September 2026 - gerrit-log - lists.osmocom.org

[S] Change in osmo-iuh[master]: hnb-test: count N(SD) over uplink MM messages
by pespin 21 Sep '26

21 Sep '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43593?usp=email ) Change subject: hnb-test: count N(SD) over uplink MM messages ...................................................................... hnb-test: count N(SD) over uplink MM messages Setting N(SD) on the Authentication Response earlier in this series fixed that one message. The TMSI Reallocation Complete that follows the Location Updating Accept still went out with N(SD) = 0, so osmo-msc dropped it as a duplicate as well and released the Location Update with a reject when the TMSI reallocation timer expired. Keep the send sequence number per signalling connection instead of setting it per message. The Location Updating Request in the InitialUE-Message is number 0, and every later uplink MM message, the Identity Response, the Authentication Response and the TMSI Reallocation Complete, takes the next value, two bits wide as on UTRAN (3GPP TS 24.007 section 11.2.3.2.3). This replaces the constant introduced earlier with a counter, so the hard-coded value in gen_nas_auth_resp() goes away. Change-Id: Ieceaee806be43a41e7662e8fa8d119e4e663a3d9 Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test.c M tests/hnb-test.h 2 files changed, 27 insertions(+), 12 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, approved laforge: Looks good to me, but someone else must approve diff --git a/tests/hnb-test.c b/tests/hnb-test.c index be9f170..86ee5a9 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -191,11 +191,24 @@ return 0; } -static struct msgb *gen_nas_id_resp() +/* Message type octet of an uplink MM message with the send sequence number + * N(SD) in bits 7 and 6 (3GPP TS 24.007 section 11.2.3.2.3). The network + * drops a message whose N(SD) is not the one it expects as a duplicate, + * so every uplink MM message on a connection has to count: the Location + * Updating Request in the InitialUE-Message is number 0. */ +static uint8_t mm_msg_type_nsd(struct hnb_test *hnb, uint8_t msg_type) +{ + struct hnbtest_chan *chan = hnb->cur_chan ? hnb->cur_chan : hnb->cs.chan; + uint8_t n_sd = chan ? chan->n_sd++ : 0; + + return (msg_type & 0x3f) | ((n_sd & 0x03) << 6); +} + +static struct msgb *gen_nas_id_resp(struct hnb_test *hnb) { uint8_t id_resp[] = { GSM48_PDISC_MM, - GSM48_MT_MM_ID_RESP, + mm_msg_type_nsd(hnb, GSM48_MT_MM_ID_RESP), /* IMEISV */ 0x09, /* len */ 0x03, /* first digit (0000) + even (0) + id IMEISV (011) */ @@ -206,11 +219,11 @@ return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); } -static struct msgb *gen_nas_tmsi_realloc_compl() +static struct msgb *gen_nas_tmsi_realloc_compl(struct hnb_test *hnb) { uint8_t id_resp[] = { GSM48_PDISC_MM, - GSM48_MT_MM_TMSI_REALL_COMPL, + mm_msg_type_nsd(hnb, GSM48_MT_MM_TMSI_REALL_COMPL), }; return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); @@ -219,10 +232,8 @@ /* MM Authentication Response, 3GPP TS 24.008 section 9.2.3. For GSM AKA * only the four octet SRES is present. For UMTS AKA the first four octets * of RES go into that field and the rest into the Authentication Response - * Parameter (extension) IE, as a UE does. The message type octet carries - * N(SD) = 1: it is the second uplink MM message on the connection, after - * the Location Updating Request (TS 24.007 section 11.2.3.2.3). */ -static struct msgb *gen_nas_auth_resp(const uint8_t *res, unsigned int res_len) + * Parameter (extension) IE, as a UE does. */ +static struct msgb *gen_nas_auth_resp(struct hnb_test *hnb, const uint8_t *res, unsigned int res_len) { uint8_t buf[2 + 4 + 2 + 12]; unsigned int len = 0; @@ -230,7 +241,7 @@ OSMO_ASSERT(res_len >= 4 && res_len <= 16); buf[len++] = GSM48_PDISC_MM; - buf[len++] = 0x40 | GSM48_MT_MM_AUTH_RESP; + buf[len++] = mm_msg_type_nsd(hnb, GSM48_MT_MM_AUTH_RESP); memcpy(buf + len, res, 4); len += 4; if (res_len > 4) { @@ -439,7 +450,7 @@ if (res_len < 0) return res_len; - return hnb_test_tx_dt(hnb, gen_nas_auth_resp(res, res_len)); + return hnb_test_tx_dt(hnb, gen_nas_auth_resp(hnb, res, res_len)); } void hnb_test_tx_iu_release_req(struct hnb_test *hnb) @@ -473,13 +484,13 @@ switch (msg_type) { case GSM48_MT_MM_ID_REQ: - return hnb_test_tx_dt(hnb, gen_nas_id_resp()); + return hnb_test_tx_dt(hnb, gen_nas_id_resp(hnb)); case GSM48_MT_MM_LOC_UPD_ACCEPT: if (hnb_test_nas_rx_lu_accept(gh, len, &sent_tmsi)) return -1; if (sent_tmsi) - return hnb_test_tx_dt(hnb, gen_nas_tmsi_realloc_compl()); + return hnb_test_tx_dt(hnb, gen_nas_tmsi_realloc_compl(hnb)); else return 0; @@ -965,6 +976,7 @@ chan->imsi = talloc_strdup(chan, argv[1]); chan->conn_id = conn_id; conn_id++; + chan->n_sd = 1; /* the Location Updating Request below is number 0 */ msg = gen_initue_lu(chan->is_ps, chan->conn_id, chan->imsi); rua = rua_new_conn(chan->is_ps, chan->conn_id, msg); diff --git a/tests/hnb-test.h b/tests/hnb-test.h index 44fba35..b3a0c11 100644 --- a/tests/hnb-test.h +++ b/tests/hnb-test.h @@ -43,6 +43,9 @@ int is_ps; uint32_t conn_id; char *imsi; + /*! N(SD) of the next uplink MM message on this connection, + * 3GPP TS 24.007 section 11.2.3.2.3 */ + uint8_t n_sd; }; struct hnb_test { -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43593?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: Ieceaee806be43a41e7662e8fa8d119e4e663a3d9 Gerrit-Change-Number: 43593 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <daniel(a)totalueberwachung.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[M] Change in osmo-iuh[master]: hnb-test: answer UMTS AKA with the full RES
by pespin 21 Sep '26

21 Sep '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email ) Change subject: hnb-test: answer UMTS AKA with the full RES ...................................................................... hnb-test: answer UMTS AKA with the full RES On UTRAN the MSC only accepts UMTS AKA. hnb-test computed a COMP128v1 SRES for every challenge, and osmo-msc rejected the four octet answer with "AUTH via UTRAN, cannot allow GSM AKA", so the Location Update never passed authentication. Detect the AUTN IE in the MM Authentication Request. When it is there, compute the Milenage RES (K is the existing test key, OP is 0) and send it the way a UE does, per 3GPP TS 24.008 section 9.2.3: the first four octets in the mandatory SRES field, the rest in the Authentication Response Parameter extension IE. Without AUTN, keep the GSM AKA answer. The computation is shared with the GMM handlers added later in this series. Replies so far went out on the CS signalling connection only. Record the PS channel opened by "channel ps ...", let the RUA layer set the current channel from the CN domain indicator of each DirectTransfer, and reply on that one, so a PS connection can answer a challenge from the SGSN. Forget a channel when the CN sends RUA Disconnect, so a later "channel" command can open a new connection. Change-Id: Ida588b3ea93c51196fb3a29ed9544dfc4fe4fc30 Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test-layers.h M tests/hnb-test-rua.c M tests/hnb-test.c M tests/hnb-test.h 4 files changed, 159 insertions(+), 31 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified diff --git a/tests/hnb-test-layers.h b/tests/hnb-test-layers.h index 6211661..a165dcf 100644 --- a/tests/hnb-test-layers.h +++ b/tests/hnb-test-layers.h @@ -7,6 +7,7 @@ /* main calls RUA */ void hnb_test_rua_dt_handle(struct hnb_test *hnb, struct ANY *in); void hnb_test_rua_cl_handle(struct hnb_test *hnb, struct ANY *in); +void hnb_test_rua_disc_handle(struct hnb_test *hnb, struct ANY *in); /* RUA calls RANAP */ void hnb_test_rua_dt_handle_ranap(void *priv, struct ranap_message_s *ranap_msg); @@ -17,3 +18,7 @@ void hnb_test_rx_secmode_cmd(struct hnb_test *hnb, long ip_alg); void hnb_test_rx_iu_release(struct hnb_test *hnb); void hnb_test_rx_paging(struct hnb_test *hnb, const char *imsi); + +/* authentication answer shared by the MM and GMM handlers (hnb-test.c) */ +extern const uint8_t hnb_test_subscr_key[16]; +int hnb_test_auth_answer(const uint8_t *rand, const uint8_t *autn, uint8_t *res, size_t res_size); diff --git a/tests/hnb-test-rua.c b/tests/hnb-test-rua.c index 0882515..b84087c 100644 --- a/tests/hnb-test-rua.c +++ b/tests/hnb-test-rua.c @@ -1,8 +1,10 @@ #include <asn1c/ANY.h> +#include <osmocom/core/talloc.h> #include <osmocom/ranap/ranap_common_cn.h> #include <osmocom/rua/rua_ies_defs.h> +#include "hnb-test.h" #include "hnb-test-layers.h" void hnb_test_rua_dt_handle(struct hnb_test *hnb, ANY_t *in) @@ -16,12 +18,49 @@ return; } + /* Tell the RANAP/NAS layer which signalling connection this belongs + * to, so that replies go back on the CS or the PS connection. */ + if (ies.cN_DomainIndicator == RUA_CN_DomainIndicator_ps_domain) + hnb->cur_chan = hnb->ps.chan; + else + hnb->cur_chan = hnb->cs.chan; + rc = ranap_cn_rx_co(hnb_test_rua_dt_handle_ranap, hnb, ies.ranaP_Message.buf, ies.ranaP_Message.size); + hnb->cur_chan = NULL; + /* FIXME: what to do with the asn1c-allocated memory */ rua_free_directtransferies(&ies); } +/* The CN released the signalling connection: forget the channel so that a + * new "channel" VTY command can open another one for that domain. */ +void hnb_test_rua_disc_handle(struct hnb_test *hnb, ANY_t *in) +{ + RUA_DisconnectIEs_t ies; + int rc; + + rc = rua_decode_disconnecties(&ies, in); + if (rc < 0) { + printf("failed to decode RUA Disconnect IEs\n"); + return; + } + + if (ies.cN_DomainIndicator == RUA_CN_DomainIndicator_ps_domain) { + printf("RUA Disconnect on the PS domain\n"); + if (hnb->ps.chan) + talloc_free(hnb->ps.chan); + hnb->ps.chan = NULL; + } else { + printf("RUA Disconnect on the CS domain\n"); + if (hnb->cs.chan) + talloc_free(hnb->cs.chan); + hnb->cs.chan = NULL; + } + + rua_free_disconnecties(&ies); +} + void hnb_test_rua_cl_handle(struct hnb_test *hnb, ANY_t *in) { RUA_ConnectionlessTransferIEs_t ies; diff --git a/tests/hnb-test.c b/tests/hnb-test.c index 597d04f..6eca9df 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -216,17 +216,31 @@ return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); } -static struct msgb *gen_nas_auth_resp(uint8_t *sres) +/* MM Authentication Response, 3GPP TS 24.008 section 9.2.3. For GSM AKA + * only the four octet SRES is present. For UMTS AKA the first four octets + * of RES go into that field and the rest into the Authentication Response + * Parameter (extension) IE, as a UE does. The message type octet carries + * N(SD) = 1: it is the second uplink MM message on the connection, after + * the Location Updating Request (TS 24.007 section 11.2.3.2.3). */ +static struct msgb *gen_nas_auth_resp(const uint8_t *res, unsigned int res_len) { - uint8_t id_resp[] = { - GSM48_PDISC_MM, - 0x40 | GSM48_MT_MM_AUTH_RESP, /* N(SD) = 1: second uplink MM message after the LU Request */ - 0x61, 0xb5, 0x69, 0xf5 /* hardcoded SRES */ - }; + uint8_t buf[2 + 4 + 2 + 12]; + unsigned int len = 0; - memcpy(id_resp + 2, sres, 4); + OSMO_ASSERT(res_len >= 4 && res_len <= 16); - return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); + buf[len++] = GSM48_PDISC_MM; + buf[len++] = 0x40 | GSM48_MT_MM_AUTH_RESP; + memcpy(buf + len, res, 4); + len += 4; + if (res_len > 4) { + buf[len++] = GSM48_IE_AUTH_RES_EXT; + buf[len++] = res_len - 4; + memcpy(buf + len, res + 4, res_len - 4); + len += res_len - 4; + } + + return ranap_new_msg_dt(0, buf, len); } static int hnb_test_tx_dt(struct hnb_test *hnb, struct msgb *txm) @@ -234,9 +248,12 @@ struct hnbtest_chan *chan; struct msgb *rua; - chan = hnb->cs.chan; + /* Reply on the connection the message being handled arrived on; + * outside of a receive path fall back to the CS connection. */ + chan = hnb->cur_chan ? hnb->cur_chan : hnb->cs.chan; if (!chan) { - printf("hnb_test_nas_tx_tmsi_realloc_compl(): No CS channel established yet.\n"); + printf("hnb_test_tx_dt(): No signalling connection established yet.\n"); + msgb_free(txm); return -1; } @@ -320,10 +337,77 @@ } } +/* Secret of the test subscriber: Ki for GSM AKA (COMP128v1) and K for + * UMTS AKA (Milenage, OP = 0). The same 16 octets are used for both so + * that one HLR entry serves both algorithms. */ +const uint8_t hnb_test_subscr_key[16] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f +}; + +/* Compute the answer to an authentication challenge. With an AUTN the + * challenge is UMTS AKA and the answer is the full RES from Milenage; + * without one it is GSM AKA and the answer is the SRES from COMP128v1. + * Returns the length of the answer written to res, or negative. */ +int hnb_test_auth_answer(const uint8_t *rand, const uint8_t *autn, + uint8_t *res, size_t res_size) +{ + struct osmo_auth_vector vec; + struct osmo_sub_auth_data2 auth; + int rc; + + memset(&vec, 0, sizeof(vec)); + memset(&auth, 0, sizeof(auth)); + + if (autn) { + /* Milenage wants the RES length it shall produce (4 or 8) */ + vec.res_len = 8; + auth.type = OSMO_AUTH_TYPE_UMTS; + auth.algo = OSMO_AUTH_ALG_MILENAGE; + memcpy(auth.u.umts.k, hnb_test_subscr_key, sizeof(hnb_test_subscr_key)); + auth.u.umts.k_len = sizeof(hnb_test_subscr_key); + auth.u.umts.opc_len = 16; /* OP = 0, derived to OPc */ + auth.u.umts.opc_is_op = 1; + auth.u.umts.ind_bitlen = 5; + } else { + auth.type = OSMO_AUTH_TYPE_GSM; + auth.algo = OSMO_AUTH_ALG_COMP128v1; + memcpy(auth.u.gsm.ki, hnb_test_subscr_key, sizeof(hnb_test_subscr_key)); + } + + rc = osmo_auth_gen_vec2(&vec, &auth, rand); + if (rc < 0) { + printf("osmo_auth_gen_vec2() failed: %d\n", rc); + return rc; + } + + if (autn) { + if (vec.res_len > res_size) + return -ENOSPC; + memcpy(res, vec.res, vec.res_len); + printf("UMTS AKA: rand %s", osmo_hexdump_nospc(rand, 16)); + printf(" autn %s", osmo_hexdump_nospc(autn, 16)); + printf(" --> res %s\n", osmo_hexdump_nospc(vec.res, vec.res_len)); + return vec.res_len; + } + + if (res_size < sizeof(vec.sres)) + return -ENOSPC; + memcpy(res, vec.sres, sizeof(vec.sres)); + printf("GSM AKA: rand %s", osmo_hexdump_nospc(rand, 16)); + printf(" --> sres %s\n", osmo_hexdump_nospc(vec.sres, sizeof(vec.sres))); + return sizeof(vec.sres); +} + static int hnb_test_nas_rx_auth_req(struct hnb_test *hnb, struct gsm48_hdr *gh, int len) { struct gsm48_auth_req *ar; + const uint8_t *autn = NULL; + const uint8_t *ie; + int ie_len; + uint8_t res[16]; + int res_len; len -= (const char *)&gh->data[0] - (const char *)gh; @@ -335,30 +419,21 @@ printf(" :) Authentication Request :)\n"); ar = (struct gsm48_auth_req*) &gh->data[0]; - int seq = ar->key_seq; - /* Generate SRES from *HARDCODED* Ki for Iuh testing */ - struct osmo_auth_vector vec; - /* Ki 000102030405060708090a0b0c0d0e0f */ - struct osmo_sub_auth_data2 auth = { - .type = OSMO_AUTH_TYPE_GSM, - .algo = OSMO_AUTH_ALG_COMP128v1, - .u.gsm.ki = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, - 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, - 0x0e, 0x0f - }, - }; + /* Optional AUTN (TLV, IEI 0x20) after the fixed part marks a UMTS + * AKA challenge, TS 24.008 section 9.2.2. */ + ie = &gh->data[sizeof(*ar)]; + ie_len = len - sizeof(*ar); + if (ie_len >= 2 + 16 && ie[0] == GSM48_IE_AUTN && ie[1] == 16) + autn = &ie[2]; - memset(&vec, 0, sizeof(vec)); - osmo_auth_gen_vec2(&vec, &auth, ar->rand); + printf("seq %d %s\n", ar->key_seq, autn ? "(UMTS AKA, AUTN present)" : "(GSM AKA)"); - printf("seq %d rand %s", - seq, osmo_hexdump(ar->rand, sizeof(ar->rand))); - printf(" --> sres %s\n", - osmo_hexdump(vec.sres, 4)); + res_len = hnb_test_auth_answer(ar->rand, autn, res, sizeof(res)); + if (res_len < 0) + return res_len; - return hnb_test_tx_dt(hnb, gen_nas_auth_resp(vec.sres)); + return hnb_test_tx_dt(hnb, gen_nas_auth_resp(res, res_len)); } void hnb_test_tx_iu_release_req(struct hnb_test *hnb) @@ -550,6 +625,7 @@ break; case RUA_ProcedureCode_id_Disconnect: printf("RUA rx Disconnect\n"); + hnb_test_rua_disc_handle(hnb, &pdu->choice.successfulOutcome.value); break; case RUA_ProcedureCode_id_ErrorIndication: printf("RUA rx ErrorIndication\n"); @@ -892,7 +968,9 @@ vty->index = chan; vty->node = CHAN_NODE; - if (!chan->is_ps) + if (chan->is_ps) + g_hnb_test.ps.chan = chan; + else g_hnb_test.cs.chan = chan; diff --git a/tests/hnb-test.h b/tests/hnb-test.h index 02efce0..44fba35 100644 --- a/tests/hnb-test.h +++ b/tests/hnb-test.h @@ -72,6 +72,12 @@ struct { struct hnbtest_chan *chan; } cs; + struct { + struct hnbtest_chan *chan; + } ps; + /*! channel the RANAP/NAS message being handled arrived on, set by the + * RUA layer from the CN domain indicator of the DirectTransfer */ + struct hnbtest_chan *cur_chan; }; extern struct hnb_test g_hnb_test; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: Ida588b3ea93c51196fb3a29ed9544dfc4fe4fc30 Gerrit-Change-Number: 43591 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <daniel(a)totalueberwachung.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-iuh[master]: hnb-test: parse LU Accept IEs after the LAI
by pespin 21 Sep '26

21 Sep '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43592?usp=email ) Change subject: hnb-test: parse LU Accept IEs after the LAI ...................................................................... hnb-test: parse LU Accept IEs after the LAI The Location Updating Accept begins with the mandatory Location Area Identification, a five octet V IE (3GPP TS 24.008 section 9.2.13). The optional TLV IEs, among them the Mobile Identity carrying a new TMSI, start after it. hnb-test handed the whole message body to tlv_parse(), which read the first LAI octet as an IEI and failed with OSMO_TLVP_ERR_UNKNOWN_TLV_TYPE. The TMSI Reallocation Complete was therefore never sent, and osmo-msc, which allocates a TMSI by default, released the connection with a Location Updating Reject when its timer expired. Start the parser after the LAI, and read the identity type from the Mobile Identity IE instead of the Network Name IE, which is not present in this message and would have been dereferenced as NULL. Change-Id: I2e1eb8e1bc3db5f20b04a3161713c8a47847c6dc Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test.c 1 file changed, 8 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/tests/hnb-test.c b/tests/hnb-test.c index 6eca9df..be9f170 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -298,14 +298,20 @@ int parse_res; len -= (const char *)&gh->data[0] - (const char *)gh; - parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], len, 0, 0); + + /* The Location Area Identification is a mandatory V IE of five octets + * at the start of the message body (TS 24.008 section 9.2.13); the + * TLV parser must start after it, or it takes the first LAI octet for + * an unknown IEI and fails. */ + parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[sizeof(*lai)], + len - sizeof(*lai), 0, 0); if (parse_res <= 0) { printf("Error parsing Location Update Accept message: %d\n", parse_res); return -1; } if (TLVP_PRESENT(&tp, GSM48_IE_MOBILE_ID)) { - uint8_t type = TLVP_VAL(&tp, GSM48_IE_NAME_SHORT)[0] & 0x0f; + uint8_t type = TLVP_VAL(&tp, GSM48_IE_MOBILE_ID)[0] & 0x0f; if (type == GSM_MI_TYPE_TMSI) *sent_tmsi = 1; else *sent_tmsi = 0; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43592?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I2e1eb8e1bc3db5f20b04a3161713c8a47847c6dc Gerrit-Change-Number: 43592 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[S] Change in osmo-iuh[master]: hnb-test: count N(SD) over uplink MM messages
by pespin 21 Sep '26

21 Sep '26

Attention is currently required from: andrei.gosman(a)gmail.com, daniel, lynxis lazus. pespin has posted comments on this change by andrei.gosman(a)gmail.com. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43593?usp=email ) Change subject: hnb-test: count N(SD) over uplink MM messages ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43593?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: Ieceaee806be43a41e7662e8fa8d119e4e663a3d9 Gerrit-Change-Number: 43593 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <daniel(a)totalueberwachung.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: daniel <daniel(a)totalueberwachung.de> Gerrit-Comment-Date: Mon, 21 Sep 2026 20:17:48 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[M] Change in osmo-iuh[master]: hnb-test: answer UMTS AKA with the full RES
by pespin 21 Sep '26

21 Sep '26

Attention is currently required from: andrei.gosman(a)gmail.com, daniel, lynxis lazus. pespin has posted comments on this change by andrei.gosman(a)gmail.com. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email ) Change subject: hnb-test: answer UMTS AKA with the full RES ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: Ida588b3ea93c51196fb3a29ed9544dfc4fe4fc30 Gerrit-Change-Number: 43591 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <daniel(a)totalueberwachung.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Attention: daniel <daniel(a)totalueberwachung.de> Gerrit-Comment-Date: Mon, 21 Sep 2026 20:14:34 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: bts: TC_nr_seq_error: handle occasional func=RR
by pespin 21 Sep '26

21 Sep '26

Attention is currently required from: fixeria, laforge. pespin has posted comments on this change by fixeria. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email ) Change subject: bts: TC_nr_seq_error: handle occasional func=RR ...................................................................... Patch Set 2: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I49cb6dcfa66208df246f8da7116d9fc8cba1f11e Gerrit-Change-Number: 43690 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Mon, 21 Sep 2026 20:04:52 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-mgw[master]: mgcp_client: generate mgcp_common.h with printf
by pespin 21 Sep '26

21 Sep '26

Attention is currently required from: andrei.gosman(a)gmail.com, osmith. pespin has posted comments on this change by andrei.gosman(a)gmail.com. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43576?usp=email ) Change subject: mgcp_client: generate mgcp_common.h with printf ...................................................................... Patch Set 4: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43576?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ibc547513745104212469ccddbc2e636c985cffe5 Gerrit-Change-Number: 43576 Gerrit-PatchSet: 4 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Comment-Date: Mon, 21 Sep 2026 20:01:56 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-ttcn3-hacks[master]: bts: TC_nr_seq_error: handle occasional func=RR
by fixeria 21 Sep '26

21 Sep '26

Attention is currently required from: fixeria. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: bts: TC_nr_seq_error: handle occasional func=RR ...................................................................... bts: TC_nr_seq_error: handle occasional func=RR TC_nr_seq_error() deliberately sends an I frame with a bad N(R) to trigger a sequence error on the BTS side. In response, the BTS both raises the sequence error (leading to a DISC once RSL requests link release) and, independently, sends a routine func=RR ack, since it considers itself "not busy" with no pending data at that point. ''' ((bts=0,trx=0,ts=1,ss=0)[DCCH][0]) we are not busy and have no pending data, send RR ''' Whether that RR actually reaches the air depends on how soon the channel gets its next Tx opportunity relative to the RSL RELEASE REQ: on TCH/F (FACCH can steal almost any burst) the RR is typically transmitted well before DISC is even queued, while on other channel types it is usually superseded by DISC before ever being sent. So the RR shows up on air intermittently, most reliably on TCH/F. The test's alt only expects func=DISC, so an unexpected func=RR stalls the queue and results in a failure "Missing DISC from BTS". This problem did not manifest with fake_trx.py; the test only started failing sporadically after migrating to osmo-trx-proxy, likely due to its Tx queueing scheduling latency. Change-Id: I49cb6dcfa66208df246f8da7116d9fc8cba1f11e Related: OS#6638, OS#6672 --- M bts/BTS_Tests_LAPDm.ttcn 1 file changed, 2 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/90/43690/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I49cb6dcfa66208df246f8da7116d9fc8cba1f11e Gerrit-Change-Number: 43690 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in osmo-ttcn3-hacks[master]: bts: TC_nr_seq_error: handle occasional func=RR
by fixeria 21 Sep '26

21 Sep '26

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email ) Change subject: bts: TC_nr_seq_error: handle occasional func=RR ...................................................................... bts: TC_nr_seq_error: handle occasional func=RR TC_nr_seq_error() deliberately sends an I frame with a bad N(R) to trigger a sequence error on the BTS side. In response, the BTS both raises the sequence error (leading to a DISC once RSL requests link release) and, independently, sends a routine func=RR ack, since it considers itself "not busy" with no pending data at that point. ''' ((bts=0,trx=0,ts=1,ss=0)[DCCH][0]) we are not busy and have no pending data, send RR ''' Whether that RR actually reaches the air depends on how soon the channel gets its next Tx opportunity relative to the RSL RELEASE REQ: on TCH/F (FACCH can steal almost any burst) the RR is typically transmitted well before DISC is even queued, while on other channel types it is usually superseded by DISC before ever being sent. So the RR shows up on air intermittently, most reliably on TCH/F. The test's alt only expects func=DISC, so an unexpected func=RR stalls the queue and results in a failure "Missing DISC from BTS". This problem did not manifest with fake_trx.py; the test only started failing sporadically after migrating to osmo-trx-proxy, likely due to its Tx queueing scheduling latency. Change-Id: I49cb6dcfa66208df246f8da7116d9fc8cba1f11e Related: OS#6638, OS#6672 --- M bts/BTS_Tests_LAPDm.ttcn 1 file changed, 2 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/90/43690/1 diff --git a/bts/BTS_Tests_LAPDm.ttcn b/bts/BTS_Tests_LAPDm.ttcn index fef2383..f091df9 100644 --- a/bts/BTS_Tests_LAPDm.ttcn +++ b/bts/BTS_Tests_LAPDm.ttcn @@ -814,6 +814,8 @@ T1.start; alt{ [] LAPDM.receive(t_PH_DATA(0, false, tr_LAPDm_DISC(sapi, c_r:=cr_MT_CMD, p:=true))); + /* prior to func=DISC, the BTS may send a func=RR frame - ignore it */ + [] LAPDM.receive(t_PH_DATA(0, is_sacch, tr_LAPDm_RR(sapi, c_r:=cr_MT_RSP, p:=?, nr:=?))) { repeat; } [] T1.timeout{ setverdict(fail, "Missing DISC from BTS")} } -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/43690?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I49cb6dcfa66208df246f8da7116d9fc8cba1f11e Gerrit-Change-Number: 43690 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[XS] Change in libosmocore[master]: core/socket: init_osa: pass family-correct len
by andrei.gosman＠gmail.com 21 Sep '26

21 Sep '26

Attention is currently required from: pespin. andrei.gosman(a)gmail.com has posted comments on this change by andrei.gosman(a)gmail.com. ( https://gerrit.osmocom.org/c/libosmocore/+/43574?usp=email ) Change subject: core/socket: init_osa: pass family-correct len ...................................................................... Patch Set 1: (1 comment) File src/core/socket.c: https://gerrit.osmocom.org/c/libosmocore/+/43574/comment/f6d0e720_7a3187ed?… : PS1, Line 603: if (bind(sfd, &local->u.sa, osmo_sockaddr_size(local)) == -1) { > Context: this patch is […] Correction to my previous comment in this thread, which is wrong. The union's sockaddr_storage member does represent an AF_UNIX address: sockaddr_un is 106 bytes on Darwin against a 128 byte union, and libosmocore relies on that in osmo_sock_get_name_buf(), which reads the AF_UNIX case back through a struct sockaddr_un *. So AF_UNIX can reach this code path. That comment was an unsent draft published by accident together with my cover message. Please take the cover message on patch set 1 as my answer instead. -- To view, visit https://gerrit.osmocom.org/c/libosmocore/+/43574?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: libosmocore Gerrit-Branch: master Gerrit-Change-Id: I37cb08a6e1809d51c97e666f980d4c68f8b56933 Gerrit-Change-Number: 43574 Gerrit-PatchSet: 1 Gerrit-Owner: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Mon, 21 Sep 2026 18:49:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Comment-In-Reply-To: andrei.gosman(a)gmail.com <andrei.gosman(a)gmail.com>

1 0

2026

2025

2024

2023

2022

gerrit-log September 2026