September 2026 - gerrit-log - lists.osmocom.org

[XS] Change in osmo-mgw[master]: mgcp_client: include errno.h, not asm-generic
by pespin 08 Sep '26

08 Sep '26

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email ) Change subject: mgcp_client: include errno.h, not asm-generic ...................................................................... mgcp_client: include errno.h, not asm-generic src/libosmo-mgcp-client/mgcp_client_pool.c includes <asm-generic/errno.h> for ECONNABORTED and EINVAL. That is a Linux kernel UAPI header. It exists on Linux distributions and nowhere else, so the build stops on Darwin: mgcp_client_pool.c:21:10: fatal error: 'asm-generic/errno.h' file not found Both values come from <errno.h> on every platform, and on Linux glibc's <errno.h> reaches the same UAPI definitions, so including the kernel header directly was never needed there either. No functional change on any platform. Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M src/libosmo-mgcp-client/mgcp_client_pool.c 1 file changed, 1 insertion(+), 1 deletion(-) Approvals: pespin: Looks good to me, approved; Verified diff --git a/src/libosmo-mgcp-client/mgcp_client_pool.c b/src/libosmo-mgcp-client/mgcp_client_pool.c index 61fb134..42d775e 100644 --- a/src/libosmo-mgcp-client/mgcp_client_pool.c +++ b/src/libosmo-mgcp-client/mgcp_client_pool.c @@ -18,7 +18,7 @@ * */ -#include <asm-generic/errno.h> +#include <errno.h> #include <osmocom/mgcp_client/mgcp_client.h> #include <osmocom/mgcp_client/mgcp_client_internal.h> #include <osmocom/mgcp_client/mgcp_client_pool_internal.h> -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Gerrit-Change-Number: 43577 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-mgw[master]: mgcp_client: include errno.h, not asm-generic
by pespin 08 Sep '26

08 Sep '26

Attention is currently required from: Andrei G. pespin has removed a vote from this change. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email ) Change subject: mgcp_client: include errno.h, not asm-generic ...................................................................... Removed Verified-1 by Jenkins Builder (1000002) -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: deleteVote Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Gerrit-Change-Number: 43577 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: Andrei G <andrei.gosman(a)gmail.com>

1 0

[XS] Change in osmo-mgw[master]: mgcp_client: include errno.h, not asm-generic
by pespin 08 Sep '26

08 Sep '26

Attention is currently required from: Andrei G. pespin has posted comments on this change by Andrei G. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email ) Change subject: mgcp_client: include errno.h, not asm-generic ...................................................................... Patch Set 1: Verified+1 -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Gerrit-Change-Number: 43577 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Comment-Date: Tue, 08 Sep 2026 15:32:06 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-mgw[master]: mgcp_client: include errno.h, not asm-generic
by pespin 08 Sep '26

08 Sep '26

Attention is currently required from: Andrei G. pespin has posted comments on this change by Andrei G. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email ) Change subject: mgcp_client: include errno.h, not asm-generic ...................................................................... Patch Set 1: Code-Review+2 (1 comment) Patchset: PS1: @andrei.gosman@gmail.com thanks for fixing, that was an artifact generated sometimes by my editor and it went unnoticed and finally merged. -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Gerrit-Change-Number: 43577 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Comment-Date: Tue, 08 Sep 2026 15:32:02 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-mgw[master]: mgcp_client: include errno.h, not asm-generic
by Andrei G 08 Sep '26

08 Sep '26

Andrei G has posted comments on this change by Andrei G. ( https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email ) Change subject: mgcp_client: include errno.h, not asm-generic ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: CI infrastructure issue, not code. The gerrit-binpkgs debian:11 job fails in the Docker image build step with: E: Release file for http://deb.debian.org/debian-security/dists/ bullseye-security/InRelease is expired (invalid since 17h 33min 55s). Debian 11 Bullseye left standard LTS in August 2026. Security has moved to archive.debian.org. osmo-ci/scripts/obs/data/build_binpkg.Dockerfile step 4/7 still references deb.debian.org for the security suite. Around 20 open Changes across libosmocore, osmo-mgw, osmo-hlr, osmo-trx, osmo-ggsn, osmo-sgsn and osmo-iuh all hit Verified-1 on this same job. libosmocore Changes pass because that repo's build matrix has no debian:11 target. Options: switch to http://archive.debian.org/debian-security/ for bullseye-security, or drop debian:11 from the binpkgs matrix given Bullseye EOL. Not blocking any reviewer. -- To view, visit https://gerrit.osmocom.org/c/osmo-mgw/+/43577?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: osmo-mgw Gerrit-Branch: master Gerrit-Change-Id: Ie3fc368c04c29aea824002b3bf9839e410e7f045 Gerrit-Change-Number: 43577 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com> Gerrit-Reviewer: Jenkins Builder Gerrit-Comment-Date: Tue, 08 Sep 2026 15:28:11 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No

1 0

[L] Change in pysim[master]: bip: move the BIP relay into pySim.bip
by dexter 08 Sep '26

08 Sep '26

Attention is currently required from: Hoernchen. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43540?usp=email ) Change subject: bip: move the BIP relay into pySim.bip ...................................................................... Patch Set 2: Code-Review+1 (3 comments) Patchset: PS2: Ths patch had no "Verifed" result, I have re-triggered the Jenkins build, but the build seems to take very long. I hope it will finish overnight... File tests/unittests/test_bip_relay.py: https://gerrit.osmocom.org/c/pysim/+/43540/comment/923712bf_c3f471e4?usp=em… : PS1, Line 28: with a card that sends one, and one that has one must get the PDU.""" I only see sms_sink? Were there crashes before, did you change the code when moving it to the bip module? https://gerrit.osmocom.org/c/pysim/+/43540/comment/f203b9f7_0ac00edf?usp=em… : PS1, Line 40: Proact(sms_sink=seen.append).send_sms_via_smpp(self._submit()) maybe create the Proact object first and use it then. Maybe also assert on it to make sure the constructor has stored the sms_sink callback as class property? -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43540?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Ifd8a15684939977d29ea83a6b669daee14484e88 Gerrit-Change-Number: 43540 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Comment-Date: Tue, 08 Sep 2026 15:24:44 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[L] Change in pysim[master]: ota: add TS 102 226 5.2 Expanded Remote Application data format
by dexter 08 Sep '26

08 Sep '26

Attention is currently required from: Hoernchen, daniel. dexter has posted comments on this change by Hoernchen. ( https://gerrit.osmocom.org/c/pysim/+/43541?usp=email ) Change subject: ota: add TS 102 226 5.2 Expanded Remote Application data format ...................................................................... Patch Set 2: Code-Review+1 (4 comments) Patchset: PS2: This is really a lot of stuff, however the testcases look comprehensive. I think this is ok. File pySim/ota.py: https://gerrit.osmocom.org/c/pysim/+/43541/comment/7e48dc08_d9457744?usp=em… : PS2, Line 120: Looks like a spec ref is missing here? (TS 102 226 5.2.1 as it seems) https://gerrit.osmocom.org/c/pysim/+/43541/comment/fd096896_42e464c6?usp=em… : PS2, Line 323: I would recommend to add API docstrings for the other parameters, in particular the apdu parameter, which now can also be a list of APDUs. https://gerrit.osmocom.org/c/pysim/+/43541/comment/c6b1a88c_e552ac3c?usp=em… : PS2, Line 333: same here, I think we should document all parameters. -- To view, visit https://gerrit.osmocom.org/c/pysim/+/43541?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: comment Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: Idec00d16fd1a7d4a7129b2a3b6f0ef37dabcecb7 Gerrit-Change-Number: 43541 Gerrit-PatchSet: 2 Gerrit-Owner: Hoernchen <ewild(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: dexter <pmaier(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: Hoernchen <ewild(a)sysmocom.de> Gerrit-Attention: daniel <dwillmann(a)sysmocom.de> Gerrit-Comment-Date: Tue, 08 Sep 2026 15:23:14 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes

1 0

[XS] Change in osmo-iuh[master]: hnb-test: use N(SD)=1 on MM Auth Response
by Andrei G 08 Sep '26

08 Sep '26

Andrei G has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43590?usp=email ) Change subject: hnb-test: use N(SD)=1 on MM Auth Response ...................................................................... hnb-test: use N(SD)=1 on MM Auth Response The Authentication Response carries a hard-coded N(SD) of 2 in the message type octet: 0x80 | GSM48_MT_MM_AUTH_RESP, with the comment "simulate sequence nr 2". That predates the duplicate detection of 3GPP TS 24.007 section 11.2.3.2.3 in osmo-msc. The Location Updating Request that opens the connection in the InitialUE-Message is N(SD) = 0, so the Authentication Response, being the second uplink MM message, has to be N(SD) = 1. With 2, osmo-msc logs Duplicate DTAP: bin=0, expected n_sd == 1, got 2 drops the response, and rejects the Location Update when its timer expires. Set N(SD) to 1 so the response reaches the VLR. The remaining uplink MM messages are handled later in this series. Change-Id: I4c71b404733e53d4e47d9ba5eb555b92eb1a771d Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test.c 1 file changed, 1 insertion(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/90/43590/1 diff --git a/tests/hnb-test.c b/tests/hnb-test.c index bfccf5a..597d04f 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -220,7 +220,7 @@ { uint8_t id_resp[] = { GSM48_PDISC_MM, - 0x80 | GSM48_MT_MM_AUTH_RESP, /* simulate sequence nr 2 */ + 0x40 | GSM48_MT_MM_AUTH_RESP, /* N(SD) = 1: second uplink MM message after the LU Request */ 0x61, 0xb5, 0x69, 0xf5 /* hardcoded SRES */ }; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43590?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I4c71b404733e53d4e47d9ba5eb555b92eb1a771d Gerrit-Change-Number: 43590 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com>

1 0

[S] Change in osmo-iuh[master]: hnb-test: parse LU Accept IEs after the LAI
by Andrei G 08 Sep '26

08 Sep '26

Andrei G has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43592?usp=email ) Change subject: hnb-test: parse LU Accept IEs after the LAI ...................................................................... hnb-test: parse LU Accept IEs after the LAI The Location Updating Accept begins with the mandatory Location Area Identification, a five octet V IE (3GPP TS 24.008 section 9.2.13). The optional TLV IEs, among them the Mobile Identity carrying a new TMSI, start after it. hnb-test handed the whole message body to tlv_parse(), which read the first LAI octet as an IEI and failed with OSMO_TLVP_ERR_UNKNOWN_TLV_TYPE. The TMSI Reallocation Complete was therefore never sent, and osmo-msc, which allocates a TMSI by default, released the connection with a Location Updating Reject when its timer expired. Start the parser after the LAI, and read the identity type from the Mobile Identity IE instead of the Network Name IE, which is not present in this message and would have been dereferenced as NULL. Change-Id: I2e1eb8e1bc3db5f20b04a3161713c8a47847c6dc Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test.c 1 file changed, 8 insertions(+), 2 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/92/43592/1 diff --git a/tests/hnb-test.c b/tests/hnb-test.c index 6eca9df..be9f170 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -298,14 +298,20 @@ int parse_res; len -= (const char *)&gh->data[0] - (const char *)gh; - parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[0], len, 0, 0); + + /* The Location Area Identification is a mandatory V IE of five octets + * at the start of the message body (TS 24.008 section 9.2.13); the + * TLV parser must start after it, or it takes the first LAI octet for + * an unknown IEI and fails. */ + parse_res = tlv_parse(&tp, &gsm48_mm_att_tlvdef, &gh->data[sizeof(*lai)], + len - sizeof(*lai), 0, 0); if (parse_res <= 0) { printf("Error parsing Location Update Accept message: %d\n", parse_res); return -1; } if (TLVP_PRESENT(&tp, GSM48_IE_MOBILE_ID)) { - uint8_t type = TLVP_VAL(&tp, GSM48_IE_NAME_SHORT)[0] & 0x0f; + uint8_t type = TLVP_VAL(&tp, GSM48_IE_MOBILE_ID)[0] & 0x0f; if (type == GSM_MI_TYPE_TMSI) *sent_tmsi = 1; else *sent_tmsi = 0; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43592?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: I2e1eb8e1bc3db5f20b04a3161713c8a47847c6dc Gerrit-Change-Number: 43592 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com>

1 0

[M] Change in osmo-iuh[master]: hnb-test: answer UMTS AKA with the full RES
by Andrei G 08 Sep '26

08 Sep '26

Andrei G has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email ) Change subject: hnb-test: answer UMTS AKA with the full RES ...................................................................... hnb-test: answer UMTS AKA with the full RES On UTRAN the MSC only accepts UMTS AKA. hnb-test computed a COMP128v1 SRES for every challenge, and osmo-msc rejected the four octet answer with "AUTH via UTRAN, cannot allow GSM AKA", so the Location Update never passed authentication. Detect the AUTN IE in the MM Authentication Request. When it is there, compute the Milenage RES (K is the existing test key, OP is 0) and send it the way a UE does, per 3GPP TS 24.008 section 9.2.3: the first four octets in the mandatory SRES field, the rest in the Authentication Response Parameter extension IE. Without AUTN, keep the GSM AKA answer. The computation is shared with the GMM handlers added later in this series. Replies so far went out on the CS signalling connection only. Record the PS channel opened by "channel ps ...", let the RUA layer set the current channel from the CN domain indicator of each DirectTransfer, and reply on that one, so a PS connection can answer a challenge from the SGSN. Forget a channel when the CN sends RUA Disconnect, so a later "channel" command can open a new connection. Change-Id: Ida588b3ea93c51196fb3a29ed9544dfc4fe4fc30 Signed-off-by: Andrei Gosman <andrei.gosman(a)gmail.com> --- M tests/hnb-test-layers.h M tests/hnb-test-rua.c M tests/hnb-test.c M tests/hnb-test.h 4 files changed, 159 insertions(+), 31 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-iuh refs/changes/91/43591/1 diff --git a/tests/hnb-test-layers.h b/tests/hnb-test-layers.h index 6211661..a165dcf 100644 --- a/tests/hnb-test-layers.h +++ b/tests/hnb-test-layers.h @@ -7,6 +7,7 @@ /* main calls RUA */ void hnb_test_rua_dt_handle(struct hnb_test *hnb, struct ANY *in); void hnb_test_rua_cl_handle(struct hnb_test *hnb, struct ANY *in); +void hnb_test_rua_disc_handle(struct hnb_test *hnb, struct ANY *in); /* RUA calls RANAP */ void hnb_test_rua_dt_handle_ranap(void *priv, struct ranap_message_s *ranap_msg); @@ -17,3 +18,7 @@ void hnb_test_rx_secmode_cmd(struct hnb_test *hnb, long ip_alg); void hnb_test_rx_iu_release(struct hnb_test *hnb); void hnb_test_rx_paging(struct hnb_test *hnb, const char *imsi); + +/* authentication answer shared by the MM and GMM handlers (hnb-test.c) */ +extern const uint8_t hnb_test_subscr_key[16]; +int hnb_test_auth_answer(const uint8_t *rand, const uint8_t *autn, uint8_t *res, size_t res_size); diff --git a/tests/hnb-test-rua.c b/tests/hnb-test-rua.c index 0882515..b84087c 100644 --- a/tests/hnb-test-rua.c +++ b/tests/hnb-test-rua.c @@ -1,8 +1,10 @@ #include <asn1c/ANY.h> +#include <osmocom/core/talloc.h> #include <osmocom/ranap/ranap_common_cn.h> #include <osmocom/rua/rua_ies_defs.h> +#include "hnb-test.h" #include "hnb-test-layers.h" void hnb_test_rua_dt_handle(struct hnb_test *hnb, ANY_t *in) @@ -16,12 +18,49 @@ return; } + /* Tell the RANAP/NAS layer which signalling connection this belongs + * to, so that replies go back on the CS or the PS connection. */ + if (ies.cN_DomainIndicator == RUA_CN_DomainIndicator_ps_domain) + hnb->cur_chan = hnb->ps.chan; + else + hnb->cur_chan = hnb->cs.chan; + rc = ranap_cn_rx_co(hnb_test_rua_dt_handle_ranap, hnb, ies.ranaP_Message.buf, ies.ranaP_Message.size); + hnb->cur_chan = NULL; + /* FIXME: what to do with the asn1c-allocated memory */ rua_free_directtransferies(&ies); } +/* The CN released the signalling connection: forget the channel so that a + * new "channel" VTY command can open another one for that domain. */ +void hnb_test_rua_disc_handle(struct hnb_test *hnb, ANY_t *in) +{ + RUA_DisconnectIEs_t ies; + int rc; + + rc = rua_decode_disconnecties(&ies, in); + if (rc < 0) { + printf("failed to decode RUA Disconnect IEs\n"); + return; + } + + if (ies.cN_DomainIndicator == RUA_CN_DomainIndicator_ps_domain) { + printf("RUA Disconnect on the PS domain\n"); + if (hnb->ps.chan) + talloc_free(hnb->ps.chan); + hnb->ps.chan = NULL; + } else { + printf("RUA Disconnect on the CS domain\n"); + if (hnb->cs.chan) + talloc_free(hnb->cs.chan); + hnb->cs.chan = NULL; + } + + rua_free_disconnecties(&ies); +} + void hnb_test_rua_cl_handle(struct hnb_test *hnb, ANY_t *in) { RUA_ConnectionlessTransferIEs_t ies; diff --git a/tests/hnb-test.c b/tests/hnb-test.c index 597d04f..6eca9df 100644 --- a/tests/hnb-test.c +++ b/tests/hnb-test.c @@ -216,17 +216,31 @@ return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); } -static struct msgb *gen_nas_auth_resp(uint8_t *sres) +/* MM Authentication Response, 3GPP TS 24.008 section 9.2.3. For GSM AKA + * only the four octet SRES is present. For UMTS AKA the first four octets + * of RES go into that field and the rest into the Authentication Response + * Parameter (extension) IE, as a UE does. The message type octet carries + * N(SD) = 1: it is the second uplink MM message on the connection, after + * the Location Updating Request (TS 24.007 section 11.2.3.2.3). */ +static struct msgb *gen_nas_auth_resp(const uint8_t *res, unsigned int res_len) { - uint8_t id_resp[] = { - GSM48_PDISC_MM, - 0x40 | GSM48_MT_MM_AUTH_RESP, /* N(SD) = 1: second uplink MM message after the LU Request */ - 0x61, 0xb5, 0x69, 0xf5 /* hardcoded SRES */ - }; + uint8_t buf[2 + 4 + 2 + 12]; + unsigned int len = 0; - memcpy(id_resp + 2, sres, 4); + OSMO_ASSERT(res_len >= 4 && res_len <= 16); - return ranap_new_msg_dt(0, id_resp, sizeof(id_resp)); + buf[len++] = GSM48_PDISC_MM; + buf[len++] = 0x40 | GSM48_MT_MM_AUTH_RESP; + memcpy(buf + len, res, 4); + len += 4; + if (res_len > 4) { + buf[len++] = GSM48_IE_AUTH_RES_EXT; + buf[len++] = res_len - 4; + memcpy(buf + len, res + 4, res_len - 4); + len += res_len - 4; + } + + return ranap_new_msg_dt(0, buf, len); } static int hnb_test_tx_dt(struct hnb_test *hnb, struct msgb *txm) @@ -234,9 +248,12 @@ struct hnbtest_chan *chan; struct msgb *rua; - chan = hnb->cs.chan; + /* Reply on the connection the message being handled arrived on; + * outside of a receive path fall back to the CS connection. */ + chan = hnb->cur_chan ? hnb->cur_chan : hnb->cs.chan; if (!chan) { - printf("hnb_test_nas_tx_tmsi_realloc_compl(): No CS channel established yet.\n"); + printf("hnb_test_tx_dt(): No signalling connection established yet.\n"); + msgb_free(txm); return -1; } @@ -320,10 +337,77 @@ } } +/* Secret of the test subscriber: Ki for GSM AKA (COMP128v1) and K for + * UMTS AKA (Milenage, OP = 0). The same 16 octets are used for both so + * that one HLR entry serves both algorithms. */ +const uint8_t hnb_test_subscr_key[16] = { + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, + 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f +}; + +/* Compute the answer to an authentication challenge. With an AUTN the + * challenge is UMTS AKA and the answer is the full RES from Milenage; + * without one it is GSM AKA and the answer is the SRES from COMP128v1. + * Returns the length of the answer written to res, or negative. */ +int hnb_test_auth_answer(const uint8_t *rand, const uint8_t *autn, + uint8_t *res, size_t res_size) +{ + struct osmo_auth_vector vec; + struct osmo_sub_auth_data2 auth; + int rc; + + memset(&vec, 0, sizeof(vec)); + memset(&auth, 0, sizeof(auth)); + + if (autn) { + /* Milenage wants the RES length it shall produce (4 or 8) */ + vec.res_len = 8; + auth.type = OSMO_AUTH_TYPE_UMTS; + auth.algo = OSMO_AUTH_ALG_MILENAGE; + memcpy(auth.u.umts.k, hnb_test_subscr_key, sizeof(hnb_test_subscr_key)); + auth.u.umts.k_len = sizeof(hnb_test_subscr_key); + auth.u.umts.opc_len = 16; /* OP = 0, derived to OPc */ + auth.u.umts.opc_is_op = 1; + auth.u.umts.ind_bitlen = 5; + } else { + auth.type = OSMO_AUTH_TYPE_GSM; + auth.algo = OSMO_AUTH_ALG_COMP128v1; + memcpy(auth.u.gsm.ki, hnb_test_subscr_key, sizeof(hnb_test_subscr_key)); + } + + rc = osmo_auth_gen_vec2(&vec, &auth, rand); + if (rc < 0) { + printf("osmo_auth_gen_vec2() failed: %d\n", rc); + return rc; + } + + if (autn) { + if (vec.res_len > res_size) + return -ENOSPC; + memcpy(res, vec.res, vec.res_len); + printf("UMTS AKA: rand %s", osmo_hexdump_nospc(rand, 16)); + printf(" autn %s", osmo_hexdump_nospc(autn, 16)); + printf(" --> res %s\n", osmo_hexdump_nospc(vec.res, vec.res_len)); + return vec.res_len; + } + + if (res_size < sizeof(vec.sres)) + return -ENOSPC; + memcpy(res, vec.sres, sizeof(vec.sres)); + printf("GSM AKA: rand %s", osmo_hexdump_nospc(rand, 16)); + printf(" --> sres %s\n", osmo_hexdump_nospc(vec.sres, sizeof(vec.sres))); + return sizeof(vec.sres); +} + static int hnb_test_nas_rx_auth_req(struct hnb_test *hnb, struct gsm48_hdr *gh, int len) { struct gsm48_auth_req *ar; + const uint8_t *autn = NULL; + const uint8_t *ie; + int ie_len; + uint8_t res[16]; + int res_len; len -= (const char *)&gh->data[0] - (const char *)gh; @@ -335,30 +419,21 @@ printf(" :) Authentication Request :)\n"); ar = (struct gsm48_auth_req*) &gh->data[0]; - int seq = ar->key_seq; - /* Generate SRES from *HARDCODED* Ki for Iuh testing */ - struct osmo_auth_vector vec; - /* Ki 000102030405060708090a0b0c0d0e0f */ - struct osmo_sub_auth_data2 auth = { - .type = OSMO_AUTH_TYPE_GSM, - .algo = OSMO_AUTH_ALG_COMP128v1, - .u.gsm.ki = { - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, - 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, - 0x0e, 0x0f - }, - }; + /* Optional AUTN (TLV, IEI 0x20) after the fixed part marks a UMTS + * AKA challenge, TS 24.008 section 9.2.2. */ + ie = &gh->data[sizeof(*ar)]; + ie_len = len - sizeof(*ar); + if (ie_len >= 2 + 16 && ie[0] == GSM48_IE_AUTN && ie[1] == 16) + autn = &ie[2]; - memset(&vec, 0, sizeof(vec)); - osmo_auth_gen_vec2(&vec, &auth, ar->rand); + printf("seq %d %s\n", ar->key_seq, autn ? "(UMTS AKA, AUTN present)" : "(GSM AKA)"); - printf("seq %d rand %s", - seq, osmo_hexdump(ar->rand, sizeof(ar->rand))); - printf(" --> sres %s\n", - osmo_hexdump(vec.sres, 4)); + res_len = hnb_test_auth_answer(ar->rand, autn, res, sizeof(res)); + if (res_len < 0) + return res_len; - return hnb_test_tx_dt(hnb, gen_nas_auth_resp(vec.sres)); + return hnb_test_tx_dt(hnb, gen_nas_auth_resp(res, res_len)); } void hnb_test_tx_iu_release_req(struct hnb_test *hnb) @@ -550,6 +625,7 @@ break; case RUA_ProcedureCode_id_Disconnect: printf("RUA rx Disconnect\n"); + hnb_test_rua_disc_handle(hnb, &pdu->choice.successfulOutcome.value); break; case RUA_ProcedureCode_id_ErrorIndication: printf("RUA rx ErrorIndication\n"); @@ -892,7 +968,9 @@ vty->index = chan; vty->node = CHAN_NODE; - if (!chan->is_ps) + if (chan->is_ps) + g_hnb_test.ps.chan = chan; + else g_hnb_test.cs.chan = chan; diff --git a/tests/hnb-test.h b/tests/hnb-test.h index 02efce0..44fba35 100644 --- a/tests/hnb-test.h +++ b/tests/hnb-test.h @@ -72,6 +72,12 @@ struct { struct hnbtest_chan *chan; } cs; + struct { + struct hnbtest_chan *chan; + } ps; + /*! channel the RANAP/NAS message being handled arrived on, set by the + * RUA layer from the CN domain indicator of the DirectTransfer */ + struct hnbtest_chan *cur_chan; }; extern struct hnb_test g_hnb_test; -- To view, visit https://gerrit.osmocom.org/c/osmo-iuh/+/43591?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: osmo-iuh Gerrit-Branch: master Gerrit-Change-Id: Ida588b3ea93c51196fb3a29ed9544dfc4fe4fc30 Gerrit-Change-Number: 43591 Gerrit-PatchSet: 1 Gerrit-Owner: Andrei G <andrei.gosman(a)gmail.com>

1 0

2026

2025

2024

2023

2022

gerrit-log September 2026