] = autn[i] ^ ak[i]; +#ifdef DEBUG + hexdump("Milenage: RX SQN", rx_sqn, 6); + hexdump("Milenage: SQN", sqn, 6); +#endif + + if (memcmp(rx_sqn, sqn, 6) <= 0) { + u8 auts_amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ + if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) + return -1; +#ifdef DEBUG + hexdump("Milenage: AK*", ak, 6); +#endif + for (i = 0; i < 6; i++) + auts[i] = sqn[i] ^ ak[i]; + if (milenage_f1(opc, k, _rand, sqn, auts_amf, NULL, auts + 6)) + return -1; +#ifdef DEBUG + hexdump("Milenage: AUTS", auts, 14); +#endif + return -2; + } + + amf = autn + 6; +#ifdef DEBUG + hexdump("Milenage: AMF", amf, 2); +#endif + if (milenage_f1(opc, k, _rand, rx_sqn, amf, mac_a, NULL)) + return -1; + +#ifdef DEBUG + hexdump("Milenage: MAC_A", mac_a, 8); +#endif + + if (memcmp(mac_a, autn + 8, 8) != 0) { +#ifdef DEBUG + hexdump("Milenage: MAC mismatch, Received MAC_A", + autn + 8, 8); +#endif + return -1; + } + + return 0; +} diff --git a/library/milenage/milenage.h b/library/milenage/milenage.h new file mode 100644 index 0000000..238df62 --- /dev/null +++ b/library/milenage/milenage.h @@ -0,0 +1,22 @@ + +#include <stdint.h> +#include <stddef.h> +#include <string.h> + +typedef uint8_t u8; +typedef uint16_t u16; +typedef uint32_t u32; + +int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand, + const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s); +int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand, + u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar); +void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k, + const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik, + u8 *ck, u8 *res, size_t *res_len); +int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts, + u8 *sqn); +int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc); +int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand, + const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len, + u8 *auts); diff --git a/library/ng_crypto/key_derivation.c b/library/ng_crypto/key_derivation.c new file mode 100644 index 0000000..29e0849 --- /dev/null +++ b/library/ng_crypto/key_derivation.c @@ -0,0 +1,49 @@ +#include <stdint.h> +#include <string.h> +#include <arpa/inet.h> +#include <gnutls/crypto.h> + +#include "key_derivation.h" + +/* 3GPP TS 33.501 A.4 RES* and XRES* derivation function */ +void kdf_xres_star(const uint8_t *serving_network_name, + uint16_t serving_network_name_len, + const uint8_t *ck, + const uint8_t *ik, + const uint8_t *rand, + const uint8_t *xres, size_t xres_len, + uint8_t *out) +{ + uint8_t s[1024]; + uint8_t key[16*2]; + uint8_t tmp_out[32]; + size_t pos = 0; + uint16_t lenbe; + + memcpy(key, ck, 16); + memcpy(key+16, ik, 16); + + s[pos++] = 0x6B; /* FC Value */ + + memcpy(&s[pos], serving_network_name, serving_network_name_len); + pos += serving_network_name_len; + lenbe = htons(serving_network_name_len); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + memcpy(&s[pos], rand, 16); + pos += 16; + lenbe = htons(16); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + memcpy(&s[pos], xres, xres_len); + pos += xres_len; + lenbe = htons(xres_len); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + gnutls_hmac_fast(GNUTLS_MAC_SHA256, key, sizeof(key), s, pos, tmp_out); + + memcpy(out, tmp_out+16, 16); +} diff --git a/library/ng_crypto/key_derivation.h b/library/ng_crypto/key_derivation.h new file mode 100644 index 0000000..f78d746 --- /dev/null +++ b/library/ng_crypto/key_derivation.h @@ -0,0 +1,12 @@ +#pragma once + +#include <stdint.h> +#include <unistd.h> + +void kdf_xres_star(const uint8_t *serving_network_name, + uint16_t serving_network_name_len, + const uint8_t *ck, + const uint8_t *ik, + const uint8_t *rand, + const uint8_t *xres, size_t xres_len, + uint8_t *out); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40413?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I11527f47e4310863124f3f02148e3f71da7d911e Gerrit-Change-Number: 40413 Gerrit-PatchSet: 9 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[L] Change in ...osmo-s1gw[master]: enft_kpi: retrieve per-eNB traffic counters

by fixeria

Attention is currently required from: fixeria, laforge, pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40281?usp=email to look at the new patch set (#9). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by pespin, Verified+1 by Jenkins Builder Change subject: enft_kpi: retrieve per-eNB traffic counters ...................................................................... enft_kpi: retrieve per-eNB traffic counters Change-Id: I498d2854447a2d53d2abddd38652f3e2bbb1fbdd Related: SYS#7307 --- M config/sys.config M debian/control M include/s1gw_metrics.hrl M rebar.config M rebar.lock A src/enft_kpi.erl M src/osmo_s1gw.app.src M src/osmo_s1gw_sup.erl M src/s1ap_proxy.erl M test/s1ap_proxy_test.erl 10 files changed, 684 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/81/40281/9 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40281?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: I498d2854447a2d53d2abddd38652f3e2bbb1fbdd Gerrit-Change-Number: 40281 Gerrit-PatchSet: 9 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[L] Change in ...osmo-s1gw[master]: enft_kpi: support different UL/DL GTP-U addresses

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40437?usp=email ) Change subject: enft_kpi: support different UL/DL GTP-U addresses ...................................................................... enft_kpi: support different UL/DL GTP-U addresses Change-Id: Icd4a17790062bfcaf2bccb01fa94dcdb65c0872c Related: SYS#7307 --- M src/enft_kpi.erl M src/s1ap_proxy.erl 2 files changed, 156 insertions(+), 113 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/37/40437/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index 015956c..9b4caf1 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -72,14 +72,22 @@ -type counters() :: dict:dict(K :: string(), V :: counter()). +-type uldl() :: ul | dl. + +-type uldl_addr() :: {ULDL :: uldl(), + Addr :: string()}. + +-type enb_uldl_state() :: #{uldl => uldl(), + addr => string(), + handle => integer(), + ctr => counter() + }. + -type enb_state() :: #{pid => pid(), - addr => string(), genb_id => string(), mon_ref => reference(), - handle_ul => integer(), - handle_dl => integer(), - ctr_ul => counter(), %% UL counters - ctr_dl => counter() %% DL counters + ul => enb_uldl_state(), %% Uplink data + dl => enb_uldl_state() %% Downlink data }. -type registry() :: dict:dict(K :: pid(), @@ -109,10 +117,11 @@ gen_server:call(?MODULE, {?FUNCTION_NAME, GlobalENBId}). --spec enb_set_addr(Addr) -> ok | {error, term()} - when Addr :: string(). -enb_set_addr(Addr) -> - gen_server:call(?MODULE, {?FUNCTION_NAME, Addr}). +-spec enb_set_addr(ULDLAddr) -> ok | {error, term()} + when ULDLAddr :: uldl_addr(). +enb_set_addr(ULDLAddr) -> + %% TODO: use cast here to avoid blocking + gen_server:call(?MODULE, {?FUNCTION_NAME, ULDLAddr}). -spec enb_unregister() -> ok | {error, term()}. @@ -194,15 +203,30 @@ {reply, ok, S#state{registry = R1}} end; -handle_call({enb_set_addr, Addr}, {Pid, _Ref}, +handle_call({enb_set_addr, {ULDL, Addr}}, {Pid, _Ref}, #state{registry = R} = S0) -> case dict:find(Pid, R) of - {ok, EnbState} -> - {Reply, S1} = enb_set_addr(Addr, EnbState, S0), + %% the given UL/DL Addr is already known + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := Addr}}} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", + [Pid, GlobalENBId, ULDL, Addr]), + {reply, ok, S0}; + %% the given UL/DL Addr differs from stored Addr + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := OldAddr}}} -> + ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", + [Pid, GlobalENBId, ULDL, OldAddr, Addr]), + {reply, {error, addr_mismatch}, S0}; + %% UL/DL state is missing => create it + {ok, #{genb_id := GlobalENBId} = ES} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " + "creating NFT counters and rules", + [Pid, GlobalENBId, ULDL, Addr]), + {Reply, S1} = enb_set_addr({ULDL, Addr}, ES, S0), {reply, Reply, S1}; error -> - ?LOG_ERROR("eNB @ ~p (pid ~p) is *not* registered", - [Addr, Pid]), + ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), {reply, {error, not_registered}, S0} end; @@ -303,107 +327,108 @@ enb_add_metrics(GlobalENBId, ul), enb_add_metrics(GlobalENBId, dl). -enb_add_metrics(GlobalENBId, UDL) -> +enb_add_metrics(GlobalENBId, ULDL) -> %% counters may already exist, so catch exceptions here - catch exometer:new(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, UDL), counter), - catch exometer:new(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, UDL), counter), - catch exometer:new(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, UDL), counter). + catch exometer:new(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, ULDL), counter), + catch exometer:new(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, ULDL), counter), + catch exometer:new(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, ULDL), counter). --spec enb_set_addr(Addr, ES, S0) -> {Reply, S1} - when Addr :: string(), +-spec enb_set_addr(ULDLAddr, ES, S0) -> {Reply, S1} + when ULDLAddr :: uldl_addr(), ES :: enb_state(), S0 :: #state{}, S1 :: #state{}, Reply :: ok | {error, term()}. -enb_set_addr(Addr, %% given Addr matches stored Addr +enb_set_addr({ULDL, Addr}, #{genb_id := GlobalENBId, - addr := Addr, - pid := Pid}, S) -> - ?LOG_DEBUG("eNB @ ~p (pid ~p, ~p): address is already known", - [Addr, Pid, GlobalENBId]), - {ok, S}; - -enb_set_addr(NewAddr, %% given NewAddr differs from stored Addr - #{genb_id := GlobalENBId, - addr := Addr, - pid := Pid}, S) -> - ?LOG_ERROR("eNB @ ~p (pid ~p, ~p): address (~p) mismatch?!?", - [Addr, Pid, GlobalENBId, NewAddr]), - {{error, addr_mismatch}, S}; - -enb_set_addr(Addr, #{genb_id := GlobalENBId, - pid := Pid} = ES0, + pid := Pid} = ES0, #state{cfg = Cfg, registry = R0} = S) -> - ?LOG_DEBUG("eNB @ ~p (pid ~p, ~p): " - "address indicated, creating NFT rules/counters", - [Addr, Pid, GlobalENBId]), - case enb_add_nft_counters(ES0#{addr => Addr}, Cfg) of - {ok, ES1} -> + case enb_add_nft_counter({ULDL, Addr}, GlobalENBId, Cfg) of + {ok, Handle} -> + ?LOG_INFO("eNB (pid ~p, ~p): NFT rules/counters created for ~p", + [Pid, GlobalENBId, ULDL]), + %% store an updated eNB state to the registry + ES1 = ES0#{ULDL => #{uldl => ULDL, + addr => Addr, + handle => Handle, + ctr => #ctr{}}}, R1 = dict:store(Pid, ES1, R0), - ?LOG_INFO("eNB @ ~p (pid ~p, ~p): " - "NFT rules/counters created (KPI ready)", - [Addr, Pid, GlobalENBId]), {ok, S#state{registry = R1}}; {error, Error} -> - ?LOG_ERROR("eNB @ ~p (pid ~p, ~p): " - "creating NFT rules/counters failed: ~p", - [Addr, Pid, GlobalENBId, Error]), + ?LOG_ERROR("eNB (pid ~p, ~p): creating NFT rules/counters failed: ~p", + [Pid, GlobalENBId, Error]), {{error, Error}, S} end. --spec enb_add_nft_counters(ES0, Cfg) -> {ok, ES1} | {error, term()} - when ES0 :: enb_state(), - ES1 :: enb_state(), - Cfg :: cfg(). -enb_add_nft_counters(#{addr := Addr, - genb_id := GlobalENBId} = ES0, - #{table_name := TName}) -> - RUL = [nft_expr_match_ip_saddr(Addr, ?OP_EQ), - nft_expr_counter("ul-" ++ GlobalENBId)], - RDL = [nft_expr_match_ip_daddr(Addr, ?OP_EQ), - nft_expr_counter("dl-" ++ GlobalENBId)], - Cmds = [nft_cmd_add_counter(TName, "ul-" ++ GlobalENBId), - nft_cmd_add_counter(TName, "dl-" ++ GlobalENBId), - nft_cmd_add_rule(TName, "gtpu-ul", RUL), - nft_cmd_add_rule(TName, "gtpu-dl", RDL) +enb_nft_counter_name(ul, GlobalENBId) -> "ul-" ++ GlobalENBId; +enb_nft_counter_name(dl, GlobalENBId) -> "dl-" ++ GlobalENBId. + +enb_nft_rule_name(ul) -> "gtpu-ul"; +enb_nft_rule_name(dl) -> "gtpu-dl". + + +-spec enb_add_nft_counter(ULDLAddr, GlobalENBId, Cfg) -> {ok, Handle} | {error, term()} + when ULDLAddr :: uldl_addr(), + GlobalENBId :: string(), + Cfg :: cfg(), + Handle :: integer(). +enb_add_nft_counter({ULDL, Addr}, GlobalENBId, + #{table_name := TName}) -> + CName = enb_nft_counter_name(ULDL, GlobalENBId), + RName = enb_nft_rule_name(ULDL), + Rule = [nft_expr_match_ip_addr({ULDL, Addr}), + nft_expr_counter(CName)], + Cmds = [nft_cmd_add_counter(TName, CName), + nft_cmd_add_rule(TName, RName, Rule) ], case nft_exec(Cmds) of ok -> - ULH = nft_chain_last_handle(TName, "gtpu-ul"), - DLH = nft_chain_last_handle(TName, "gtpu-dl"), - %% update the eNB state with new info - ES1 = ES0#{handle_ul => ULH, - handle_dl => DLH, - ctr_ul => #ctr{}, - ctr_dl => #ctr{}}, - {ok, ES1}; + Handle = nft_chain_last_handle(TName, RName), + {ok, Handle}; {error, Error} -> ?LOG_ERROR("~p() failed: ~p", [?FUNCTION_NAME, Error]), {error, Error} end. --spec enb_del_nft_counters(enb_state(), cfg()) -> ok | {error, term()}. -enb_del_nft_counters(#{genb_id := GlobalENBId, - handle_ul := ULH, - handle_dl := DLH}, - #{table_name := TName}) -> - Cmds = [nft_cmd_del_rule(TName, "gtpu-ul", ULH), - nft_cmd_del_rule(TName, "gtpu-dl", DLH), - nft_cmd_del_counter(TName, "ul-" ++ GlobalENBId), - nft_cmd_del_counter(TName, "dl-" ++ GlobalENBId) +-spec enb_del_nft_counters(ES0, Cfg) -> ES1 + when Cfg :: cfg(), + ES0 :: enb_state(), + ES1 :: enb_state(). +enb_del_nft_counters(#{ul := ULS} = ES, Cfg) -> + enb_del_nft_counter(ULS, ES, Cfg), + enb_del_nft_counters(maps:remove(ul, ES), Cfg); + +enb_del_nft_counters(#{dl := DLS} = ES, Cfg) -> + enb_del_nft_counter(DLS, ES, Cfg), + enb_del_nft_counters(maps:remove(dl, ES), Cfg); + +%% no UL/DL state => nothing to delete +enb_del_nft_counters(ES, _Cfg) -> ES. + + +-spec enb_del_nft_counter(S, ES, Cfg) -> ok | {error, term()} + when S :: enb_uldl_state(), + ES :: enb_state(), + Cfg :: cfg(). +enb_del_nft_counter(#{uldl := ULDL, handle := Handle}, + #{genb_id := GlobalENBId, pid := Pid}, + #{table_name := TName}) -> + ?LOG_DEBUG("eNB (pid ~p, ~p): deleting NFT counter for ~p", + [Pid, GlobalENBId, ULDL]), + CName = enb_nft_counter_name(ULDL, GlobalENBId), + RName = enb_nft_rule_name(ULDL), + Cmds = [nft_cmd_del_rule(TName, RName, Handle), + nft_cmd_del_counter(TName, CName) ], case nft_exec(Cmds) of ok -> ok; {error, Error} -> ?LOG_ERROR("~p() failed: ~p", [?FUNCTION_NAME, Error]), {error, Error} - end; - -%% missing ULH/DLH => nothing to delete -enb_del_nft_counters(_ES, _Cfg) -> ok. + end. %% Parse the given list of NFT counters (result of nft_cmd_list_counters()). @@ -437,51 +462,59 @@ R1 :: registry(). %% (new) registry of eNBs report_nft_counters(Ctrs, R0) -> %% for each registered eNB, look-up and report UL/DL counters - dict:map(fun(_Pid, EnbState) -> enb_report_nft_counters(Ctrs, EnbState) end, R0). + dict:map(fun(_Pid, ES) -> enb_report_nft_counters(Ctrs, ES) end, R0). -spec enb_report_nft_counters(counters(), enb_state()) -> enb_state(). -enb_report_nft_counters(Ctrs, #{genb_id := GlobalENBId, - ctr_ul := ULC, - ctr_dl := DLC} = ES) -> - ?LOG_DEBUG("Reporting NFT counters for eNB ~p", [GlobalENBId]), - ES#{ctr_ul => report_nft_counter(Ctrs, {ul, GlobalENBId}, ULC), - ctr_dl => report_nft_counter(Ctrs, {dl, GlobalENBId}, DLC)}; +enb_report_nft_counters(Ctrs, #{ul := ULS, + dl := DLS} = ES) -> + %% report both UL and DL counters + ES#{ul => enb_report_nft_counters(Ctrs, ES, ULS), + dl => enb_report_nft_counters(Ctrs, ES, DLS)}; -%% missing ULH/DLH => nothing to report +enb_report_nft_counters(Ctrs, #{ul := ULS} = ES) -> + %% report UL counters only + ES#{ul => enb_report_nft_counters(Ctrs, ES, ULS)}; + +enb_report_nft_counters(Ctrs, #{dl := DLS} = ES) -> + %% report DL counters only + ES#{dl => enb_report_nft_counters(Ctrs, ES, DLS)}; + +%% no UL/DL state => nothing to report enb_report_nft_counters(_Ctrs, ES) -> ES. --spec report_nft_counter(Ctrs, {UDL, GlobalENBId}, C0) -> C1 +-spec enb_report_nft_counters(Ctrs, ES, S0) -> S1 when Ctrs :: counters(), - UDL :: ul | dl, - GlobalENBId :: string(), - C0 :: counter(), - C1 :: counter(). -report_nft_counter(Ctrs, {UDL, GlobalENBId}, C0) -> - CtrName = atom_to_list(UDL) ++ "-" ++ GlobalENBId, + ES :: enb_state(), + S0 :: enb_uldl_state(), + S1 :: enb_uldl_state(). +enb_report_nft_counters(Ctrs, + #{genb_id := GlobalENBId, pid := Pid}, + #{uldl := ULDL, ctr := C0} = S) -> + CtrName = enb_nft_counter_name(ULDL, GlobalENBId), case dict:find(CtrName, Ctrs) of {ok, C0} -> %% no diff, nothing to report - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: ~p", - [UDL, GlobalENBId, C0]), - C0; + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): ~p", + [ULDL, Pid, GlobalENBId, C0]), + S; {ok, C1} -> %% XXX: assuming C1 (new) values >= C0 (cached) values - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: ~p -> ~p", - [UDL, GlobalENBId, C0, C1]), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, UDL), + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): ~p -> ~p", + [ULDL, Pid, GlobalENBId, C0, C1]), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, ULDL), C1#ctr.packets - C0#ctr.packets), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, UDL), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, ULDL), C1#ctr.bytes_ue - C0#ctr.bytes_ue), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, UDL), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, ULDL), C1#ctr.bytes_total - C0#ctr.bytes_total), - C1; + S#{ctr => C1}; error -> %% no counters for this eNB (yet?) - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: nope", - [UDL, GlobalENBId]), - C0 + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): nope", + [ULDL, Pid, GlobalENBId]), + S end. @@ -591,6 +624,14 @@ nft_expr_match_payload({"udp", "dport"}, Port, Op). +-spec nft_expr_match_ip_addr(uldl_addr()) -> map(). +nft_expr_match_ip_addr({ul, Addr}) -> + nft_expr_match_ip_saddr(Addr, ?OP_EQ); + +nft_expr_match_ip_addr({dl, Addr}) -> + nft_expr_match_ip_daddr(Addr, ?OP_EQ). + + nft_expr_accept() -> #{accept => null}. diff --git a/src/s1ap_proxy.erl b/src/s1ap_proxy.erl index 85a2e80..6f63e4c 100644 --- a/src/s1ap_proxy.erl +++ b/src/s1ap_proxy.erl @@ -652,7 +652,8 @@ 'transportLayerAddress' = TLA_In, 'gTP-TEID' = << TEID_In:32/big >>} = C0, S) -> %% indicate eNB's address to the enft_kpi module - enft_kpi:enb_set_addr(tla_str(TLA_In)), + enft_kpi:enb_set_addr({ul, tla_str(TLA_In)}), + enft_kpi:enb_set_addr({dl, tla_str(TLA_In)}), %% poke E-RAB FSM case erab_fsm_find(ERABId, S) of {ok, Pid} -> @@ -941,7 +942,8 @@ 'transportLayerAddress' = TLA_In, 'gTP-TEID' = << TEID_In:32/big >>} = C0, S) -> %% indicate eNB's address to the enft_kpi module - enft_kpi:enb_set_addr(tla_str(TLA_In)), + enft_kpi:enb_set_addr({ul, tla_str(TLA_In)}), + enft_kpi:enb_set_addr({dl, tla_str(TLA_In)}), %% poke E-RAB FSM case erab_fsm_find(ERABId, S) of {ok, Pid} -> -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40437?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: Icd4a17790062bfcaf2bccb01fa94dcdb65c0872c Gerrit-Change-Number: 40437 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[M] Change in ...osmo-s1gw[master]: enft_kpi: make enb_set_addr/1 non-blocking

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40438?usp=email ) Change subject: enft_kpi: make enb_set_addr/1 non-blocking ...................................................................... enft_kpi: make enb_set_addr/1 non-blocking This function is called each time a new E-REB is established, while the result, be it success or failure, does not matter to s1ap_proxy. Use gen_server:cast/2 instead of gen_server:call/2 to avoid blocking. Change-Id: Iacd380f66fc0249a6a645293abd5aac9cdba34d5 Related: SYS#7307 --- M src/enft_kpi.erl 1 file changed, 29 insertions(+), 30 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/38/40438/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index 9b4caf1..d5d5ce3 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -117,11 +117,10 @@ gen_server:call(?MODULE, {?FUNCTION_NAME, GlobalENBId}). --spec enb_set_addr(ULDLAddr) -> ok | {error, term()} +-spec enb_set_addr(ULDLAddr) -> ok when ULDLAddr :: uldl_addr(). enb_set_addr(ULDLAddr) -> - %% TODO: use cast here to avoid blocking - gen_server:call(?MODULE, {?FUNCTION_NAME, ULDLAddr}). + gen_server:cast(?MODULE, {?FUNCTION_NAME, self(), ULDLAddr}). -spec enb_unregister() -> ok | {error, term()}. @@ -203,33 +202,6 @@ {reply, ok, S#state{registry = R1}} end; -handle_call({enb_set_addr, {ULDL, Addr}}, {Pid, _Ref}, - #state{registry = R} = S0) -> - case dict:find(Pid, R) of - %% the given UL/DL Addr is already known - {ok, #{genb_id := GlobalENBId, - ULDL := #{addr := Addr}}} -> - ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", - [Pid, GlobalENBId, ULDL, Addr]), - {reply, ok, S0}; - %% the given UL/DL Addr differs from stored Addr - {ok, #{genb_id := GlobalENBId, - ULDL := #{addr := OldAddr}}} -> - ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", - [Pid, GlobalENBId, ULDL, OldAddr, Addr]), - {reply, {error, addr_mismatch}, S0}; - %% UL/DL state is missing => create it - {ok, #{genb_id := GlobalENBId} = ES} -> - ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " - "creating NFT counters and rules", - [Pid, GlobalENBId, ULDL, Addr]), - {Reply, S1} = enb_set_addr({ULDL, Addr}, ES, S0), - {reply, Reply, S1}; - error -> - ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), - {reply, {error, not_registered}, S0} - end; - handle_call(enb_unregister, {Pid, _Ref}, #state{cfg = Cfg, registry = R0} = S) -> case dict:find(Pid, R0) of @@ -269,6 +241,33 @@ ?LOG_DEBUG("ignore ~p(): ~p", [?FUNCTION_NAME, Info]), {noreply, S}; +handle_cast({enb_set_addr, Pid, {ULDL, Addr}}, + #state{registry = R} = S0) -> + case dict:find(Pid, R) of + %% the given UL/DL Addr is already known + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := Addr}}} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", + [Pid, GlobalENBId, ULDL, Addr]), + {noreply, S0}; + %% the given UL/DL Addr differs from stored Addr + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := OldAddr}}} -> + ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", + [Pid, GlobalENBId, ULDL, OldAddr, Addr]), + {noreply, S0}; + %% UL/DL state is missing => create it + {ok, #{genb_id := GlobalENBId} = ES} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " + "creating NFT counters and rules", + [Pid, GlobalENBId, ULDL, Addr]), + {_, S1} = enb_set_addr({ULDL, Addr}, ES, S0), + {noreply, S1}; + error -> + ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), + {noreply, S0} + end; + handle_cast(report_nft_counters, #state{cfg = #{table_name := TName}, registry = R0} = S) -> -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40438?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: Iacd380f66fc0249a6a645293abd5aac9cdba34d5 Gerrit-Change-Number: 40438 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[M] Change in ...osmo-s1gw[master]: enft_kpi: use command/expression templates from enftables

by fixeria

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40439?usp=email ) Change subject: enft_kpi: use command/expression templates from enftables ...................................................................... enft_kpi: use command/expression templates from enftables Change-Id: I421ba5ccc8956586136466d5eb50d6ace69eeb67 Related: SYS#7307 --- M src/enft_kpi.erl 1 file changed, 22 insertions(+), 116 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/39/40439/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index d5d5ce3..3afe9d5 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -147,15 +147,17 @@ TName = maps:get(table_name, Cfg, "osmo-s1gw"), Interval = maps:get(interval, Cfg, 3000), %% ignore (accept) anything but GTPU @ udp/2152 - R1 = [nft_expr_match_ip_proto("udp", ?OP_NEQ), nft_expr_accept()], - R2 = [nft_expr_match_udp_dport(?GTPU_PORT, ?OP_NEQ), nft_expr_accept()], - Cmds = [nft_cmd_add_table(TName), + R1 = [enftables:nft_expr_match_ip_proto("udp", ?OP_NEQ), + enftables:nft_expr_accept()], + R2 = [enftables:nft_expr_match_udp_dport(?GTPU_PORT, ?OP_NEQ), + enftables:nft_expr_accept()], + Cmds = [enftables:nft_cmd_add_table(TName, [<< "owner" >>]), nft_cmd_add_chain(TName, "gtpu-ul", "prerouting"), nft_cmd_add_chain(TName, "gtpu-dl", "postrouting"), - nft_cmd_add_rule(TName, "gtpu-ul", R1), - nft_cmd_add_rule(TName, "gtpu-dl", R1), - nft_cmd_add_rule(TName, "gtpu-ul", R2), - nft_cmd_add_rule(TName, "gtpu-dl", R2) + enftables:nft_cmd_add_rule(TName, "gtpu-ul", R1), + enftables:nft_cmd_add_rule(TName, "gtpu-dl", R1), + enftables:nft_cmd_add_rule(TName, "gtpu-ul", R2), + enftables:nft_cmd_add_rule(TName, "gtpu-dl", R2) ], case nft_exec(Cmds) of ok -> @@ -221,7 +223,7 @@ handle_call(fetch_counters, _From, #state{cfg = #{table_name := TName}} = S) -> ?LOG_DEBUG("Fetching NFT counters"), - Cmds = [nft_cmd_list_counters(TName)], + Cmds = [enftables:nft_cmd_list_counters(TName)], case nft_exec(Cmds) of {ok, Res} -> Ctrs = parse_nft_counters(Res), @@ -272,7 +274,7 @@ #state{cfg = #{table_name := TName}, registry = R0} = S) -> ?LOG_DEBUG("Fetching and reporting NFT counters"), - Cmds = [nft_cmd_list_counters(TName)], + Cmds = [enftables:nft_cmd_list_counters(TName)], case nft_exec(Cmds) of {ok, Res} -> Ctrs = parse_nft_counters(Res), @@ -312,7 +314,7 @@ ?LOG_NOTICE("Terminating, reason ~p", [Reason]), case Cfg of #{enable := true, table_name := TName} -> - nft_exec([nft_cmd_del_table(TName)]), %% delete the table + nft_exec([enftables:nft_cmd_del_table(TName)]), %% delete the table ok; _ -> ok %% stub mode end. @@ -377,10 +379,11 @@ #{table_name := TName}) -> CName = enb_nft_counter_name(ULDL, GlobalENBId), RName = enb_nft_rule_name(ULDL), + Counter = enftables:nft_counter(TName, CName), Rule = [nft_expr_match_ip_addr({ULDL, Addr}), - nft_expr_counter(CName)], - Cmds = [nft_cmd_add_counter(TName, CName), - nft_cmd_add_rule(TName, RName, Rule) + enftables:nft_expr_counter(CName)], + Cmds = [enftables:nft_cmd_add_counter(Counter), + enftables:nft_cmd_add_rule(TName, RName, Rule) ], case nft_exec(Cmds) of ok -> @@ -419,8 +422,9 @@ [Pid, GlobalENBId, ULDL]), CName = enb_nft_counter_name(ULDL, GlobalENBId), RName = enb_nft_rule_name(ULDL), - Cmds = [nft_cmd_del_rule(TName, RName, Handle), - nft_cmd_del_counter(TName, CName) + Counter = enftables:nft_counter(TName, CName), + Cmds = [enftables:nft_cmd_del_rule(TName, RName, Handle), + enftables:nft_cmd_del_counter(Counter) ], case nft_exec(Cmds) of ok -> ok; @@ -525,7 +529,7 @@ nft_chain_last_handle(TName, CName) -> - Cmds = [nft_cmd_list_chain(TName, CName)], + Cmds = [enftables:nft_cmd_list_chain(TName, CName)], case nft_exec(Cmds) of {ok, Res} -> #{<< "rule" >> := Rule} = lists:last(Res), @@ -536,21 +540,6 @@ end. -nft_cmd_add_table(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName), - flags => [<< "owner" >>] - }, - #{add => #{table => T}}. - - -nft_cmd_del_table(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName) - }, - #{delete => #{table => T}}. - - nft_cmd_add_chain(TName, CName, Hook) -> C = #{family => << "inet" >>, table => list_to_binary(TName), @@ -563,95 +552,12 @@ #{add => #{chain => C}}. -nft_cmd_add_rule(TName, CName, Expr) -> - R = #{family => << "inet" >>, - table => list_to_binary(TName), - chain => list_to_binary(CName), - expr => Expr - }, - #{add => #{rule => R}}. - - -nft_cmd_del_rule(TName, CName, Handle) -> - R = #{family => << "inet" >>, - table => list_to_binary(TName), - chain => list_to_binary(CName), - handle => Handle - }, - #{delete => #{rule => R}}. - - -nft_counter(TName, Name) -> - #{family => << "inet" >>, - table => list_to_binary(TName), - name => list_to_binary(Name) - }. - -nft_cmd_add_counter(TName, Name) -> - #{add => #{counter => nft_counter(TName, Name)}}. - -nft_cmd_del_counter(TName, Name) -> - #{delete => #{counter => nft_counter(TName, Name)}}. - - --spec nft_expr_match_payload({Proto, Field}, Value, Op) -> map() - when Proto :: string(), - Field :: string(), - Value :: term(), - Op :: string(). -nft_expr_match_payload({Proto, Field}, Value, Op) -> - Left = #{payload => #{protocol => list_to_binary(Proto), - field => list_to_binary(Field)}}, - #{match => #{left => Left, - right => Value, - op => list_to_binary(Op)}}. - - -nft_expr_match_ip_proto(Proto, Op) -> - nft_expr_match_payload({"ip", "protocol"}, - list_to_binary(Proto), Op). - -nft_expr_match_ip_saddr(Addr, Op) -> - nft_expr_match_payload({"ip", "saddr"}, - list_to_binary(Addr), Op). - -nft_expr_match_ip_daddr(Addr, Op) -> - nft_expr_match_payload({"ip", "daddr"}, - list_to_binary(Addr), Op). - -nft_expr_match_udp_dport(Port, Op) -> - nft_expr_match_payload({"udp", "dport"}, Port, Op). - - -spec nft_expr_match_ip_addr(uldl_addr()) -> map(). nft_expr_match_ip_addr({ul, Addr}) -> - nft_expr_match_ip_saddr(Addr, ?OP_EQ); + enftables:nft_expr_match_ip_saddr(Addr, ?OP_EQ); nft_expr_match_ip_addr({dl, Addr}) -> - nft_expr_match_ip_daddr(Addr, ?OP_EQ). - - -nft_expr_accept() -> - #{accept => null}. - - -nft_expr_counter(Name) -> - #{counter => list_to_binary(Name)}. - - -nft_cmd_list_chain(TName, CName) -> - C = #{family => << "inet" >>, - table => list_to_binary(TName), - name => list_to_binary(CName) - }, - #{list => #{chain => C}}. - - -nft_cmd_list_counters(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName) - }, - #{list => #{counters => #{table => T}}}. + enftables:nft_expr_match_ip_daddr(Addr, ?OP_EQ). -spec heartbeat(timeout()) -> no_return(). -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40439?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: I421ba5ccc8956586136466d5eb50d6ace69eeb67 Gerrit-Change-Number: 40439 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[M] Change in osmo-ci[master]: jobs/reminder-extend-obs-key: new job

by osmith

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40431?usp=email ) Change subject: jobs/reminder-extend-obs-key: new job ...................................................................... jobs/reminder-extend-obs-key: new job Add a script that downloads the current OBS pubkey, checks its expiration date and fails if it is in less than a year. The idea is to extend it for two years every year (so users have enough time to update their osmocom-keyring package). Change-Id: I934282efbe1fe3bd86813ad53df38ef79575bf8d --- A jobs/reminder-extend-obs-key.yml A scripts/reminder-extend-obs-key.sh 2 files changed, 84 insertions(+), 0 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, but someone else must approve osmith: Looks good to me, approved Jenkins Builder: Verified diff --git a/jobs/reminder-extend-obs-key.yml b/jobs/reminder-extend-obs-key.yml new file mode 100644 index 0000000..d2728dc --- /dev/null +++ b/jobs/reminder-extend-obs-key.yml @@ -0,0 +1,39 @@ +--- +- job: + name: 'reminder-extend-obs-key' + project-type: freestyle + concurrent: false + defaults: global + description: | + Reminder for extending the OBS key (OS#6567) + properties: + - build-discarder: + days-to-keep: 30 + num-to-keep: 30 + parameters: + - string: + name: BRANCH_OSMO_CI + description: | + osmo-ci.git branch with scripts/tarballs/publish-tarballs-for-tags.sh + default: 'master' + - string: + name: EMAIL_NOTIFICATIONS + description: For failed build notifications, set to empty to disable + default: 'jenkins-notifications(a)lists.osmocom.org' + builders: + - shell: | + PUBLISH=1 scripts/reminder-extend-obs-key.sh + scm: + - git: + branches: + - '$BRANCH_OSMO_CI' + url: https://gerrit.osmocom.org/osmo-ci + git-config-name: 'Jenkins Builder' + git-config-email: 'jenkins(a)osmocom.org' + wipe-workspace: true + triggers: + - timed: "@daily" + publishers: + - email: + notify-every-unstable-build: true + recipients: '$EMAIL_NOTIFICATIONS' diff --git a/scripts/reminder-extend-obs-key.sh b/scripts/reminder-extend-obs-key.sh new file mode 100755 index 0000000..2eeebb0 --- /dev/null +++ b/scripts/reminder-extend-obs-key.sh @@ -0,0 +1,45 @@ +#!/bin/sh -ex +mkdir -p _temp +cd _temp + +if ! [ -e public_key ]; then + wget -q https://obs.osmocom.org/projects/osmocom/public_key +fi + +gpg --show-keys public_key + +EXPIRATION_DATE="$(gpg --show-keys public_key | grep -o 'expires: [0-9-]*' | cut -d ' ' -f2)" +EXPIRATION_DATE_S="$(date -d "$EXPIRATION_DATE" +%s)" +ONE_YEAR_FROM_NOW="$(date -d "+356 days" +%Y-%m-%d)" +ONE_YEAR_FROM_NOW_S="$(date -d "$ONE_YEAR_FROM_NOW" +%s)" + +set +x + +if [ "$(echo "$EXPIRATION_DATE" | wc -l)" != 1 ] || [ "$EXPIRATION_DATE_S" -lt "$(date -d "2026-01-01" +%s)" ]; then + echo "Failed to get valid expiration date" + exit 1 +fi + +if [ "$ONE_YEAR_FROM_NOW_S" -lt "$(date -d "2026-01-01" +%s)" ]; then + echo "Failed to get date one year from now" + exit 1 +fi + +echo +echo "Checking if expiration date ($EXPIRATION_DATE) is in less than a year from now ($ONE_YEAR_FROM_NOW)..." + +if [ "$ONE_YEAR_FROM_NOW_S" -gt "$EXPIRATION_DATE_S" ]; then + echo + echo "=============================================================" + echo "The OBS signing key must be extended!" + echo + echo "Instructions:" + echo "https://osmocom.org/projects/osmocom-servers/wiki/OBS_server_setup#Extendin…" + echo + echo "The key becomes valid for 2 years, we extend it after 1 year." + echo "=============================================================" + echo + exit 1 +else + echo "=> OK" +fi -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40431?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I934282efbe1fe3bd86813ad53df38ef79575bf8d Gerrit-Change-Number: 40431 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[XS] Change in osmo-ci[master]: jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument

by osmith

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40425?usp=email ) Change subject: jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument ...................................................................... jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument Change-Id: I5009f7b722c7455ee6dfd25a6b5370929c9bc469 --- M jobs/osmocom-obs.yml 1 file changed, 5 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/jobs/osmocom-obs.yml b/jobs/osmocom-obs.yml index 39fa5fb..fd11055 100644 --- a/jobs/osmocom-obs.yml +++ b/jobs/osmocom-obs.yml @@ -44,6 +44,10 @@ name: BRANCH description: osmo-ci.git branch default: 'refs/remotes/origin/master' + - string: + name: EMAIL_NOTIFICATIONS + description: For failed job notifications, set to empty to disable + default: 'jenkins-notifications(a)lists.osmocom.org' builders: - shell: | export PYTHONUNBUFFERED=1 @@ -72,6 +76,6 @@ publishers: - email: notify-every-unstable-build: true - recipients: 'jenkins-notifications(a)lists.osmocom.org' + recipients: '$EMAIL_NOTIFICATIONS' # vim: expandtab tabstop=2 shiftwidth=2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40425?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I5009f7b722c7455ee6dfd25a6b5370929c9bc469 Gerrit-Change-Number: 40425 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[XS] Change in osmo-ci[master]: OBS: repo without manuals: fix draft removal logic

by osmith

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40426?usp=email ) Change subject: OBS: repo without manuals: fix draft removal logic ...................................................................... OBS: repo without manuals: fix draft removal logic Adjust set_asciidoc_style_without_draft_watermark() so it does not fail in repositories that do not have any manuals. Fixes: 3b348d5e ("OBS: remove pdf draft watermark for latest pkgs") Change-Id: Ie93430a1f7bd2bae6886e87755e79ff93ea609e7 --- M scripts/obs/lib/srcpkg.py 1 file changed, 3 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved diff --git a/scripts/obs/lib/srcpkg.py b/scripts/obs/lib/srcpkg.py index 6f4e613..3a09af3 100644 --- a/scripts/obs/lib/srcpkg.py +++ b/scripts/obs/lib/srcpkg.py @@ -169,10 +169,12 @@ def set_asciidoc_style_without_draft_watermark(project): repo_path = lib.git.get_repo_path(project) - doc_makefiles = lib.run_cmd(["grep", "-r", "-l", "include $(OSMO_GSM_MANUALS_DIR)/build/Makefile.asciidoc.inc"], cwd=repo_path) + doc_makefiles = lib.run_cmd(["grep", "-r", "-l", "include $(OSMO_GSM_MANUALS_DIR)/build/Makefile.asciidoc.inc"], cwd=repo_path, check=False) doc_makefiles = doc_makefiles.output.rstrip().split("\n") for doc_makefile in doc_makefiles: + if doc_makefile == "": + continue print(f"{project}: setting asciidoc style to remove draft watermark in {doc_makefile}") lib.run_cmd(["sed", "-i", '/\\/build\\/Makefile\\.asciidoc\\.inc/s/^/ ASCIIDOCSTYLE = $(BUILDDIR)\\/custom-dblatex.sty\\n/', -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40426?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Ie93430a1f7bd2bae6886e87755e79ff93ea609e7 Gerrit-Change-Number: 40426 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[XS] Change in osmo-ci[master]: OBS: remove libosmo-sccp-legacy

by osmith

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40427?usp=email ) Change subject: OBS: remove libosmo-sccp-legacy ...................................................................... OBS: remove libosmo-sccp-legacy Stop building libosmo-sccp-legacy, which is not needed anymore since osmo-msc 1.13.0 has been tagged some time ago. Change-Id: I086e3eff10e79bddd8ec23927b46cc58a7101de6 --- M scripts/obs/lib/config.py 1 file changed, 0 insertions(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/scripts/obs/lib/config.py b/scripts/obs/lib/config.py index c6f373e..dc67757 100644 --- a/scripts/obs/lib/config.py +++ b/scripts/obs/lib/config.py @@ -58,7 +58,6 @@ "libosmo-gprs", "libosmo-netif", "libosmo-pfcp", - "libosmo-sccp-legacy", # can be dropped after osmo-msc >= 1.12.x release "libosmo-sigtran", "libosmocore", "libsmpp34", -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40427?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I086e3eff10e79bddd8ec23927b46cc58a7101de6 Gerrit-Change-Number: 40427 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

[XS] Change in osmo-ci[master]: OBS: add the new osmocom-keyring package

by osmith

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40428?usp=email ) Change subject: OBS: add the new osmocom-keyring package ...................................................................... OBS: add the new osmocom-keyring package The public key for OBS packages needs to be extended every two years. When the previous key expires, it is not possible to update packages anymore until users replace the old key with the new, extended key. To make this less inconvenient for users, introduce a new osmocom-keyring package that holds the current key (valid for 2 years), which will get updated every year with an extended key (valid for another 2 years, I'll add a jenkins job to remind us). This means as long as users upgrade their packages once a year, they will automatically receive the new key. Related: https://gitea.osmocom.org/osmocom/osmocom-keyring Related: OS#6567 Change-Id: I370b4fa0c6f7e8a925b1ddd7c1c47980a8f4fea2 --- M scripts/obs/lib/config.py 1 file changed, 2 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved diff --git a/scripts/obs/lib/config.py b/scripts/obs/lib/config.py index dc67757..4d8bcd3 100644 --- a/scripts/obs/lib/config.py +++ b/scripts/obs/lib/config.py @@ -47,6 +47,8 @@ # NOTE: Consider whether new packages should be added to EXCLUDE_PACKAGES in # osmocom-obs-nightly-asan.yml. projects_osmocom = [ + "osmocom-keyring", + "erlang/osmo_dia2gsup", "erlang/osmo-epdg", "erlang/osmo-s1gw", -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40428?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I370b4fa0c6f7e8a925b1ddd7c1c47980a8f4fea2 Gerrit-Change-Number: 40428 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

2 weeks, 4 days

1
0
0 0

2025

2024

2023

2022

gerrit-log June 2025