- gerrit-log - lists.osmocom.org

[M] Change in osmo-ttcn3-hacks[master]: mme: Move LTE_CryptoFunction* to library/
by pespin 05 Jun '25

05 Jun '25

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40420?usp=email ) Change subject: mme: Move LTE_CryptoFunction* to library/ ...................................................................... mme: Move LTE_CryptoFunction* to library/ S1AP_Emulation is already importing LTE_CryptoFunction.ttcn, so it really belongs to library and not to mme/ directory. While at it, split Snow3G algos to its own subdir so it can be easily exported standalone, eg. when used by 5G NAS in the future. Change-Id: I76f86beeb2c49110eea0fac6abffee8307a3c22c --- A library/LTE_CryptoFunctionDefs.cc R library/LTE_CryptoFunctions.ttcn R library/lte_crypto/key_derivation.c R library/lte_crypto/key_derivation.h R library/snow_3g/Snow3G_FunctionDefs.cc A library/snow_3g/Snow3G_Functions.ttcn R library/snow_3g/snow-3g.c R library/snow_3g/snow-3g.h M mme/gen_links.sh M mme/regen_makefile.sh 10 files changed, 125 insertions(+), 72 deletions(-) Approvals: laforge: Looks good to me, but someone else must approve fixeria: Looks good to me, approved Jenkins Builder: Verified diff --git a/library/LTE_CryptoFunctionDefs.cc b/library/LTE_CryptoFunctionDefs.cc new file mode 100644 index 0000000..fafb22a --- /dev/null +++ b/library/LTE_CryptoFunctionDefs.cc @@ -0,0 +1,89 @@ +/* Utility functions from ogslib imported to TTCN-3 + * + * (C) 2019 Harald Welte <laforge(a)gnumonks.org> + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <stdint.h> + +#include <Boolean.hh> +#include <Integer.hh> +#include <Octetstring.hh> +#include <Bitstring.hh> + +#include "key_derivation.h" + +namespace LTE__CryptoFunctions { + +OCTETSTRING f__kdf__kasme(const OCTETSTRING& ck, const OCTETSTRING& ik, const OCTETSTRING& plmn_id, + const OCTETSTRING& sqn, const OCTETSTRING& ak) +{ + TTCN_Buffer ttcn_buf_ck(ck); + TTCN_Buffer ttcn_buf_ik(ik); + TTCN_Buffer ttcn_buf_plmn_id(plmn_id); + TTCN_Buffer ttcn_buf_sqn(sqn); + TTCN_Buffer ttcn_buf_ak(ak); + uint8_t kasme[32]; + + hss_auc_kasme(ttcn_buf_ck.get_data(), ttcn_buf_ik.get_data(), ttcn_buf_plmn_id.get_data(), + ttcn_buf_sqn.get_data(), ttcn_buf_ak.get_data(), kasme); + return OCTETSTRING(sizeof(kasme), kasme); +} + +OCTETSTRING f__kdf__nas__int(const INTEGER& alg_id, const OCTETSTRING &kasme) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + uint8_t knas[16]; + + mme_kdf_nas(MME_KDF_NAS_INT_ALG, (int)alg_id, (const uint8_t*) ttcn_buf_kasme.get_data(), knas); + return OCTETSTRING(sizeof(knas), knas); +} + +OCTETSTRING f__kdf__nas__enc(const INTEGER& alg_id, const OCTETSTRING &kasme) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + uint8_t knas[16]; + + mme_kdf_nas(MME_KDF_NAS_ENC_ALG, (int)alg_id, (const uint8_t*) ttcn_buf_kasme.get_data(), knas); + return OCTETSTRING(sizeof(knas), knas); +} + + +OCTETSTRING f__kdf__enb(const OCTETSTRING &kasme, const INTEGER &ul_count) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + uint8_t kenb[32]; + + mme_kdf_enb(ttcn_buf_kasme.get_data(), (int)ul_count, kenb); + return OCTETSTRING(sizeof(kenb), kenb); +} + +OCTETSTRING f__kdf__nh(const OCTETSTRING &kasme, const OCTETSTRING &sync_inp) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + TTCN_Buffer ttcn_buf_sync_inp(sync_inp); + uint8_t kenb[32]; + + mme_kdf_nh(ttcn_buf_kasme.get_data(), ttcn_buf_sync_inp.get_data(), kenb); + return OCTETSTRING(sizeof(kenb), kenb); +} + +OCTETSTRING f__kdf__nas__token(const OCTETSTRING &kasme, const INTEGER &ul_count) +{ + TTCN_Buffer ttcn_buf_kasme(kasme); + uint8_t nas_token[32]; + + mme_kdf_nas_token(ttcn_buf_kasme.get_data(), (int)ul_count, nas_token); + return OCTETSTRING(sizeof(nas_token), nas_token); +} + + +} // namespace diff --git a/mme/LTE_CryptoFunctions.ttcn b/library/LTE_CryptoFunctions.ttcn similarity index 96% rename from mme/LTE_CryptoFunctions.ttcn rename to library/LTE_CryptoFunctions.ttcn index fafcb34..57e0c4d 100644 --- a/mme/LTE_CryptoFunctions.ttcn +++ b/library/LTE_CryptoFunctions.ttcn @@ -14,6 +14,8 @@ import from General_Types all; import from Misc_Helpers all; +import from Snow3G_Functions all; + import from S1AP_Types all; import from S1AP_PDU_Descriptions all; @@ -24,12 +26,6 @@ * low-level API (external C/C++ code) *********************************************************************************/ -external function f_snow_3g_f8(in OCT16 key, in integer count, in integer bearer, - in boolean is_downlink, in octetstring data) return octetstring; - -external function f_snow_3g_f9(in OCT16 key, in integer count, in integer fresh, - in boolean is_downlink, in octetstring data) return OCT4; - external function f_kdf_kasme(in OCT16 ck, in OCT16 ik, in OCT3 plmn_id, in OCT6 sqn, in OCT6 ak) return OCT32; diff --git a/mme/key_derivation.c b/library/lte_crypto/key_derivation.c similarity index 100% rename from mme/key_derivation.c rename to library/lte_crypto/key_derivation.c diff --git a/mme/key_derivation.h b/library/lte_crypto/key_derivation.h similarity index 100% rename from mme/key_derivation.h rename to library/lte_crypto/key_derivation.h diff --git a/mme/LTE_CryptoFunctionDefs.cc b/library/snow_3g/Snow3G_FunctionDefs.cc similarity index 65% rename from mme/LTE_CryptoFunctionDefs.cc rename to library/snow_3g/Snow3G_FunctionDefs.cc index 7f82224..340afda 100644 --- a/mme/LTE_CryptoFunctionDefs.cc +++ b/library/snow_3g/Snow3G_FunctionDefs.cc @@ -20,7 +20,6 @@ #include <Bitstring.hh> #include "snow-3g.h" -#include "key_derivation.h" //#define DEBUG @@ -70,7 +69,7 @@ } #endif -namespace LTE__CryptoFunctions { +namespace Snow3G__Functions { /* f8. @@ -131,67 +130,4 @@ return OCTETSTRING(4, tmp); } -OCTETSTRING f__kdf__kasme(const OCTETSTRING& ck, const OCTETSTRING& ik, const OCTETSTRING& plmn_id, - const OCTETSTRING& sqn, const OCTETSTRING& ak) -{ - TTCN_Buffer ttcn_buf_ck(ck); - TTCN_Buffer ttcn_buf_ik(ik); - TTCN_Buffer ttcn_buf_plmn_id(plmn_id); - TTCN_Buffer ttcn_buf_sqn(sqn); - TTCN_Buffer ttcn_buf_ak(ak); - uint8_t kasme[32]; - - hss_auc_kasme(ttcn_buf_ck.get_data(), ttcn_buf_ik.get_data(), ttcn_buf_plmn_id.get_data(), - ttcn_buf_sqn.get_data(), ttcn_buf_ak.get_data(), kasme); - return OCTETSTRING(sizeof(kasme), kasme); -} - -OCTETSTRING f__kdf__nas__int(const INTEGER& alg_id, const OCTETSTRING &kasme) -{ - TTCN_Buffer ttcn_buf_kasme(kasme); - uint8_t knas[16]; - - mme_kdf_nas(MME_KDF_NAS_INT_ALG, (int)alg_id, (const u8*) ttcn_buf_kasme.get_data(), knas); - return OCTETSTRING(sizeof(knas), knas); -} - -OCTETSTRING f__kdf__nas__enc(const INTEGER& alg_id, const OCTETSTRING &kasme) -{ - TTCN_Buffer ttcn_buf_kasme(kasme); - uint8_t knas[16]; - - mme_kdf_nas(MME_KDF_NAS_ENC_ALG, (int)alg_id, (const u8*) ttcn_buf_kasme.get_data(), knas); - return OCTETSTRING(sizeof(knas), knas); -} - - -OCTETSTRING f__kdf__enb(const OCTETSTRING &kasme, const INTEGER &ul_count) -{ - TTCN_Buffer ttcn_buf_kasme(kasme); - uint8_t kenb[32]; - - mme_kdf_enb(ttcn_buf_kasme.get_data(), (int)ul_count, kenb); - return OCTETSTRING(sizeof(kenb), kenb); -} - -OCTETSTRING f__kdf__nh(const OCTETSTRING &kasme, const OCTETSTRING &sync_inp) -{ - TTCN_Buffer ttcn_buf_kasme(kasme); - TTCN_Buffer ttcn_buf_sync_inp(sync_inp); - uint8_t kenb[32]; - - mme_kdf_nh(ttcn_buf_kasme.get_data(), ttcn_buf_sync_inp.get_data(), kenb); - return OCTETSTRING(sizeof(kenb), kenb); -} - -OCTETSTRING f__kdf__nas__token(const OCTETSTRING &kasme, const INTEGER &ul_count) -{ - TTCN_Buffer ttcn_buf_kasme(kasme); - uint8_t nas_token[32]; - - mme_kdf_nas_token(ttcn_buf_kasme.get_data(), (int)ul_count, nas_token); - return OCTETSTRING(sizeof(nas_token), nas_token); -} - - } // namespace diff --git a/library/snow_3g/Snow3G_Functions.ttcn b/library/snow_3g/Snow3G_Functions.ttcn new file mode 100644 index 0000000..3662163 --- /dev/null +++ b/library/snow_3g/Snow3G_Functions.ttcn @@ -0,0 +1,22 @@ +/* Utility functions from ogslib imported to TTCN-3 + * + * (C) 2019 Harald Welte <laforge(a)gnumonks.org> + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +module Snow3G_Functions { + +import from General_Types all; + +external function f_snow_3g_f8(in OCT16 key, in integer count, in integer bearer, + in boolean is_downlink, in octetstring data) return octetstring; + +external function f_snow_3g_f9(in OCT16 key, in integer count, in integer fresh, + in boolean is_downlink, in octetstring data) return OCT4; + +} // namespace diff --git a/mme/snow-3g.c b/library/snow_3g/snow-3g.c similarity index 100% rename from mme/snow-3g.c rename to library/snow_3g/snow-3g.c diff --git a/mme/snow-3g.h b/library/snow_3g/snow-3g.h similarity index 100% rename from mme/snow-3g.h rename to library/snow_3g/snow-3g.h diff --git a/mme/gen_links.sh b/mme/gen_links.sh index e2e9fb0..af0355f 100755 --- a/mme/gen_links.sh +++ b/mme/gen_links.sh @@ -69,12 +69,21 @@ FILES+="S1AP_EncDec.cc S1AP_Types.ttcn S1AP_Templates.ttcn " gen_links $DIR $FILES +DIR=../library/snow_3g +FILES="snow-3g.c snow-3g.h Snow3G_FunctionDefs.cc Snow3G_Functions.ttcn " +gen_links $DIR $FILES + +DIR=../library/lte_crypto +FILES="key_derivation.c key_derivation.h " +gen_links $DIR $FILES + DIR=../library FILES="Misc_Helpers.ttcn General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPCP_Types.ttcn IPCP_Templates.ttcn " FILES+="SGsAP_Templates.ttcn SGsAP_CodecPort.ttcn SGsAP_CodecPort_CtrlFunct.ttcn SGsAP_CodecPort_CtrlFunctDef.cc SGsAP_Emulation.ttcn DNS_Helpers.ttcn " FILES+="L3_Templates.ttcn RLCMAC_CSN1_Templates.ttcn RLCMAC_CSN1_Types.ttcn " FILES+="S1AP_CodecPort.ttcn S1AP_CodecPort_CtrlFunctDef.cc S1AP_CodecPort_CtrlFunct.ttcn S1AP_Functions.ttcn S1AP_Emulation.ttcn " -FILES+="NAS_EPS_Templates.ttcn GTPv2_PrivateExtensions.ttcn GTPv2_Templates.ttcn " +FILES+="NAS_EPS_Templates.ttcn LTE_CryptoFunctionDefs.cc LTE_CryptoFunctions.ttcn " +FILES+="GTPv2_PrivateExtensions.ttcn GTPv2_Templates.ttcn " FILES+="DIAMETER_Types.ttcn DIAMETER_CodecPort.ttcn DIAMETER_CodecPort_CtrlFunct.ttcn DIAMETER_CodecPort_CtrlFunctDef.cc DIAMETER_Emulation.ttcn " FILES+="DIAMETER_Templates.ttcn DIAMETER_ts29_272_Templates.ttcn " FILES+="GTPv1C_CodecPort.ttcn GTPv1C_CodecPort_CtrlFunct.ttcn GTPv1C_CodecPort_CtrlFunctDef.cc GTPv1U_CodecPort.ttcn GTPv1U_CodecPort_CtrlFunct.ttcn GTPv1U_CodecPort_CtrlFunctDef.cc GTP_Emulation.ttcn GTPv1C_Templates.ttcn Osmocom_Gb_Types.ttcn " diff --git a/mme/regen_makefile.sh b/mme/regen_makefile.sh index 768fbd2..4eb0f1a 100755 --- a/mme/regen_makefile.sh +++ b/mme/regen_makefile.sh @@ -21,6 +21,7 @@ S1AP_CodecPort_CtrlFunctDef.cc S1AP_EncDec.cc SGsAP_CodecPort_CtrlFunctDef.cc + Snow3G_FunctionDefs.cc TCCConversion.cc TCCEncoding.cc TCCInterface.cc -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40420?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I76f86beeb2c49110eea0fac6abffee8307a3c22c Gerrit-Change-Number: 40420 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in osmo-ttcn3-hacks[master]: 5gc: Implement AKA authentication
by pespin 05 Jun '25

05 Jun '25

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40413?usp=email ) Change subject: 5gc: Implement AKA authentication ...................................................................... 5gc: Implement AKA authentication deps/nas.git already has some Auth related functionaltities to calculate XRES*, but I couldn't get them to generate proper output. Furthermore, using them directly would include a lot of churn we don't want: * ttcn: Otherwise ttcn/Lib_NG_NAS/LIB_NG_NAS_Functions.ttcn brings in tons of dependencies about Emulation stuff which is not interesting for us. * .cc: We want to implement our own low level functions using our eclipse Titan API, as well as our own C lib dependencies (because some code for those dependencies is not really available in the repo). Hence, instead use our own milenage.c implementation imported from libosmocore (actually from a slightly modified self-contained copy we already ported to some development branch of asterisk VoLTE project). With this patch it is already possible to detect SQN Out-of-sync and answer with an Auth Failure, then get a new Auth Req from network and properly answer with an Auth Resp which the network likes and hence answers with a Security Mode Command. Change-Id: I11527f47e4310863124f3f02148e3f71da7d911e --- M 5gc/C5G_Tests.cfg M 5gc/C5G_Tests.ttcn M 5gc/gen_links.sh M 5gc/regen_makefile.sh M deps/Makefile M library/General_Types.ttcn A library/NG_CryptoFunctionDefs.cc A library/NG_CryptoFunctions.ttcn M library/NG_NAS_Osmo_Templates.ttcn A library/milenage/Milenage_FunctionDefs.cc A library/milenage/Milenage_Functions.ttcn A library/milenage/milenage.c A library/milenage/milenage.h A library/ng_crypto/key_derivation.c A library/ng_crypto/key_derivation.h 15 files changed, 837 insertions(+), 17 deletions(-) Approvals: jolly: Looks good to me, but someone else must approve Jenkins Builder: Verified laforge: Looks good to me, but someone else must approve pespin: Looks good to me, approved diff --git a/5gc/C5G_Tests.cfg b/5gc/C5G_Tests.cfg index 85ad9a3..d45b963 100644 --- a/5gc/C5G_Tests.cfg +++ b/5gc/C5G_Tests.cfg @@ -16,6 +16,9 @@ mp_5gc_ngap_port := 38412; mp_local_ngap_ip := "127.0.0.202"; mp_local_ngap_port := 50000; +mp_imsi := '999700000000000'H; +mp_usim_key := '762a2206fe0b4151ace403c86a11e479'O; +mp_usim_opc := '3c6e0b8a9c15224a8228b9a98ca1531d'O; [MAIN_CONTROLLER] diff --git a/5gc/C5G_Tests.ttcn b/5gc/C5G_Tests.ttcn index 9b45298..9cf5ec3 100644 --- a/5gc/C5G_Tests.ttcn +++ b/5gc/C5G_Tests.ttcn @@ -19,6 +19,8 @@ import from Osmocom_Types all; import from GSM_Types all; +import from Milenage_Functions all; + import from NGAP_PDU_Descriptions all; import from NGAP_IEs all; import from NGAP_PDU_Contents all; @@ -31,14 +33,14 @@ import from NGAP_Emulation all; import from NAS_CommonTypeDefs all; - +import from NAS_CommonTemplates all; import from NG_NAS_Common all; import from NG_NAS_MsgContainers all; -import from NAS_CommonTemplates all; import from NG_NAS_Templates all; import from NG_NAS_Osmo_Templates all; import from NG_NAS_Functions all; +import from NG_CryptoFunctions all; /* (maximum) number of emulated eNBs */ const integer NUM_NGRAN := 1; @@ -56,6 +58,8 @@ GsmMcc mp_mcc := '999'H; GsmMnc mp_mnc := '70'H; hexstring mp_imsi := '999700000000000'H; + octetstring mp_usim_key := '762a2206fe0b4151ace403c86a11e479'O; + octetstring mp_usim_opc := '3c6e0b8a9c15224a8228b9a98ca1531d'O; uint24_t mp_tac := 1; } @@ -69,6 +73,8 @@ /* parameters of emulated UE */ type record UeParams { hexstring imsi, + octetstring usim_key, + octetstring usim_opc, charstring ue_ip } @@ -145,6 +151,8 @@ uep := { imsi := f_concat_pad(lengthof(mp_imsi), substr(mp_imsi, 0, lengthof(mp_imsi) - 6), imsi_suffix), + usim_key := mp_usim_key, + usim_opc := mp_usim_opc, ue_ip := "192.168.123.50" } } @@ -211,12 +219,18 @@ iE_Extensions := omit } -private function f_SUCI_IMSI() runs on ConnHdlr return octetstring { +private function f_imsi_plmn_id() runs on ConnHdlr return PLMNIdentity { var hexstring imsi := g_pars.ue_pars.imsi; var GsmMcc mcc := substr(imsi, 0, 3); var GsmMnc mnc := substr(imsi, 3, 2); - var octetstring imsi_suffix := imsi_hex2oct(substr(imsi, lengthof(imsi)-10, 10)); - return f_enc_mcc_mnc(mcc, mnc) & '21430001'O & imsi_suffix; + return f_enc_mcc_mnc(mcc, mnc); +} + +private function f_SUCI_IMSI() runs on ConnHdlr return octetstring { + var hexstring imsi := g_pars.ue_pars.imsi; + var PLMNIdentity plmn_id := f_imsi_plmn_id(); + var octetstring imsi_suffix := imsi_hex2oct(substr(imsi, lengthof(imsi) - 10, 10)); + return plmn_id & '21430001'O & imsi_suffix; } friend function f_ngap_setup(integer idx := 0, template (omit) NGAP_IEs.Cause cause := omit) runs on MTC_CT { @@ -270,17 +284,60 @@ } } -private altstep as_ngap_handle_auth() runs on ConnHdlr { +/* 3GPP TS 24.501 5.4.1.3.2, 3GPP TS 33.501 6.1.3.2 */ +private altstep as_ngap_handle_auth(boolean allow_resync := true) runs on ConnHdlr { var NG_NAS_DL_Message_Type rx_nas; var template (present) NAS_KeySetIdentifier kset_id := f_tr_ConnHdlr_kset_id(); [] NGAP.receive(cr_NG_AUTHENTICATION_REQUEST) -> value rx_nas { log("Rx NAS message: ", rx_nas); + var integer ret; + var integer my_sqn := 0; /* TODO: move to a ConnHdlr state attribute? */ + var OCT16 rand := bit2oct(rx_nas.authentication_Request.rand.randValue); + var OCT16 autn := bit2oct(rx_nas.authentication_Request.autn.aUTN); + var OCT16 ik; + var OCT16 ck; + var OCT8 res; + var OCT14 auts; g_pars.kset_id := rx_nas.authentication_Request.ngNasKeySetId; - /* TODO: generate proper RES, 3GPP TS 33.501 A.4 */ - const OCT8 res := '6a91970e838fd079'O; - NGAP.send(cs_NG_AUTHENTICATION_RESPONSE(cs_AuthenticationResponseParameter(oct2bit(res)))); + ret := f_milenage_check(g_pars.ue_pars.usim_key, + g_pars.ue_pars.usim_opc, + int2oct(my_sqn, 8), + rand, autn, ik, ck, res, auts); + if (ret == -1) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + log2str("fx_milenage_check() failed! -1")); + } + if (ret == -2) { + if (not allow_resync) { + Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, + log2str("fx_milenage_check() unexpected Resync!")); + } + log("Milenage: RX-SQN differs from SIM SQN: Re-Sync! AUTS=", auts); + /* 3GPP TS 24.501 5.4.1.3.6 d) */ + NGAP.send(cs_NG_AUTHENTICATION_FAILURE(cs_GMM_GSM_Cause(omit, int2bit(21, 8)), + cs_AuthFailParam(oct2bit(auts)))); + as_ngap_handle_auth(allow_resync := false); + return; + } + + /* Derive (X)RES* from (X)RES, 3GPP TS 33.501 A.4 */ + var octetstring ssn := f_NG_NAS_ServingNetworkName_OCT(f_imsi_plmn_id(), omit); + var OCT16 res_star := f_kdf_xres_star(ssn, ck, ik, rand, res); + log("Auth Response: RES=", res, ", SSN=", ssn, " / ", oct2char(ssn), ", RES*=", res_star); + + NGAP.send(cs_NG_AUTHENTICATION_RESPONSE(cs_AuthenticationResponseParameter(oct2bit(res_star)))); + } +} + +private altstep as_ngap_handle_sec_mode() runs on ConnHdlr { + var NG_NAS_DL_Message_Type rx_nas; + + [] NGAP.receive(cr_NG_SECURITY_PROTECTED_NAS_MESSAGE) -> value rx_nas { + var NG_NAS_DL_Message_Type in_nas := dec_NG_NAS_DL_Message_Type(rx_nas.security_Protected_Nas_Message.plainNASMessage); + log("PESPIN: Rx inner NAS: ", in_nas); + /* TODO: apply below integrity and ciphering based on Security Mode Command */ } } @@ -320,6 +377,7 @@ } as_ngap_handle_auth(); + as_ngap_handle_sec_mode(); /* TODO: handle Auth, SecurityModeCommand, InitialContextSetup, PDUSessionresource, */ f_sleep(5.0); diff --git a/5gc/gen_links.sh b/5gc/gen_links.sh index 295ca24..9f67736 100755 --- a/5gc/gen_links.sh +++ b/5gc/gen_links.sh @@ -61,12 +61,21 @@ FILES+="NGAP_EncDec.cc NGAP_Types.ttcn NGAP_Pixits.ttcn NGAP_Templates.ttcn " gen_links $DIR $FILES +DIR=../library/milenage +FILES="milenage.c milenage.h Milenage_FunctionDefs.cc Milenage_Functions.ttcn " +gen_links $DIR $FILES + +DIR=../library/ng_crypto +FILES="key_derivation.c key_derivation.h " +gen_links $DIR $FILES + DIR=../library FILES="Misc_Helpers.ttcn General_Types.ttcn GSM_Types.ttcn Osmocom_Types.ttcn Native_Functions.ttcn Native_FunctionDefs.cc IPCP_Types.ttcn IPCP_Templates.ttcn " FILES+="SCTP_Templates.ttcn " FILES+="DNS_Helpers.ttcn " FILES+="NGAP_CodecPort.ttcn NGAP_CodecPort_CtrlFunctDef.cc NGAP_CodecPort_CtrlFunct.ttcn NGAP_Functions.ttcn NGAP_Emulation.ttcn " FILES+="NG_NAS_Osmo_Templates.ttcn NG_NAS_Functions.ttcn " +FILES+="NG_CryptoFunctionDefs.cc NG_CryptoFunctions.ttcn " gen_links $DIR $FILES gen_links_finish diff --git a/5gc/regen_makefile.sh b/5gc/regen_makefile.sh index 44f7a56..0d53583 100755 --- a/5gc/regen_makefile.sh +++ b/5gc/regen_makefile.sh @@ -4,13 +4,16 @@ FILES=" *.asn + *.c *.ttcn IPL4asp_PT.cc IPL4asp_discovery.cc Native_FunctionDefs.cc common_ext.cc + Milenage_FunctionDefs.cc NGAP_CodecPort_CtrlFunctDef.cc NGAP_EncDec.cc + NG_CryptoFunctionDefs.cc TCCConversion.cc TCCEncoding.cc TCCInterface.cc diff --git a/deps/Makefile b/deps/Makefile index aa2b36c..b7e06cb 100644 --- a/deps/Makefile +++ b/deps/Makefile @@ -85,7 +85,7 @@ # Do not put references to branches here, except for local testing: this breaks the caching # logic of docker containers, which only invalidate their cached ttcn3 dependencies if this # file changed. -nas_commit= 4371752494b7c85cd5a3bc32bc6f498171c7aa13 +nas_commit= f7921c4d88e204e09067f0975957d075be82e800 titan.Libraries.TCCUsefulFunctions_commit= R.35.B-6-gb3687da titan.ProtocolEmulations.M3UA_commit= b58f92046e48a7b1ed531e243a2319ebca53bf4c titan.ProtocolEmulations.SCCP_commit= 750a3e836831e58eae59d4757ef5d0c759f9ca5d diff --git a/library/General_Types.ttcn b/library/General_Types.ttcn index 2daa593..163ec47 100644 --- a/library/General_Types.ttcn +++ b/library/General_Types.ttcn @@ -84,7 +84,11 @@ type bitstring BIT30 length(30) with { variant "FIELDLENGTH(30)" }; type bitstring BIT31 length(31) with { variant "FIELDLENGTH(31)" }; type bitstring BIT32 length(32) with { variant "FIELDLENGTH(32)" }; + type bitstring BIT48 length(48) with { variant "FIELDLENGTH(48)" }; type bitstring BIT56 length(56) with { variant "FIELDLENGTH(56)" }; + type bitstring BIT64 length(64) with { variant "FIELDLENGTH(64)" }; + type bitstring BIT128 length(128) with { variant "FIELDLENGTH(128)" }; + type bitstring BIT256 length(256) with { variant "FIELDLENGTH(256)" }; //**************************************************** // Octetstrings diff --git a/library/NG_CryptoFunctionDefs.cc b/library/NG_CryptoFunctionDefs.cc new file mode 100644 index 0000000..e45e519 --- /dev/null +++ b/library/NG_CryptoFunctionDefs.cc @@ -0,0 +1,40 @@ +/* AKA USIM Utility functions */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <stdint.h> +#include <gnutls/crypto.h> + +#include <Addfunc.hh> +#include <Encdec.hh> +#include <Boolean.hh> +#include <Integer.hh> +#include <Octetstring.hh> +#include <Bitstring.hh> + +#include "key_derivation.h" + +namespace NG__CryptoFunctions { + +/* 3GPP TS 33.501 A.4 RES* and XRES* derivation function */ +OCTETSTRING f__kdf__xres__star(const OCTETSTRING &ssn, const OCTETSTRING& ck, const OCTETSTRING& ik, + const OCTETSTRING& rand, const OCTETSTRING& xres) +{ + TTCN_Buffer ttcn_buf_ssn(ssn); + TTCN_Buffer ttcn_buf_ck(ck); + TTCN_Buffer ttcn_buf_ik(ik); + TTCN_Buffer ttcn_buf_rand(rand); + TTCN_Buffer ttcn_buf_xres(xres); + uint8_t xres_star[16]; + + kdf_xres_star(ttcn_buf_ssn.get_data(), ttcn_buf_ssn.get_len(), + ttcn_buf_ck.get_data(), + ttcn_buf_ik.get_data(), + ttcn_buf_rand.get_data(), + ttcn_buf_xres.get_data(), ttcn_buf_xres.get_len(), + xres_star); + return OCTETSTRING(sizeof(xres_star), xres_star); +} + +} diff --git a/library/NG_CryptoFunctions.ttcn b/library/NG_CryptoFunctions.ttcn new file mode 100644 index 0000000..fbbe57e --- /dev/null +++ b/library/NG_CryptoFunctions.ttcn @@ -0,0 +1,78 @@ +/* Utility crypto functions for NG NAS (5G) + * + * (C) 2025 by sysmocom - s.f.m.c. GmbH <info(a)sysmocom.de> + * Author: Pau Espin Pedrol <pespin(a)sysmocom.de + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +module NG_CryptoFunctions { + +import from General_Types all; +import from Misc_Helpers all; + +import from NAS_CommonTypeDefs all; + +/********************************************************************************* + * low-level API (external C/C++ code) + *********************************************************************************/ + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +external function f_kdf_xres_star(octetstring ssn, OCT16 ck, OCT16 ik, OCT16 rand, + octetstring xres) return OCT16; + +/********************************************************************************* + * mid-level API + *********************************************************************************/ + +function f_NG_NAS_SNN_MNC(NAS_PlmnId plmn_id) return charstring +{ + var charstring mnc := ""; + var hexstring plmn_hex := oct2hex(plmn_id); + + if (plmn_hex[2] == 'F'H) { + mnc := "0"; + } + mnc := mnc & hex2str(plmn_hex[5]) & hex2str(plmn_hex[4]); + if (plmn_hex[2] != 'F'H) { + /* add last digit if not F */ + mnc := mnc & hex2str(plmn_hex[2]); + } + return mnc; +} + +function f_NG_NAS_SNN_MCC(NAS_PlmnId plmn_id) return charstring +{ + var charstring mcc; + var hexstring plmn_hex := oct2hex(plmn_id); + + mcc := hex2str(plmn_hex[1]) & + hex2str(plmn_hex[0]) & + hex2str(plmn_hex[3]); + + return mcc; +} + +function f_NG_NAS_ServingNetworkName(NAS_PlmnId plmn_id, template (omit) hexstring NID := omit) return charstring +{ + var charstring ssn := "5G:mnc" & f_NG_NAS_SNN_MNC(plmn_id) & + ".mcc" & f_NG_NAS_SNN_MCC(plmn_id) & + ".3gppnetwork.org"; + + if (isvalue(NID)) { + ssn := ssn & ":" & hex2str (valueof(NID)); + } + + return ssn; +} + +function f_NG_NAS_ServingNetworkName_OCT(NAS_PlmnId plmn_id, template (omit) hexstring NID := omit) return octetstring +{ + return char2oct(f_NG_NAS_ServingNetworkName(plmn_id, NID)); +} + +} diff --git a/library/NG_NAS_Osmo_Templates.ttcn b/library/NG_NAS_Osmo_Templates.ttcn index 1108947..5887fa6 100644 --- a/library/NG_NAS_Osmo_Templates.ttcn +++ b/library/NG_NAS_Osmo_Templates.ttcn @@ -54,6 +54,13 @@ res := p_ExpectedRES } + template (value) AuthenticationFailureParameter cs_AuthFailParam(template (value) B112_Type auts) := + { + iei := '30'O, // version 110, and value used in GMM + iel := '0E'O, + auts := auts + }; + /* 24.501 cl. 8.2.1 */ template (present) NG_NAS_DL_Message_Type @@ -63,7 +70,7 @@ template AUTN p_AUTN := *, template EAP_Message p_EAP := * ) := -{ /* 24.501 cl. 8.2.1 */ +{ authentication_Request := { protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ @@ -84,13 +91,47 @@ template (omit) EAP_Message p_EAP := omit) := { authentication_Response := { - protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ - spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ - securityHeaderType := tsc_SHT_NoSecurityProtection, - messageType := tsc_MT_NG_AuthenticationResponse, /* cl. 9.7 M V 1 */ - authResponseParam := p_Res, /* cl. 9.11.3.17 O TLV 18 IEI=2D */ - eapMessage := p_EAP /* cl. 9.11.2.2 O TLV-E 7-1503 IEI=78 */ + protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ + spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ + securityHeaderType := tsc_SHT_NoSecurityProtection, + messageType := tsc_MT_NG_AuthenticationResponse, /* cl. 9.7 M V 1 */ + authResponseParam := p_Res, /* cl. 9.11.3.17 O TLV 18 IEI=2D */ + eapMessage := p_EAP /* cl. 9.11.2.2 O TLV-E 7-1503 IEI=78 */ + } } + +/* 24.501 cl. 8.2.4 */ +template (value) NG_NAS_UL_Message_Type cs_NG_AUTHENTICATION_FAILURE(template (value) GMM_GSM_Cause p_Cause, + template (omit) AuthenticationFailureParameter p_AuthFailParam := omit) := +{ + authentication_Failure := { + protocolDiscriminator := tsc_EPD_GMM, /* cl. 9.2 M V 1 */ + spareHalfOctet := tsc_SpareHalfOctet, /* cl. 9.3 M V 1/2 */ + securityHeaderType := tsc_SHT_NoSecurityProtection, + messageType := tsc_MT_NG_AuthenticationFailure, /* cl. 9.7 M V 1 */ + gmmCause := p_Cause, /* cl. 9.11.3.2 M V 1 */ + authFailureParam := p_AuthFailParam /* cl. 9.11.3.12 O TLV 16 IEI=30 */ + } +} + + +/* 24.501 cl. 8.2.28 */ +template (present) NG_NAS_DL_Message_Type +cr_NG_SECURITY_PROTECTED_NAS_MESSAGE(template (present) ExtdProtocolDiscriminator p_protocolDiscriminator := ?, + template (present) SpareHalfOctet p_spareHalfOctet := ?, + template (present) SecurityHeaderType p_securityHeaderType := ?, + template (present) MessageAuthenticationCode p_messageAuthenticationCode := ?, + template (present) NAS_SequenceNumber p_sequenceNumber := ?, + template (present) NG_NAS_Message p_plainNASMessage := ?) := +{ + security_Protected_Nas_Message := { + protocolDiscriminator := p_protocolDiscriminator, /* cl. 9.2 M V 1 */ + spareHalfOctet := p_spareHalfOctet, /* cl. 9.5 M V 1/2 */ + securityHeaderType := p_securityHeaderType, /* cl. 9.3 M V 1/2 */ + messageAuthenticationCode := p_messageAuthenticationCode, /* cl. 9.8 M V 4 */ + sequenceNumber := p_sequenceNumber, /* cl. 9.10 M V 1 */ + plainNASMessage := p_plainNASMessage /* cl. 9.9 M V 3-n */ + } } } diff --git a/library/milenage/Milenage_FunctionDefs.cc b/library/milenage/Milenage_FunctionDefs.cc new file mode 100644 index 0000000..ddd399f --- /dev/null +++ b/library/milenage/Milenage_FunctionDefs.cc @@ -0,0 +1,53 @@ +/* AKA USIM Utility functions */ + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <stdint.h> + +#include <Addfunc.hh> +#include <Encdec.hh> +#include <Boolean.hh> +#include <Integer.hh> +#include <Octetstring.hh> +#include <Bitstring.hh> + +#include "milenage.h" + +namespace Milenage__Functions { + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +INTEGER f__milenage__check(const OCTETSTRING& opc, const OCTETSTRING& k, + const OCTETSTRING& sqn, const OCTETSTRING& _rand, const OCTETSTRING& autn, + OCTETSTRING& ik, OCTETSTRING& ck, OCTETSTRING& res, OCTETSTRING& auts) +{ + TTCN_Buffer ttcn_buf_opc(opc); + TTCN_Buffer ttcn_buf_k(k); + TTCN_Buffer ttcn_buf_sqn(sqn); + TTCN_Buffer ttcn_buf_rand(_rand); + TTCN_Buffer ttcn_buf_autn(autn); + uint8_t buf_ik[16]; + uint8_t buf_ck[16]; + uint8_t buf_res[8]; + uint8_t buf_auts[14]; + size_t res_len = 0; + int rc; + + rc = milenage_check(ttcn_buf_opc.get_data(), + ttcn_buf_k.get_data(), + ttcn_buf_sqn.get_data(), + ttcn_buf_rand.get_data(), + ttcn_buf_autn.get_data(), + buf_ik, buf_ck, + buf_res, &res_len, + buf_auts); + + ik = OCTETSTRING(16, static_cast<const unsigned char*>(&buf_ik[0])); + ck = OCTETSTRING(16, static_cast<const unsigned char*>(&buf_ck[0])); + res = OCTETSTRING(res_len, static_cast<const unsigned char*>(&buf_res[0])); + auts = OCTETSTRING(14, static_cast<const unsigned char*>(&buf_auts[0])); + + return INTEGER(rc); +} + +} diff --git a/library/milenage/Milenage_Functions.ttcn b/library/milenage/Milenage_Functions.ttcn new file mode 100644 index 0000000..8fb9b04 --- /dev/null +++ b/library/milenage/Milenage_Functions.ttcn @@ -0,0 +1,24 @@ +/* Milenage crypto functions (USIM AKA) + * + * (C) 2025 by sysmocom - s.f.m.c. GmbH <info(a)sysmocom.de> + * Author: Pau Espin Pedrol <pespin(a)sysmocom.de + * All rights reserved. + * + * Released under the terms of GNU General Public License, Version 2 or + * (at your option) any later version. + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +module Milenage_Functions { + +import from General_Types all; + +/* 3GPP TS 33.102 Figure 9, 3GPP TS 35.206 Annex 3 */ +external function f_milenage_check(OCT16 opc,OCT16 k, + OCT8 sqn, OCT16 rand, OCT16 autn, + out OCT16 ik, out OCT16 ck, + out OCT8 res, out OCT14 auts) return integer; + + +} diff --git a/library/milenage/milenage.c b/library/milenage/milenage.c new file mode 100644 index 0000000..d079a3d --- /dev/null +++ b/library/milenage/milenage.c @@ -0,0 +1,424 @@ +/* + * 3GPP AKA - Milenage algorithm (3GPP TS 35.205, .206, .207, .208) + * Copyright (c) 2006-2007 <j(a)w1.fi> + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + * + * This file implements an example authentication algorithm defined for 3GPP + * AKA. This can be used to implement a simple HLR/AuC into hlr_auc_gw to allow + * EAP-AKA to be tested properly with real USIM cards. + * + * This implementations assumes that the r1..r5 and c1..c5 constants defined in + * TS 35.206 are used, i.e., r1=64, r2=0, r3=32, r4=64, r5=96, c1=00..00, + * c2=00..01, c3=00..02, c4=00..04, c5=00..08. The block cipher is assumed to + * be AES (Rijndael). + */ + + +#include "milenage.h" + +#include <openssl/err.h> /* for ERR_print_errors_fp */ +#include <openssl/ssl.h> /* for NID_sha1, RSA */ +#include <openssl/evp.h> /* for EVP_PKEY, EVP_sha1(), ... */ +#include <openssl/md5.h> /* for MD5_DIGEST_LENGTH */ +#include <openssl/sha.h> /* for SHA_DIGEST_LENGTH */ + +#define AST_CRYPTO_RSA_KEY_BITS 1024 +#define AST_CRYPTO_AES_BLOCKSIZE 128 + +struct ast_aes { + unsigned char raw[AST_CRYPTO_AES_BLOCKSIZE / 8]; +}; + +int ast_aes_set_encrypt_key(const unsigned char *key, struct ast_aes *ctx) +{ + if (key == NULL || ctx == NULL) + return -1; + + memcpy(ctx->raw, key, AST_CRYPTO_AES_BLOCKSIZE / 8); + return 0; +} + +static int evp_cipher_aes_encrypt(const unsigned char *in, unsigned char *out, unsigned inlen, const struct ast_aes *key) +{ + EVP_CIPHER_CTX *ctx = NULL; + int res, outlen, finallen; + unsigned char final[AST_CRYPTO_AES_BLOCKSIZE / 8]; + + if ((ctx = EVP_CIPHER_CTX_new()) == NULL) + return -1; + + do { + if ((res = EVP_CipherInit(ctx, EVP_aes_128_ecb(), key->raw, NULL, 1)) <= 0) + break; + EVP_CIPHER_CTX_set_padding(ctx, 0); + if ((res = EVP_CipherUpdate(ctx, out, &outlen, in, inlen)) <= 0) + break; + /* for ECB, this is a no-op */ + if ((res = EVP_CipherFinal(ctx, final, &finallen)) <= 0) + break; + res = outlen; + } while (0); + + EVP_CIPHER_CTX_free(ctx); + + return res; +} + +int ast_aes_encrypt(const unsigned char *in, unsigned char *out, const struct ast_aes *key) +{ + int res; + + if ((res = evp_cipher_aes_encrypt(in, out, AST_CRYPTO_AES_BLOCKSIZE / 8, key)) <= 0) { + printf("AES encryption failed\n"); + exit(0); + } + return res; +} + +static int aes_128_encrypt_block(const u8 *key, const u8 *plain, u8 *encr) +{ + struct ast_aes aes_key; + + ast_aes_set_encrypt_key(key, &aes_key); + if (ast_aes_encrypt(plain, encr, &aes_key) <= 0) { + printf("Failed to ecrypt AES 128."); + return -1; + } + + return 0; +} + +#define DEBUG +#ifdef DEBUG +void hexdump(const char *text, const uint8_t *data, int len) +{ + char s[3 * len + 2], *p; + int f; + + for (p = s, f = 0; f < len; f++, p += 3) + sprintf(p, "%02hhX ", (unsigned char)data[f]); + + printf("%s: %s\n", text, s); +} +#endif + + +/** + * milenage_f1 - Milenage f1 and f1* algorithms + * @opc: OPc = 128-bit value derived from OP and K + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @sqn: SQN = 48-bit sequence number + * @amf: AMF = 16-bit authentication management field + * @mac_a: Buffer for MAC-A = 64-bit network authentication code, or %NULL + * @mac_s: Buffer for MAC-S = 64-bit resync authentication code, or %NULL + * Returns: 0 on success, -1 on failure + */ +int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand, + const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s) +{ + u8 tmp1[16], tmp2[16], tmp3[16]; + int i; + + /* tmp1 = TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp1[i] = _rand[i] ^ opc[i]; + if (aes_128_encrypt_block(k, tmp1, tmp1)) + return -1; + + /* tmp2 = IN1 = SQN || AMF || SQN || AMF */ + memcpy(tmp2, sqn, 6); + memcpy(tmp2 + 6, amf, 2); + memcpy(tmp2 + 8, tmp2, 8); + + /* OUT1 = E_K(TEMP XOR rot(IN1 XOR OP_C, r1) XOR c1) XOR OP_C */ + + /* rotate (tmp2 XOR OP_C) by r1 (= 0x40 = 8 bytes) */ + for (i = 0; i < 16; i++) + tmp3[(i + 8) % 16] = tmp2[i] ^ opc[i]; + /* XOR with TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp3[i] ^= tmp1[i]; + /* XOR with c1 (= ..00, i.e., NOP) */ + + /* f1 || f1* = E_K(tmp3) XOR OP_c */ + if (aes_128_encrypt_block(k, tmp3, tmp1)) + return -1; + for (i = 0; i < 16; i++) + tmp1[i] ^= opc[i]; + if (mac_a) + memcpy(mac_a, tmp1, 8); /* f1 */ + if (mac_s) + memcpy(mac_s, tmp1 + 8, 8); /* f1* */ + return 0; +} + + +/** + * milenage_f2345 - Milenage f2, f3, f4, f5, f5* algorithms + * @opc: OPc = 128-bit value derived from OP and K + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ak: Buffer for AK = 48-bit anonymity key (f5), or %NULL + * @akstar: Buffer for AK = 48-bit anonymity key (f5*), or %NULL + * Returns: 0 on success, -1 on failure + */ +int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand, + u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar) +{ + u8 tmp1[16], tmp2[16], tmp3[16]; + int i; + + /* tmp2 = TEMP = E_K(RAND XOR OP_C) */ + for (i = 0; i < 16; i++) + tmp1[i] = _rand[i] ^ opc[i]; + if (aes_128_encrypt_block(k, tmp1, tmp2)) + return -1; + + /* OUT2 = E_K(rot(TEMP XOR OP_C, r2) XOR c2) XOR OP_C */ + /* OUT3 = E_K(rot(TEMP XOR OP_C, r3) XOR c3) XOR OP_C */ + /* OUT4 = E_K(rot(TEMP XOR OP_C, r4) XOR c4) XOR OP_C */ + /* OUT5 = E_K(rot(TEMP XOR OP_C, r5) XOR c5) XOR OP_C */ + + /* f2 and f5 */ + /* rotate by r2 (= 0, i.e., NOP) */ + for (i = 0; i < 16; i++) + tmp1[i] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 1; /* XOR c2 (= ..01) */ + /* f5 || f2 = E_K(tmp1) XOR OP_c */ + if (aes_128_encrypt_block(k, tmp1, tmp3)) + return -1; + for (i = 0; i < 16; i++) + tmp3[i] ^= opc[i]; + if (res) + memcpy(res, tmp3 + 8, 8); /* f2 */ + if (ak) + memcpy(ak, tmp3, 6); /* f5 */ + + /* f3 */ + if (ck) { + /* rotate by r3 = 0x20 = 4 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 12) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 2; /* XOR c3 (= ..02) */ + if (aes_128_encrypt_block(k, tmp1, ck)) + return -1; + for (i = 0; i < 16; i++) + ck[i] ^= opc[i]; + } + + /* f4 */ + if (ik) { + /* rotate by r4 = 0x40 = 8 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 8) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 4; /* XOR c4 (= ..04) */ + if (aes_128_encrypt_block(k, tmp1, ik)) + return -1; + for (i = 0; i < 16; i++) + ik[i] ^= opc[i]; + } + + /* f5* */ + if (akstar) { + /* rotate by r5 = 0x60 = 12 bytes */ + for (i = 0; i < 16; i++) + tmp1[(i + 4) % 16] = tmp2[i] ^ opc[i]; + tmp1[15] ^= 8; /* XOR c5 (= ..08) */ + if (aes_128_encrypt_block(k, tmp1, tmp1)) + return -1; + for (i = 0; i < 6; i++) + akstar[i] = tmp1[i] ^ opc[i]; + } + + return 0; +} + + +/** + * milenage_generate - Generate AKA AUTN,IK,CK,RES + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @amf: AMF = 16-bit authentication management field + * @k: K = 128-bit subscriber key + * @sqn: SQN = 48-bit sequence number + * @_rand: RAND = 128-bit random challenge + * @autn: Buffer for AUTN = 128-bit authentication token + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @res_len: Max length for res; set to used length or 0 on failure + */ +void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k, + const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik, + u8 *ck, u8 *res, size_t *res_len) +{ + int i; + u8 mac_a[8], ak[6]; + + if (*res_len < 8) { + *res_len = 0; + return; + } + if (milenage_f1(opc, k, _rand, sqn, amf, mac_a, NULL) || + milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) { + *res_len = 0; + return; + } + *res_len = 8; + + /* AUTN = (SQN ^ AK) || AMF || MAC */ + for (i = 0; i < 6; i++) + autn[i] = sqn[i] ^ ak[i]; + memcpy(autn + 6, amf, 2); + memcpy(autn + 8, mac_a, 8); +} + + +/** + * milenage_auts - Milenage AUTS validation + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @auts: AUTS = 112-bit authentication token from client + * @sqn: Buffer for SQN = 48-bit sequence number + * Returns: 0 = success (sqn filled), -1 on failure + */ +int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts, + u8 *sqn) +{ + u8 amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ + u8 ak[6], mac_s[8]; + int i; + + if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) + return -1; + for (i = 0; i < 6; i++) + sqn[i] = auts[i] ^ ak[i]; + if (milenage_f1(opc, k, _rand, sqn, amf, NULL, mac_s) || + memcmp(mac_s, auts + 6, 8) != 0) + return -1; + return 0; +} + + +/** + * gsm_milenage - Generate GSM-Milenage (3GPP TS 55.205) authentication triplet + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @_rand: RAND = 128-bit random challenge + * @sres: Buffer for SRES = 32-bit SRES + * @kc: Buffer for Kc = 64-bit Kc + * Returns: 0 on success, -1 on failure + */ +int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc) +{ + u8 res[8], ck[16], ik[16]; + int i; + + if (milenage_f2345(opc, k, _rand, res, ck, ik, NULL, NULL)) + return -1; + + for (i = 0; i < 8; i++) + kc[i] = ck[i] ^ ck[i + 8] ^ ik[i] ^ ik[i + 8]; + +#ifdef GSM_MILENAGE_ALT_SRES + memcpy(sres, res, 4); +#else /* GSM_MILENAGE_ALT_SRES */ + for (i = 0; i < 4; i++) + sres[i] = res[i] ^ res[i + 4]; +#endif /* GSM_MILENAGE_ALT_SRES */ + return 0; +} + + +/** + * milenage_generate - Generate AKA AUTN,IK,CK,RES + * @opc: OPc = 128-bit operator variant algorithm configuration field (encr.) + * @k: K = 128-bit subscriber key + * @sqn: SQN = 48-bit sequence number + * @_rand: RAND = 128-bit random challenge + * @autn: AUTN = 128-bit authentication token + * @ik: Buffer for IK = 128-bit integrity key (f4), or %NULL + * @ck: Buffer for CK = 128-bit confidentiality key (f3), or %NULL + * @res: Buffer for RES = 64-bit signed response (f2), or %NULL + * @res_len: Variable that will be set to RES length + * @auts: 112-bit buffer for AUTS + * Returns: 0 on success, -1 on failure, or -2 on synchronization failure + */ +int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand, + const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len, + u8 *auts) +{ + int i; + u8 mac_a[8], ak[6], rx_sqn[6]; + const u8 *amf; + +#ifdef DEBUG + hexdump("Milenage: OPC", opc, 16); + hexdump("Milenage: K", k, 16); + hexdump("Milenage: AUTN", autn, 16); + hexdump("Milenage: RAND", _rand, 16); +#endif + + if (milenage_f2345(opc, k, _rand, res, ck, ik, ak, NULL)) + return -1; + + *res_len = 8; +#ifdef DEBUG + hexdump("Milenage: RES", res, *res_len); + hexdump("Milenage: CK", ck, 16); + hexdump("Milenage: IK", ik, 16); + hexdump("Milenage: AK", ak, 6); +#endif + + /* AUTN = (SQN ^ AK) || AMF || MAC */ + for (i = 0; i < 6; i++) + rx_sqn[i] = autn[i] ^ ak[i]; +#ifdef DEBUG + hexdump("Milenage: RX SQN", rx_sqn, 6); + hexdump("Milenage: SQN", sqn, 6); +#endif + + if (memcmp(rx_sqn, sqn, 6) <= 0) { + u8 auts_amf[2] = { 0x00, 0x00 }; /* TS 33.102 v7.0.0, 6.3.3 */ + if (milenage_f2345(opc, k, _rand, NULL, NULL, NULL, NULL, ak)) + return -1; +#ifdef DEBUG + hexdump("Milenage: AK*", ak, 6); +#endif + for (i = 0; i < 6; i++) + auts[i] = sqn[i] ^ ak[i]; + if (milenage_f1(opc, k, _rand, sqn, auts_amf, NULL, auts + 6)) + return -1; +#ifdef DEBUG + hexdump("Milenage: AUTS", auts, 14); +#endif + return -2; + } + + amf = autn + 6; +#ifdef DEBUG + hexdump("Milenage: AMF", amf, 2); +#endif + if (milenage_f1(opc, k, _rand, rx_sqn, amf, mac_a, NULL)) + return -1; + +#ifdef DEBUG + hexdump("Milenage: MAC_A", mac_a, 8); +#endif + + if (memcmp(mac_a, autn + 8, 8) != 0) { +#ifdef DEBUG + hexdump("Milenage: MAC mismatch, Received MAC_A", + autn + 8, 8); +#endif + return -1; + } + + return 0; +} diff --git a/library/milenage/milenage.h b/library/milenage/milenage.h new file mode 100644 index 0000000..238df62 --- /dev/null +++ b/library/milenage/milenage.h @@ -0,0 +1,22 @@ + +#include <stdint.h> +#include <stddef.h> +#include <string.h> + +typedef uint8_t u8; +typedef uint16_t u16; +typedef uint32_t u32; + +int milenage_f1(const u8 *opc, const u8 *k, const u8 *_rand, + const u8 *sqn, const u8 *amf, u8 *mac_a, u8 *mac_s); +int milenage_f2345(const u8 *opc, const u8 *k, const u8 *_rand, + u8 *res, u8 *ck, u8 *ik, u8 *ak, u8 *akstar); +void milenage_generate(const u8 *opc, const u8 *amf, const u8 *k, + const u8 *sqn, const u8 *_rand, u8 *autn, u8 *ik, + u8 *ck, u8 *res, size_t *res_len); +int milenage_auts(const u8 *opc, const u8 *k, const u8 *_rand, const u8 *auts, + u8 *sqn); +int gsm_milenage(const u8 *opc, const u8 *k, const u8 *_rand, u8 *sres, u8 *kc); +int milenage_check(const u8 *opc, const u8 *k, const u8 *sqn, const u8 *_rand, + const u8 *autn, u8 *ik, u8 *ck, u8 *res, size_t *res_len, + u8 *auts); diff --git a/library/ng_crypto/key_derivation.c b/library/ng_crypto/key_derivation.c new file mode 100644 index 0000000..29e0849 --- /dev/null +++ b/library/ng_crypto/key_derivation.c @@ -0,0 +1,49 @@ +#include <stdint.h> +#include <string.h> +#include <arpa/inet.h> +#include <gnutls/crypto.h> + +#include "key_derivation.h" + +/* 3GPP TS 33.501 A.4 RES* and XRES* derivation function */ +void kdf_xres_star(const uint8_t *serving_network_name, + uint16_t serving_network_name_len, + const uint8_t *ck, + const uint8_t *ik, + const uint8_t *rand, + const uint8_t *xres, size_t xres_len, + uint8_t *out) +{ + uint8_t s[1024]; + uint8_t key[16*2]; + uint8_t tmp_out[32]; + size_t pos = 0; + uint16_t lenbe; + + memcpy(key, ck, 16); + memcpy(key+16, ik, 16); + + s[pos++] = 0x6B; /* FC Value */ + + memcpy(&s[pos], serving_network_name, serving_network_name_len); + pos += serving_network_name_len; + lenbe = htons(serving_network_name_len); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + memcpy(&s[pos], rand, 16); + pos += 16; + lenbe = htons(16); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + memcpy(&s[pos], xres, xres_len); + pos += xres_len; + lenbe = htons(xres_len); + memcpy(&s[pos], &lenbe, 2); + pos += 2; + + gnutls_hmac_fast(GNUTLS_MAC_SHA256, key, sizeof(key), s, pos, tmp_out); + + memcpy(out, tmp_out+16, 16); +} diff --git a/library/ng_crypto/key_derivation.h b/library/ng_crypto/key_derivation.h new file mode 100644 index 0000000..f78d746 --- /dev/null +++ b/library/ng_crypto/key_derivation.h @@ -0,0 +1,12 @@ +#pragma once + +#include <stdint.h> +#include <unistd.h> + +void kdf_xres_star(const uint8_t *serving_network_name, + uint16_t serving_network_name_len, + const uint8_t *ck, + const uint8_t *ik, + const uint8_t *rand, + const uint8_t *xres, size_t xres_len, + uint8_t *out); -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/40413?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I11527f47e4310863124f3f02148e3f71da7d911e Gerrit-Change-Number: 40413 Gerrit-PatchSet: 9 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[L] Change in ...osmo-s1gw[master]: enft_kpi: retrieve per-eNB traffic counters
by fixeria 05 Jun '25

05 Jun '25

Attention is currently required from: fixeria, laforge, pespin. Hello Jenkins Builder, laforge, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40281?usp=email to look at the new patch set (#9). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review+1 by pespin, Verified+1 by Jenkins Builder Change subject: enft_kpi: retrieve per-eNB traffic counters ...................................................................... enft_kpi: retrieve per-eNB traffic counters Change-Id: I498d2854447a2d53d2abddd38652f3e2bbb1fbdd Related: SYS#7307 --- M config/sys.config M debian/control M include/s1gw_metrics.hrl M rebar.config M rebar.lock A src/enft_kpi.erl M src/osmo_s1gw.app.src M src/osmo_s1gw_sup.erl M src/s1ap_proxy.erl M test/s1ap_proxy_test.erl 10 files changed, 684 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/81/40281/9 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40281?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newpatchset Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: I498d2854447a2d53d2abddd38652f3e2bbb1fbdd Gerrit-Change-Number: 40281 Gerrit-PatchSet: 9 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[L] Change in ...osmo-s1gw[master]: enft_kpi: support different UL/DL GTP-U addresses
by fixeria 05 Jun '25

05 Jun '25

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40437?usp=email ) Change subject: enft_kpi: support different UL/DL GTP-U addresses ...................................................................... enft_kpi: support different UL/DL GTP-U addresses Change-Id: Icd4a17790062bfcaf2bccb01fa94dcdb65c0872c Related: SYS#7307 --- M src/enft_kpi.erl M src/s1ap_proxy.erl 2 files changed, 156 insertions(+), 113 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/37/40437/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index 015956c..9b4caf1 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -72,14 +72,22 @@ -type counters() :: dict:dict(K :: string(), V :: counter()). +-type uldl() :: ul | dl. + +-type uldl_addr() :: {ULDL :: uldl(), + Addr :: string()}. + +-type enb_uldl_state() :: #{uldl => uldl(), + addr => string(), + handle => integer(), + ctr => counter() + }. + -type enb_state() :: #{pid => pid(), - addr => string(), genb_id => string(), mon_ref => reference(), - handle_ul => integer(), - handle_dl => integer(), - ctr_ul => counter(), %% UL counters - ctr_dl => counter() %% DL counters + ul => enb_uldl_state(), %% Uplink data + dl => enb_uldl_state() %% Downlink data }. -type registry() :: dict:dict(K :: pid(), @@ -109,10 +117,11 @@ gen_server:call(?MODULE, {?FUNCTION_NAME, GlobalENBId}). --spec enb_set_addr(Addr) -> ok | {error, term()} - when Addr :: string(). -enb_set_addr(Addr) -> - gen_server:call(?MODULE, {?FUNCTION_NAME, Addr}). +-spec enb_set_addr(ULDLAddr) -> ok | {error, term()} + when ULDLAddr :: uldl_addr(). +enb_set_addr(ULDLAddr) -> + %% TODO: use cast here to avoid blocking + gen_server:call(?MODULE, {?FUNCTION_NAME, ULDLAddr}). -spec enb_unregister() -> ok | {error, term()}. @@ -194,15 +203,30 @@ {reply, ok, S#state{registry = R1}} end; -handle_call({enb_set_addr, Addr}, {Pid, _Ref}, +handle_call({enb_set_addr, {ULDL, Addr}}, {Pid, _Ref}, #state{registry = R} = S0) -> case dict:find(Pid, R) of - {ok, EnbState} -> - {Reply, S1} = enb_set_addr(Addr, EnbState, S0), + %% the given UL/DL Addr is already known + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := Addr}}} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", + [Pid, GlobalENBId, ULDL, Addr]), + {reply, ok, S0}; + %% the given UL/DL Addr differs from stored Addr + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := OldAddr}}} -> + ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", + [Pid, GlobalENBId, ULDL, OldAddr, Addr]), + {reply, {error, addr_mismatch}, S0}; + %% UL/DL state is missing => create it + {ok, #{genb_id := GlobalENBId} = ES} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " + "creating NFT counters and rules", + [Pid, GlobalENBId, ULDL, Addr]), + {Reply, S1} = enb_set_addr({ULDL, Addr}, ES, S0), {reply, Reply, S1}; error -> - ?LOG_ERROR("eNB @ ~p (pid ~p) is *not* registered", - [Addr, Pid]), + ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), {reply, {error, not_registered}, S0} end; @@ -303,107 +327,108 @@ enb_add_metrics(GlobalENBId, ul), enb_add_metrics(GlobalENBId, dl). -enb_add_metrics(GlobalENBId, UDL) -> +enb_add_metrics(GlobalENBId, ULDL) -> %% counters may already exist, so catch exceptions here - catch exometer:new(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, UDL), counter), - catch exometer:new(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, UDL), counter), - catch exometer:new(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, UDL), counter). + catch exometer:new(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, ULDL), counter), + catch exometer:new(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, ULDL), counter), + catch exometer:new(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, ULDL), counter). --spec enb_set_addr(Addr, ES, S0) -> {Reply, S1} - when Addr :: string(), +-spec enb_set_addr(ULDLAddr, ES, S0) -> {Reply, S1} + when ULDLAddr :: uldl_addr(), ES :: enb_state(), S0 :: #state{}, S1 :: #state{}, Reply :: ok | {error, term()}. -enb_set_addr(Addr, %% given Addr matches stored Addr +enb_set_addr({ULDL, Addr}, #{genb_id := GlobalENBId, - addr := Addr, - pid := Pid}, S) -> - ?LOG_DEBUG("eNB @ ~p (pid ~p, ~p): address is already known", - [Addr, Pid, GlobalENBId]), - {ok, S}; - -enb_set_addr(NewAddr, %% given NewAddr differs from stored Addr - #{genb_id := GlobalENBId, - addr := Addr, - pid := Pid}, S) -> - ?LOG_ERROR("eNB @ ~p (pid ~p, ~p): address (~p) mismatch?!?", - [Addr, Pid, GlobalENBId, NewAddr]), - {{error, addr_mismatch}, S}; - -enb_set_addr(Addr, #{genb_id := GlobalENBId, - pid := Pid} = ES0, + pid := Pid} = ES0, #state{cfg = Cfg, registry = R0} = S) -> - ?LOG_DEBUG("eNB @ ~p (pid ~p, ~p): " - "address indicated, creating NFT rules/counters", - [Addr, Pid, GlobalENBId]), - case enb_add_nft_counters(ES0#{addr => Addr}, Cfg) of - {ok, ES1} -> + case enb_add_nft_counter({ULDL, Addr}, GlobalENBId, Cfg) of + {ok, Handle} -> + ?LOG_INFO("eNB (pid ~p, ~p): NFT rules/counters created for ~p", + [Pid, GlobalENBId, ULDL]), + %% store an updated eNB state to the registry + ES1 = ES0#{ULDL => #{uldl => ULDL, + addr => Addr, + handle => Handle, + ctr => #ctr{}}}, R1 = dict:store(Pid, ES1, R0), - ?LOG_INFO("eNB @ ~p (pid ~p, ~p): " - "NFT rules/counters created (KPI ready)", - [Addr, Pid, GlobalENBId]), {ok, S#state{registry = R1}}; {error, Error} -> - ?LOG_ERROR("eNB @ ~p (pid ~p, ~p): " - "creating NFT rules/counters failed: ~p", - [Addr, Pid, GlobalENBId, Error]), + ?LOG_ERROR("eNB (pid ~p, ~p): creating NFT rules/counters failed: ~p", + [Pid, GlobalENBId, Error]), {{error, Error}, S} end. --spec enb_add_nft_counters(ES0, Cfg) -> {ok, ES1} | {error, term()} - when ES0 :: enb_state(), - ES1 :: enb_state(), - Cfg :: cfg(). -enb_add_nft_counters(#{addr := Addr, - genb_id := GlobalENBId} = ES0, - #{table_name := TName}) -> - RUL = [nft_expr_match_ip_saddr(Addr, ?OP_EQ), - nft_expr_counter("ul-" ++ GlobalENBId)], - RDL = [nft_expr_match_ip_daddr(Addr, ?OP_EQ), - nft_expr_counter("dl-" ++ GlobalENBId)], - Cmds = [nft_cmd_add_counter(TName, "ul-" ++ GlobalENBId), - nft_cmd_add_counter(TName, "dl-" ++ GlobalENBId), - nft_cmd_add_rule(TName, "gtpu-ul", RUL), - nft_cmd_add_rule(TName, "gtpu-dl", RDL) +enb_nft_counter_name(ul, GlobalENBId) -> "ul-" ++ GlobalENBId; +enb_nft_counter_name(dl, GlobalENBId) -> "dl-" ++ GlobalENBId. + +enb_nft_rule_name(ul) -> "gtpu-ul"; +enb_nft_rule_name(dl) -> "gtpu-dl". + + +-spec enb_add_nft_counter(ULDLAddr, GlobalENBId, Cfg) -> {ok, Handle} | {error, term()} + when ULDLAddr :: uldl_addr(), + GlobalENBId :: string(), + Cfg :: cfg(), + Handle :: integer(). +enb_add_nft_counter({ULDL, Addr}, GlobalENBId, + #{table_name := TName}) -> + CName = enb_nft_counter_name(ULDL, GlobalENBId), + RName = enb_nft_rule_name(ULDL), + Rule = [nft_expr_match_ip_addr({ULDL, Addr}), + nft_expr_counter(CName)], + Cmds = [nft_cmd_add_counter(TName, CName), + nft_cmd_add_rule(TName, RName, Rule) ], case nft_exec(Cmds) of ok -> - ULH = nft_chain_last_handle(TName, "gtpu-ul"), - DLH = nft_chain_last_handle(TName, "gtpu-dl"), - %% update the eNB state with new info - ES1 = ES0#{handle_ul => ULH, - handle_dl => DLH, - ctr_ul => #ctr{}, - ctr_dl => #ctr{}}, - {ok, ES1}; + Handle = nft_chain_last_handle(TName, RName), + {ok, Handle}; {error, Error} -> ?LOG_ERROR("~p() failed: ~p", [?FUNCTION_NAME, Error]), {error, Error} end. --spec enb_del_nft_counters(enb_state(), cfg()) -> ok | {error, term()}. -enb_del_nft_counters(#{genb_id := GlobalENBId, - handle_ul := ULH, - handle_dl := DLH}, - #{table_name := TName}) -> - Cmds = [nft_cmd_del_rule(TName, "gtpu-ul", ULH), - nft_cmd_del_rule(TName, "gtpu-dl", DLH), - nft_cmd_del_counter(TName, "ul-" ++ GlobalENBId), - nft_cmd_del_counter(TName, "dl-" ++ GlobalENBId) +-spec enb_del_nft_counters(ES0, Cfg) -> ES1 + when Cfg :: cfg(), + ES0 :: enb_state(), + ES1 :: enb_state(). +enb_del_nft_counters(#{ul := ULS} = ES, Cfg) -> + enb_del_nft_counter(ULS, ES, Cfg), + enb_del_nft_counters(maps:remove(ul, ES), Cfg); + +enb_del_nft_counters(#{dl := DLS} = ES, Cfg) -> + enb_del_nft_counter(DLS, ES, Cfg), + enb_del_nft_counters(maps:remove(dl, ES), Cfg); + +%% no UL/DL state => nothing to delete +enb_del_nft_counters(ES, _Cfg) -> ES. + + +-spec enb_del_nft_counter(S, ES, Cfg) -> ok | {error, term()} + when S :: enb_uldl_state(), + ES :: enb_state(), + Cfg :: cfg(). +enb_del_nft_counter(#{uldl := ULDL, handle := Handle}, + #{genb_id := GlobalENBId, pid := Pid}, + #{table_name := TName}) -> + ?LOG_DEBUG("eNB (pid ~p, ~p): deleting NFT counter for ~p", + [Pid, GlobalENBId, ULDL]), + CName = enb_nft_counter_name(ULDL, GlobalENBId), + RName = enb_nft_rule_name(ULDL), + Cmds = [nft_cmd_del_rule(TName, RName, Handle), + nft_cmd_del_counter(TName, CName) ], case nft_exec(Cmds) of ok -> ok; {error, Error} -> ?LOG_ERROR("~p() failed: ~p", [?FUNCTION_NAME, Error]), {error, Error} - end; - -%% missing ULH/DLH => nothing to delete -enb_del_nft_counters(_ES, _Cfg) -> ok. + end. %% Parse the given list of NFT counters (result of nft_cmd_list_counters()). @@ -437,51 +462,59 @@ R1 :: registry(). %% (new) registry of eNBs report_nft_counters(Ctrs, R0) -> %% for each registered eNB, look-up and report UL/DL counters - dict:map(fun(_Pid, EnbState) -> enb_report_nft_counters(Ctrs, EnbState) end, R0). + dict:map(fun(_Pid, ES) -> enb_report_nft_counters(Ctrs, ES) end, R0). -spec enb_report_nft_counters(counters(), enb_state()) -> enb_state(). -enb_report_nft_counters(Ctrs, #{genb_id := GlobalENBId, - ctr_ul := ULC, - ctr_dl := DLC} = ES) -> - ?LOG_DEBUG("Reporting NFT counters for eNB ~p", [GlobalENBId]), - ES#{ctr_ul => report_nft_counter(Ctrs, {ul, GlobalENBId}, ULC), - ctr_dl => report_nft_counter(Ctrs, {dl, GlobalENBId}, DLC)}; +enb_report_nft_counters(Ctrs, #{ul := ULS, + dl := DLS} = ES) -> + %% report both UL and DL counters + ES#{ul => enb_report_nft_counters(Ctrs, ES, ULS), + dl => enb_report_nft_counters(Ctrs, ES, DLS)}; -%% missing ULH/DLH => nothing to report +enb_report_nft_counters(Ctrs, #{ul := ULS} = ES) -> + %% report UL counters only + ES#{ul => enb_report_nft_counters(Ctrs, ES, ULS)}; + +enb_report_nft_counters(Ctrs, #{dl := DLS} = ES) -> + %% report DL counters only + ES#{dl => enb_report_nft_counters(Ctrs, ES, DLS)}; + +%% no UL/DL state => nothing to report enb_report_nft_counters(_Ctrs, ES) -> ES. --spec report_nft_counter(Ctrs, {UDL, GlobalENBId}, C0) -> C1 +-spec enb_report_nft_counters(Ctrs, ES, S0) -> S1 when Ctrs :: counters(), - UDL :: ul | dl, - GlobalENBId :: string(), - C0 :: counter(), - C1 :: counter(). -report_nft_counter(Ctrs, {UDL, GlobalENBId}, C0) -> - CtrName = atom_to_list(UDL) ++ "-" ++ GlobalENBId, + ES :: enb_state(), + S0 :: enb_uldl_state(), + S1 :: enb_uldl_state(). +enb_report_nft_counters(Ctrs, + #{genb_id := GlobalENBId, pid := Pid}, + #{uldl := ULDL, ctr := C0} = S) -> + CtrName = enb_nft_counter_name(ULDL, GlobalENBId), case dict:find(CtrName, Ctrs) of {ok, C0} -> %% no diff, nothing to report - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: ~p", - [UDL, GlobalENBId, C0]), - C0; + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): ~p", + [ULDL, Pid, GlobalENBId, C0]), + S; {ok, C1} -> %% XXX: assuming C1 (new) values >= C0 (cached) values - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: ~p -> ~p", - [UDL, GlobalENBId, C0, C1]), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, UDL), + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): ~p -> ~p", + [ULDL, Pid, GlobalENBId, C0, C1]), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_PACKETS(GlobalENBId, ULDL), C1#ctr.packets - C0#ctr.packets), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, UDL), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_UE(GlobalENBId, ULDL), C1#ctr.bytes_ue - C0#ctr.bytes_ue), - s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, UDL), + s1gw_metrics:ctr_inc(?S1GW_CTR_GTPU_BYTES_TOTAL(GlobalENBId, ULDL), C1#ctr.bytes_total - C0#ctr.bytes_total), - C1; + S#{ctr => C1}; error -> %% no counters for this eNB (yet?) - ?LOG_DEBUG("NFT counters (~p) for eNB ~p: nope", - [UDL, GlobalENBId]), - C0 + ?LOG_DEBUG("NFT counters (~p) for eNB (pid ~p, ~p): nope", + [ULDL, Pid, GlobalENBId]), + S end. @@ -591,6 +624,14 @@ nft_expr_match_payload({"udp", "dport"}, Port, Op). +-spec nft_expr_match_ip_addr(uldl_addr()) -> map(). +nft_expr_match_ip_addr({ul, Addr}) -> + nft_expr_match_ip_saddr(Addr, ?OP_EQ); + +nft_expr_match_ip_addr({dl, Addr}) -> + nft_expr_match_ip_daddr(Addr, ?OP_EQ). + + nft_expr_accept() -> #{accept => null}. diff --git a/src/s1ap_proxy.erl b/src/s1ap_proxy.erl index 85a2e80..6f63e4c 100644 --- a/src/s1ap_proxy.erl +++ b/src/s1ap_proxy.erl @@ -652,7 +652,8 @@ 'transportLayerAddress' = TLA_In, 'gTP-TEID' = << TEID_In:32/big >>} = C0, S) -> %% indicate eNB's address to the enft_kpi module - enft_kpi:enb_set_addr(tla_str(TLA_In)), + enft_kpi:enb_set_addr({ul, tla_str(TLA_In)}), + enft_kpi:enb_set_addr({dl, tla_str(TLA_In)}), %% poke E-RAB FSM case erab_fsm_find(ERABId, S) of {ok, Pid} -> @@ -941,7 +942,8 @@ 'transportLayerAddress' = TLA_In, 'gTP-TEID' = << TEID_In:32/big >>} = C0, S) -> %% indicate eNB's address to the enft_kpi module - enft_kpi:enb_set_addr(tla_str(TLA_In)), + enft_kpi:enb_set_addr({ul, tla_str(TLA_In)}), + enft_kpi:enb_set_addr({dl, tla_str(TLA_In)}), %% poke E-RAB FSM case erab_fsm_find(ERABId, S) of {ok, Pid} -> -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40437?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: Icd4a17790062bfcaf2bccb01fa94dcdb65c0872c Gerrit-Change-Number: 40437 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in ...osmo-s1gw[master]: enft_kpi: make enb_set_addr/1 non-blocking
by fixeria 05 Jun '25

05 Jun '25

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40438?usp=email ) Change subject: enft_kpi: make enb_set_addr/1 non-blocking ...................................................................... enft_kpi: make enb_set_addr/1 non-blocking This function is called each time a new E-REB is established, while the result, be it success or failure, does not matter to s1ap_proxy. Use gen_server:cast/2 instead of gen_server:call/2 to avoid blocking. Change-Id: Iacd380f66fc0249a6a645293abd5aac9cdba34d5 Related: SYS#7307 --- M src/enft_kpi.erl 1 file changed, 29 insertions(+), 30 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/38/40438/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index 9b4caf1..d5d5ce3 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -117,11 +117,10 @@ gen_server:call(?MODULE, {?FUNCTION_NAME, GlobalENBId}). --spec enb_set_addr(ULDLAddr) -> ok | {error, term()} +-spec enb_set_addr(ULDLAddr) -> ok when ULDLAddr :: uldl_addr(). enb_set_addr(ULDLAddr) -> - %% TODO: use cast here to avoid blocking - gen_server:call(?MODULE, {?FUNCTION_NAME, ULDLAddr}). + gen_server:cast(?MODULE, {?FUNCTION_NAME, self(), ULDLAddr}). -spec enb_unregister() -> ok | {error, term()}. @@ -203,33 +202,6 @@ {reply, ok, S#state{registry = R1}} end; -handle_call({enb_set_addr, {ULDL, Addr}}, {Pid, _Ref}, - #state{registry = R} = S0) -> - case dict:find(Pid, R) of - %% the given UL/DL Addr is already known - {ok, #{genb_id := GlobalENBId, - ULDL := #{addr := Addr}}} -> - ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", - [Pid, GlobalENBId, ULDL, Addr]), - {reply, ok, S0}; - %% the given UL/DL Addr differs from stored Addr - {ok, #{genb_id := GlobalENBId, - ULDL := #{addr := OldAddr}}} -> - ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", - [Pid, GlobalENBId, ULDL, OldAddr, Addr]), - {reply, {error, addr_mismatch}, S0}; - %% UL/DL state is missing => create it - {ok, #{genb_id := GlobalENBId} = ES} -> - ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " - "creating NFT counters and rules", - [Pid, GlobalENBId, ULDL, Addr]), - {Reply, S1} = enb_set_addr({ULDL, Addr}, ES, S0), - {reply, Reply, S1}; - error -> - ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), - {reply, {error, not_registered}, S0} - end; - handle_call(enb_unregister, {Pid, _Ref}, #state{cfg = Cfg, registry = R0} = S) -> case dict:find(Pid, R0) of @@ -269,6 +241,33 @@ ?LOG_DEBUG("ignore ~p(): ~p", [?FUNCTION_NAME, Info]), {noreply, S}; +handle_cast({enb_set_addr, Pid, {ULDL, Addr}}, + #state{registry = R} = S0) -> + case dict:find(Pid, R) of + %% the given UL/DL Addr is already known + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := Addr}}} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p is already known", + [Pid, GlobalENBId, ULDL, Addr]), + {noreply, S0}; + %% the given UL/DL Addr differs from stored Addr + {ok, #{genb_id := GlobalENBId, + ULDL := #{addr := OldAddr}}} -> + ?LOG_ERROR("eNB (pid ~p, ~p): ~p address ~p -> ~p change?!?", + [Pid, GlobalENBId, ULDL, OldAddr, Addr]), + {noreply, S0}; + %% UL/DL state is missing => create it + {ok, #{genb_id := GlobalENBId} = ES} -> + ?LOG_DEBUG("eNB (pid ~p, ~p): ~p address ~p indicated, " + "creating NFT counters and rules", + [Pid, GlobalENBId, ULDL, Addr]), + {_, S1} = enb_set_addr({ULDL, Addr}, ES, S0), + {noreply, S1}; + error -> + ?LOG_ERROR("eNB (pid ~p) is *not* registered", [Pid]), + {noreply, S0} + end; + handle_cast(report_nft_counters, #state{cfg = #{table_name := TName}, registry = R0} = S) -> -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40438?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: Iacd380f66fc0249a6a645293abd5aac9cdba34d5 Gerrit-Change-Number: 40438 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in ...osmo-s1gw[master]: enft_kpi: use command/expression templates from enftables
by fixeria 05 Jun '25

05 Jun '25

fixeria has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40439?usp=email ) Change subject: enft_kpi: use command/expression templates from enftables ...................................................................... enft_kpi: use command/expression templates from enftables Change-Id: I421ba5ccc8956586136466d5eb50d6ace69eeb67 Related: SYS#7307 --- M src/enft_kpi.erl 1 file changed, 22 insertions(+), 116 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-s1gw refs/changes/39/40439/1 diff --git a/src/enft_kpi.erl b/src/enft_kpi.erl index d5d5ce3..3afe9d5 100644 --- a/src/enft_kpi.erl +++ b/src/enft_kpi.erl @@ -147,15 +147,17 @@ TName = maps:get(table_name, Cfg, "osmo-s1gw"), Interval = maps:get(interval, Cfg, 3000), %% ignore (accept) anything but GTPU @ udp/2152 - R1 = [nft_expr_match_ip_proto("udp", ?OP_NEQ), nft_expr_accept()], - R2 = [nft_expr_match_udp_dport(?GTPU_PORT, ?OP_NEQ), nft_expr_accept()], - Cmds = [nft_cmd_add_table(TName), + R1 = [enftables:nft_expr_match_ip_proto("udp", ?OP_NEQ), + enftables:nft_expr_accept()], + R2 = [enftables:nft_expr_match_udp_dport(?GTPU_PORT, ?OP_NEQ), + enftables:nft_expr_accept()], + Cmds = [enftables:nft_cmd_add_table(TName, [<< "owner" >>]), nft_cmd_add_chain(TName, "gtpu-ul", "prerouting"), nft_cmd_add_chain(TName, "gtpu-dl", "postrouting"), - nft_cmd_add_rule(TName, "gtpu-ul", R1), - nft_cmd_add_rule(TName, "gtpu-dl", R1), - nft_cmd_add_rule(TName, "gtpu-ul", R2), - nft_cmd_add_rule(TName, "gtpu-dl", R2) + enftables:nft_cmd_add_rule(TName, "gtpu-ul", R1), + enftables:nft_cmd_add_rule(TName, "gtpu-dl", R1), + enftables:nft_cmd_add_rule(TName, "gtpu-ul", R2), + enftables:nft_cmd_add_rule(TName, "gtpu-dl", R2) ], case nft_exec(Cmds) of ok -> @@ -221,7 +223,7 @@ handle_call(fetch_counters, _From, #state{cfg = #{table_name := TName}} = S) -> ?LOG_DEBUG("Fetching NFT counters"), - Cmds = [nft_cmd_list_counters(TName)], + Cmds = [enftables:nft_cmd_list_counters(TName)], case nft_exec(Cmds) of {ok, Res} -> Ctrs = parse_nft_counters(Res), @@ -272,7 +274,7 @@ #state{cfg = #{table_name := TName}, registry = R0} = S) -> ?LOG_DEBUG("Fetching and reporting NFT counters"), - Cmds = [nft_cmd_list_counters(TName)], + Cmds = [enftables:nft_cmd_list_counters(TName)], case nft_exec(Cmds) of {ok, Res} -> Ctrs = parse_nft_counters(Res), @@ -312,7 +314,7 @@ ?LOG_NOTICE("Terminating, reason ~p", [Reason]), case Cfg of #{enable := true, table_name := TName} -> - nft_exec([nft_cmd_del_table(TName)]), %% delete the table + nft_exec([enftables:nft_cmd_del_table(TName)]), %% delete the table ok; _ -> ok %% stub mode end. @@ -377,10 +379,11 @@ #{table_name := TName}) -> CName = enb_nft_counter_name(ULDL, GlobalENBId), RName = enb_nft_rule_name(ULDL), + Counter = enftables:nft_counter(TName, CName), Rule = [nft_expr_match_ip_addr({ULDL, Addr}), - nft_expr_counter(CName)], - Cmds = [nft_cmd_add_counter(TName, CName), - nft_cmd_add_rule(TName, RName, Rule) + enftables:nft_expr_counter(CName)], + Cmds = [enftables:nft_cmd_add_counter(Counter), + enftables:nft_cmd_add_rule(TName, RName, Rule) ], case nft_exec(Cmds) of ok -> @@ -419,8 +422,9 @@ [Pid, GlobalENBId, ULDL]), CName = enb_nft_counter_name(ULDL, GlobalENBId), RName = enb_nft_rule_name(ULDL), - Cmds = [nft_cmd_del_rule(TName, RName, Handle), - nft_cmd_del_counter(TName, CName) + Counter = enftables:nft_counter(TName, CName), + Cmds = [enftables:nft_cmd_del_rule(TName, RName, Handle), + enftables:nft_cmd_del_counter(Counter) ], case nft_exec(Cmds) of ok -> ok; @@ -525,7 +529,7 @@ nft_chain_last_handle(TName, CName) -> - Cmds = [nft_cmd_list_chain(TName, CName)], + Cmds = [enftables:nft_cmd_list_chain(TName, CName)], case nft_exec(Cmds) of {ok, Res} -> #{<< "rule" >> := Rule} = lists:last(Res), @@ -536,21 +540,6 @@ end. -nft_cmd_add_table(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName), - flags => [<< "owner" >>] - }, - #{add => #{table => T}}. - - -nft_cmd_del_table(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName) - }, - #{delete => #{table => T}}. - - nft_cmd_add_chain(TName, CName, Hook) -> C = #{family => << "inet" >>, table => list_to_binary(TName), @@ -563,95 +552,12 @@ #{add => #{chain => C}}. -nft_cmd_add_rule(TName, CName, Expr) -> - R = #{family => << "inet" >>, - table => list_to_binary(TName), - chain => list_to_binary(CName), - expr => Expr - }, - #{add => #{rule => R}}. - - -nft_cmd_del_rule(TName, CName, Handle) -> - R = #{family => << "inet" >>, - table => list_to_binary(TName), - chain => list_to_binary(CName), - handle => Handle - }, - #{delete => #{rule => R}}. - - -nft_counter(TName, Name) -> - #{family => << "inet" >>, - table => list_to_binary(TName), - name => list_to_binary(Name) - }. - -nft_cmd_add_counter(TName, Name) -> - #{add => #{counter => nft_counter(TName, Name)}}. - -nft_cmd_del_counter(TName, Name) -> - #{delete => #{counter => nft_counter(TName, Name)}}. - - --spec nft_expr_match_payload({Proto, Field}, Value, Op) -> map() - when Proto :: string(), - Field :: string(), - Value :: term(), - Op :: string(). -nft_expr_match_payload({Proto, Field}, Value, Op) -> - Left = #{payload => #{protocol => list_to_binary(Proto), - field => list_to_binary(Field)}}, - #{match => #{left => Left, - right => Value, - op => list_to_binary(Op)}}. - - -nft_expr_match_ip_proto(Proto, Op) -> - nft_expr_match_payload({"ip", "protocol"}, - list_to_binary(Proto), Op). - -nft_expr_match_ip_saddr(Addr, Op) -> - nft_expr_match_payload({"ip", "saddr"}, - list_to_binary(Addr), Op). - -nft_expr_match_ip_daddr(Addr, Op) -> - nft_expr_match_payload({"ip", "daddr"}, - list_to_binary(Addr), Op). - -nft_expr_match_udp_dport(Port, Op) -> - nft_expr_match_payload({"udp", "dport"}, Port, Op). - - -spec nft_expr_match_ip_addr(uldl_addr()) -> map(). nft_expr_match_ip_addr({ul, Addr}) -> - nft_expr_match_ip_saddr(Addr, ?OP_EQ); + enftables:nft_expr_match_ip_saddr(Addr, ?OP_EQ); nft_expr_match_ip_addr({dl, Addr}) -> - nft_expr_match_ip_daddr(Addr, ?OP_EQ). - - -nft_expr_accept() -> - #{accept => null}. - - -nft_expr_counter(Name) -> - #{counter => list_to_binary(Name)}. - - -nft_cmd_list_chain(TName, CName) -> - C = #{family => << "inet" >>, - table => list_to_binary(TName), - name => list_to_binary(CName) - }, - #{list => #{chain => C}}. - - -nft_cmd_list_counters(TName) -> - T = #{family => << "inet" >>, - name => list_to_binary(TName) - }, - #{list => #{counters => #{table => T}}}. + enftables:nft_expr_match_ip_daddr(Addr, ?OP_EQ). -spec heartbeat(timeout()) -> no_return(). -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-s1gw/+/40439?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: newchange Gerrit-Project: erlang/osmo-s1gw Gerrit-Branch: master Gerrit-Change-Id: I421ba5ccc8956586136466d5eb50d6ace69eeb67 Gerrit-Change-Number: 40439 Gerrit-PatchSet: 1 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de>

1 0

[M] Change in osmo-ci[master]: jobs/reminder-extend-obs-key: new job
by osmith 05 Jun '25

05 Jun '25

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40431?usp=email ) Change subject: jobs/reminder-extend-obs-key: new job ...................................................................... jobs/reminder-extend-obs-key: new job Add a script that downloads the current OBS pubkey, checks its expiration date and fails if it is in less than a year. The idea is to extend it for two years every year (so users have enough time to update their osmocom-keyring package). Change-Id: I934282efbe1fe3bd86813ad53df38ef79575bf8d --- A jobs/reminder-extend-obs-key.yml A scripts/reminder-extend-obs-key.sh 2 files changed, 84 insertions(+), 0 deletions(-) Approvals: pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, but someone else must approve osmith: Looks good to me, approved Jenkins Builder: Verified diff --git a/jobs/reminder-extend-obs-key.yml b/jobs/reminder-extend-obs-key.yml new file mode 100644 index 0000000..d2728dc --- /dev/null +++ b/jobs/reminder-extend-obs-key.yml @@ -0,0 +1,39 @@ +--- +- job: + name: 'reminder-extend-obs-key' + project-type: freestyle + concurrent: false + defaults: global + description: | + Reminder for extending the OBS key (OS#6567) + properties: + - build-discarder: + days-to-keep: 30 + num-to-keep: 30 + parameters: + - string: + name: BRANCH_OSMO_CI + description: | + osmo-ci.git branch with scripts/tarballs/publish-tarballs-for-tags.sh + default: 'master' + - string: + name: EMAIL_NOTIFICATIONS + description: For failed build notifications, set to empty to disable + default: 'jenkins-notifications(a)lists.osmocom.org' + builders: + - shell: | + PUBLISH=1 scripts/reminder-extend-obs-key.sh + scm: + - git: + branches: + - '$BRANCH_OSMO_CI' + url: https://gerrit.osmocom.org/osmo-ci + git-config-name: 'Jenkins Builder' + git-config-email: 'jenkins(a)osmocom.org' + wipe-workspace: true + triggers: + - timed: "@daily" + publishers: + - email: + notify-every-unstable-build: true + recipients: '$EMAIL_NOTIFICATIONS' diff --git a/scripts/reminder-extend-obs-key.sh b/scripts/reminder-extend-obs-key.sh new file mode 100755 index 0000000..2eeebb0 --- /dev/null +++ b/scripts/reminder-extend-obs-key.sh @@ -0,0 +1,45 @@ +#!/bin/sh -ex +mkdir -p _temp +cd _temp + +if ! [ -e public_key ]; then + wget -q https://obs.osmocom.org/projects/osmocom/public_key +fi + +gpg --show-keys public_key + +EXPIRATION_DATE="$(gpg --show-keys public_key | grep -o 'expires: [0-9-]*' | cut -d ' ' -f2)" +EXPIRATION_DATE_S="$(date -d "$EXPIRATION_DATE" +%s)" +ONE_YEAR_FROM_NOW="$(date -d "+356 days" +%Y-%m-%d)" +ONE_YEAR_FROM_NOW_S="$(date -d "$ONE_YEAR_FROM_NOW" +%s)" + +set +x + +if [ "$(echo "$EXPIRATION_DATE" | wc -l)" != 1 ] || [ "$EXPIRATION_DATE_S" -lt "$(date -d "2026-01-01" +%s)" ]; then + echo "Failed to get valid expiration date" + exit 1 +fi + +if [ "$ONE_YEAR_FROM_NOW_S" -lt "$(date -d "2026-01-01" +%s)" ]; then + echo "Failed to get date one year from now" + exit 1 +fi + +echo +echo "Checking if expiration date ($EXPIRATION_DATE) is in less than a year from now ($ONE_YEAR_FROM_NOW)..." + +if [ "$ONE_YEAR_FROM_NOW_S" -gt "$EXPIRATION_DATE_S" ]; then + echo + echo "=============================================================" + echo "The OBS signing key must be extended!" + echo + echo "Instructions:" + echo "https://osmocom.org/projects/osmocom-servers/wiki/OBS_server_setup#Extendin…" + echo + echo "The key becomes valid for 2 years, we extend it after 1 year." + echo "=============================================================" + echo + exit 1 +else + echo "=> OK" +fi -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40431?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I934282efbe1fe3bd86813ad53df38ef79575bf8d Gerrit-Change-Number: 40431 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument
by osmith 05 Jun '25

05 Jun '25

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40425?usp=email ) Change subject: jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument ...................................................................... jobs/osmocom-obs: add EMAIL_NOTIFICATIONS argument Change-Id: I5009f7b722c7455ee6dfd25a6b5370929c9bc469 --- M jobs/osmocom-obs.yml 1 file changed, 5 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved pespin: Looks good to me, but someone else must approve diff --git a/jobs/osmocom-obs.yml b/jobs/osmocom-obs.yml index 39fa5fb..fd11055 100644 --- a/jobs/osmocom-obs.yml +++ b/jobs/osmocom-obs.yml @@ -44,6 +44,10 @@ name: BRANCH description: osmo-ci.git branch default: 'refs/remotes/origin/master' + - string: + name: EMAIL_NOTIFICATIONS + description: For failed job notifications, set to empty to disable + default: 'jenkins-notifications(a)lists.osmocom.org' builders: - shell: | export PYTHONUNBUFFERED=1 @@ -72,6 +76,6 @@ publishers: - email: notify-every-unstable-build: true - recipients: 'jenkins-notifications(a)lists.osmocom.org' + recipients: '$EMAIL_NOTIFICATIONS' # vim: expandtab tabstop=2 shiftwidth=2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40425?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I5009f7b722c7455ee6dfd25a6b5370929c9bc469 Gerrit-Change-Number: 40425 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: OBS: repo without manuals: fix draft removal logic
by osmith 05 Jun '25

05 Jun '25

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40426?usp=email ) Change subject: OBS: repo without manuals: fix draft removal logic ...................................................................... OBS: repo without manuals: fix draft removal logic Adjust set_asciidoc_style_without_draft_watermark() so it does not fail in repositories that do not have any manuals. Fixes: 3b348d5e ("OBS: remove pdf draft watermark for latest pkgs") Change-Id: Ie93430a1f7bd2bae6886e87755e79ff93ea609e7 --- M scripts/obs/lib/srcpkg.py 1 file changed, 3 insertions(+), 1 deletion(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, but someone else must approve fixeria: Looks good to me, approved diff --git a/scripts/obs/lib/srcpkg.py b/scripts/obs/lib/srcpkg.py index 6f4e613..3a09af3 100644 --- a/scripts/obs/lib/srcpkg.py +++ b/scripts/obs/lib/srcpkg.py @@ -169,10 +169,12 @@ def set_asciidoc_style_without_draft_watermark(project): repo_path = lib.git.get_repo_path(project) - doc_makefiles = lib.run_cmd(["grep", "-r", "-l", "include $(OSMO_GSM_MANUALS_DIR)/build/Makefile.asciidoc.inc"], cwd=repo_path) + doc_makefiles = lib.run_cmd(["grep", "-r", "-l", "include $(OSMO_GSM_MANUALS_DIR)/build/Makefile.asciidoc.inc"], cwd=repo_path, check=False) doc_makefiles = doc_makefiles.output.rstrip().split("\n") for doc_makefile in doc_makefiles: + if doc_makefile == "": + continue print(f"{project}: setting asciidoc style to remove draft watermark in {doc_makefile}") lib.run_cmd(["sed", "-i", '/\\/build\\/Makefile\\.asciidoc\\.inc/s/^/ ASCIIDOCSTYLE = $(BUILDDIR)\\/custom-dblatex.sty\\n/', -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40426?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: Ie93430a1f7bd2bae6886e87755e79ff93ea609e7 Gerrit-Change-Number: 40426 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

[XS] Change in osmo-ci[master]: OBS: remove libosmo-sccp-legacy
by osmith 05 Jun '25

05 Jun '25

osmith has submitted this change. ( https://gerrit.osmocom.org/c/osmo-ci/+/40427?usp=email ) Change subject: OBS: remove libosmo-sccp-legacy ...................................................................... OBS: remove libosmo-sccp-legacy Stop building libosmo-sccp-legacy, which is not needed anymore since osmo-msc 1.13.0 has been tagged some time ago. Change-Id: I086e3eff10e79bddd8ec23927b46cc58a7101de6 --- M scripts/obs/lib/config.py 1 file changed, 0 insertions(+), 1 deletion(-) Approvals: pespin: Looks good to me, but someone else must approve Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/scripts/obs/lib/config.py b/scripts/obs/lib/config.py index c6f373e..dc67757 100644 --- a/scripts/obs/lib/config.py +++ b/scripts/obs/lib/config.py @@ -58,7 +58,6 @@ "libosmo-gprs", "libosmo-netif", "libosmo-pfcp", - "libosmo-sccp-legacy", # can be dropped after osmo-msc >= 1.12.x release "libosmo-sigtran", "libosmocore", "libsmpp34", -- To view, visit https://gerrit.osmocom.org/c/osmo-ci/+/40427?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-ci Gerrit-Branch: master Gerrit-Change-Id: I086e3eff10e79bddd8ec23927b46cc58a7101de6 Gerrit-Change-Number: 40427 Gerrit-PatchSet: 1 Gerrit-Owner: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de>

1 0

2026

2025

2024

2023

2022

gerrit-log