- gerrit-log - lists.osmocom.org

[L] Change in ...osmo-epdg[master]: docs: add basic manual of the osmo-epdg
by Jenkins Builder 11 May '24

11 May '24

Attention is currently required from: lynxis lazus. Jenkins Builder has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email ) Change subject: docs: add basic manual of the osmo-epdg ...................................................................... Patch Set 2: (13 comments) File docs/manuals/chapters/osmo-epdg.adoc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/2d324c9d_8138… PS2, Line 48: key,default,description trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/c1f9da01_9340… PS2, Line 69: key,default,description trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/d6207441_45cc… PS2, Line 88: key,default,description trailing whitespace File docs/manuals/ue-connects.msc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/80f20227_3515… PS2, Line 8: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/2f79d31d_3ae9… PS2, Line 14: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/e51d77f4_f205… PS2, Line 20: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/7cd1ec41_60d7… PS2, Line 22: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/c147b8cf_a7a8… PS2, Line 25: trailing whitespace File docs/manuals/ue-connects2.msc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/1429b417_873a… PS2, Line 7: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/683162e5_baae… PS2, Line 13: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/9948f5f7_6619… PS2, Line 17: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/c2acf9ad_1cae… PS2, Line 20: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16053): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/044c7a51_7900… PS2, Line 26: trailing whitespace -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b Gerrit-Change-Number: 36783 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: daniel <dwillmann(a)sysmocom.de> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Sat, 11 May 2024 18:25:09 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[L] Change in ...osmo-epdg[master]: docs: add basic manual of the osmo-epdg
by lynxis lazus 11 May '24

11 May '24

Attention is currently required from: lynxis lazus. Hello Jenkins Builder, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Verified-1 by Jenkins Builder Change subject: docs: add basic manual of the osmo-epdg ...................................................................... docs: add basic manual of the osmo-epdg Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b --- A docs/manuals/chapters/epcrequirements.adoc A docs/manuals/chapters/osmo-epdg.adoc A docs/manuals/chapters/overview.adoc A docs/manuals/chapters/strongswan.adoc A docs/manuals/osmo-epdg-erlang.dot A docs/manuals/osmo-epdg-overview.dot A docs/manuals/osmo-epdg-usermanual-docinfo.xml A docs/manuals/osmo-epdg-usermanual.adoc A docs/manuals/strongswan-ue-connection.msc A docs/manuals/ue-connects.msc A docs/manuals/ue-connects2.msc 11 files changed, 453 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-epdg refs/changes/83/36783/2 -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b Gerrit-Change-Number: 36783 Gerrit-PatchSet: 2 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-CC: daniel <dwillmann(a)sysmocom.de> Gerrit-CC: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-MessageType: newpatchset

1 0

[L] Change in ...osmo-epdg[master]: docs: add basic manual of the osmo-epdg
by lynxis lazus 11 May '24

11 May '24

lynxis lazus has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email ) Change subject: docs: add basic manual of the osmo-epdg ...................................................................... Patch Set 1: (1 comment) Patchset: PS1: I don't know what is the best way to add build scripts. Should I create a configure in the docs directory? -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b Gerrit-Change-Number: 36783 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-CC: Jenkins Builder Gerrit-Comment-Date: Sat, 11 May 2024 17:29:38 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[L] Change in ...osmo-epdg[master]: docs: add basic manual of the osmo-epdg
by Jenkins Builder 11 May '24

11 May '24

Jenkins Builder has posted comments on this change. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email ) Change subject: docs: add basic manual of the osmo-epdg ...................................................................... Patch Set 1: (13 comments) File docs/manuals/chapters/osmo-epdg.adoc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/fcf4d292_a5ed… PS1, Line 48: key,default,description trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/e4411747_d83e… PS1, Line 69: key,default,description trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/dc8c8f23_7d98… PS1, Line 88: key,default,description trailing whitespace File docs/manuals/ue-connects.msc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/8ff69cc0_f4b0… PS1, Line 8: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/97b7bd63_4d55… PS1, Line 14: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/1a2bf5d8_b514… PS1, Line 20: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/ef87a115_25d2… PS1, Line 22: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/352d40e9_14a9… PS1, Line 25: trailing whitespace File docs/manuals/ue-connects2.msc: Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/93c071cb_c622… PS1, Line 7: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/9ebf41f0_9478… PS1, Line 13: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/4a74bdab_2226… PS1, Line 17: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/61e2763e_9649… PS1, Line 20: trailing whitespace Robot Comment from checkpatch (run ID jenkins-gerrit-lint-16052): https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783/comment/70b9e32c_6bab… PS1, Line 26: trailing whitespace -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b Gerrit-Change-Number: 36783 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-CC: Jenkins Builder Gerrit-Comment-Date: Sat, 11 May 2024 17:29:10 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

1 0

[L] Change in ...osmo-epdg[master]: docs: add basic manual of the osmo-epdg
by lynxis lazus 11 May '24

11 May '24

lynxis lazus has uploaded this change for review. ( https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email ) Change subject: docs: add basic manual of the osmo-epdg ...................................................................... docs: add basic manual of the osmo-epdg Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b --- A docs/manuals/chapters/epcrequirements.adoc A docs/manuals/chapters/osmo-epdg.adoc A docs/manuals/chapters/overview.adoc A docs/manuals/chapters/strongswan.adoc A docs/manuals/osmo-epdg-erlang.dot A docs/manuals/osmo-epdg-overview.dot A docs/manuals/osmo-epdg-usermanual-docinfo.xml A docs/manuals/osmo-epdg-usermanual.adoc A docs/manuals/strongswan-ue-connection.msc A docs/manuals/ue-connects.msc A docs/manuals/ue-connects2.msc 11 files changed, 453 insertions(+), 0 deletions(-) git pull ssh://gerrit.osmocom.org:29418/erlang/osmo-epdg refs/changes/83/36783/1 diff --git a/docs/manuals/chapters/epcrequirements.adoc b/docs/manuals/chapters/epcrequirements.adoc new file mode 100644 index 0000000..036b1ff --- /dev/null +++ b/docs/manuals/chapters/epcrequirements.adoc @@ -0,0 +1,18 @@ +[[epcrequirements]] +== EPC requirements + +The osmo-epdg was tested and developed against open5gs (version 2.7.0.83.290df). + +=== HSS + +When a UE connects it requests an APN via SWu. By default the UE will request +the APN "ims". The subscriber entry must allow connections to the requested APN to succeed. + +=== PGW + +The osmo-epdg/erlang expects the PGW to support and use S2b and S6b. +A UE will request attributes via IKEv2 which are translated into additional PCO in GTP on the S2b +reference point. THe PGW should support additional PCO via S2b. +open5gs supports additional PCO by 2.7.1. + +osmo-epdg only supports S2b over GTP. diff --git a/docs/manuals/chapters/osmo-epdg.adoc b/docs/manuals/chapters/osmo-epdg.adoc new file mode 100644 index 0000000..36c7ee9 --- /dev/null +++ b/docs/manuals/chapters/osmo-epdg.adoc @@ -0,0 +1,93 @@ +[[osmoepdg]] +== osmo-epdg/erlang + +The core component of the osmo-epdg is the osmo-epdg/erlang daemon. +It holds the state of the UE and communicates with the relevant core components. + +[[fig-osmo-epdg-erlang]] +.osmo-epdg/erlang structure +[graphviz] +---- +include::{srcdir}/osmo-epdg-erlang.dot[] +---- + +=== Debian packages + +For Debian based distribution osmocom provides packages repositories: + +- https://osmocom.org/projects/cellular-infrastructure/wiki/Latest_Builds +- https://osmocom.org/projects/cellular-infrastructure/wiki/Nightly_Builds + +The osmo-epdg package contains a systemd.service file and a default example configuration. + +=== Configuration + +The osmo-epdg/erlang is configured via Erlang configuration (https://www.erlang.org/doc/man/config.html). +When using the osmo-epdg debian package, the default location for the configuration is +*/etc/osmocom/osmo-epdg.config*. + +===== CEIA: Connection for strongSwan + +[format="csv",options="header"] +|=== +key, default, description +gsup_local_ip, 127.0.0.1, bind IP of the GSUP server (TCP). strongSwan connects to this IP. +gsup_local_port, 4222, bind TCP server port +|=== + +===== SWx (diameter) + +SWx (<<3gpp-ts-29-273>>): Interface between AAA and HSS. +The AAA will retrieve authentication, authorize the UE and +update the location (AAA, PGW address) in the HSS. + +See Erlang diameter specific behaviour on https://www.erlang.org/doc/man/diameter.html + +[format="csv",options="header"] +|=== +key,default,description +dia_swx_remote_ip, 127.0.0.1, Remote IP of the HSS +dia_swx_remote_port, 3868, SCTP port of the HSS +dia_swx_proto, sctp, Protocol. sctp or tcp +dia_swx_connect_timer, 30000, Watchdog Connect timer in ms. RFC 6733.dia_swx_watchdog_timer, 30000, Watchdog TwInit. RFC 3539. +dia_swx_watchdog_config, "[ok, suspect]", See https://www.erlang.org/doc/man/diameter.html +dia_swx_transmit_timer, 10000, SWx Transmit Timeout (ms) +dia_swx_vendor_id, 0, Diameter Vendor Id +dia_swx_origin_host, epdg.localdomain, Diameter Origin Host +dia_swx_origin_realm, localdomain, Diameter Origin Realm +|=== + +===== S6b (diameter) + +S6b (<<3gpp-ts-29-273>>): Interface between AAA and PGW. +Authorize the GTP session of the ePDG. + +See Erlang diameter specific behaviour on https://www.erlang.org/doc/man/diameter.html + +[format="csv",options="header"] +|=== +key,default,description +dia_s6b_local_ip, 127.0.0.10, local bind IP +dia_s6b_local_port, 3868, local bind Port +dia_s6b_proto, sctp, Protocol. sctp or tcp +dia_s6b_connect_timer, 30000, Watchdog Connect timer in ms. RFC 6733. +dia_s6b_watchdog_timer, 30000, Watchdog TwInit. RFC 3539. +dia_s6b_watchdog_config, "[ok, suspect]", See https://www.erlang.org/doc/man/diameter.html +dia_s6b_vendor_id, 0, Diameter Vendor Id +dia_s6b_origin_host, aaa.localdomain, Diameter Origin Host +dia_s6b_origin_realm, localdomain, Diameter Origin Realm +|=== + +===== S2b (GTPv2) + +S2b (<<3gpp-ts-29-273>>): Interface between ePDG and PGW. +GTP control plane for the UE traffic. + +[format="csv",options="header"] +|=== +key,default,description +gtpc_local_ip, 127.0.0.2, local bind IP +gtpc_local_port, 2123, local bind Port +gtpc_remote_ip, 127.0.0.1, remote IP of the PGW +gtpc_remote_port, 2123, remote port of the PGW +|=== diff --git a/docs/manuals/chapters/overview.adoc b/docs/manuals/chapters/overview.adoc new file mode 100644 index 0000000..75a0d02 --- /dev/null +++ b/docs/manuals/chapters/overview.adoc @@ -0,0 +1,61 @@ +[[overview]] +== Overview + +This manual should help you getting started with osmo-epdg. It will cover +aspects of configuring and running the osmo-epdg. + +[[intro_overview]] +=== About osmo-epdg + +osmo-epdg is a combined ePDG (Evolved Packet Data Gateway) and AAA (Authorization, Authentication, Accounting). +The ePDG is used by an UE to connect via an untrusted non-3GPP access network towards the PGW to allow +VoWifi (Voice over Wifi). + +The UE will establish a tunnel using IPSec (IKEv2 and ESP) towards the ePDG (SWu interface). +The ePDG will authenticate and authorize the UE by using an AAA and will forward the traffic from the UE towards +a PGW. + +[[fig-osmo-epdg-overview]] +.`osmo-epdg` structure +[graphviz] +---- +include::{srcdir}/osmo-epdg-overview.dot[] +---- + +The core of the osmo-epdg is the erlang daemon (osmo-epdg/erlang). +It communicates with core components by 3GPP protocols and contains the state of UEs. +Further the osmo-epdg is using strongSwan to handle the communication towards UEs. +Both components communicate over the internal protocol CEIA based on GSUP. + +=== Components of the osmo-epdg + +* strongSwan (IKEv2/ESP) +* osmo-epdg (state handling, communication with other core components) +* Linux generic policy routing and firewall (user plane) + +=== Interfaces of the osmo-epdg + +==== strongSwan + +* SWu: IPsec/IKEv2 towards the UE. +* netlink: with the Linux kernel to encrypt and decrypt ESP traffic. +* CEIA: internal communication to osmo-epdg/erlang to forward authentication and state based on GSUP. + +==== osmo-epdg/erlang + +Interface to other core components. In round brackets the represented core component of the osmo-epdg side. + +* SWx: with HSS for authentication, authorisation, accounting (AAA) +* S2b: with PGW to create GTP session (ePDG) +* S6b: with PGW for authorisation of a GTP session (AAA) +* netlink: with the Linux kernel to create GTP tunnels (ePDG) +* CEIA: internal communication to osmo-epdg/erlang to forward authentication and state based on GSUP. (ePDG/AAA) + +==== Relevant 3gpp specifications + +- [[[3gpp-ts-23-402]]] 3GPP TS 23.402 Architecture enhancements for non-3GPP accesses +- [[[3gpp-ts-24-302]]] 3GPP TS 24.302 Architecture enhancements for non-3GPP accesses +- [[[3gpp-ts-29-273]]] 3GPP TS 29.273: 3GPP EPS AAA interfaces +- [[[3gpp-ts-20-274]]] 3GPP TS 29.274: Tunnelling Protocol for Control plane (GTPv2-C) +- [[[3gpp-ts-33-402]]] 3GPP TS 33.402: Security aspects of non-3GPP accesses + diff --git a/docs/manuals/chapters/strongswan.adoc b/docs/manuals/chapters/strongswan.adoc new file mode 100644 index 0000000..6a06eec --- /dev/null +++ b/docs/manuals/chapters/strongswan.adoc @@ -0,0 +1,58 @@ +[[strongswan]] +== strongSwan + +strongSwan is a free software implementationo of IPsec. +It can support multiple different IPsec standards. +osmo-epdg is using strongSwan to terminate SWu (IKEv2 and ESP) traffic. + +strongSwan has been extended to support this role in the osmo-epdg. + +Example configuration for strongSwan can be found under https://gitea.osmocom.org/ims-volte-vowifi/ansible-prototype + +=== Concept of strongSwan within osmo-epdg + +strongSwan will be used as interface towards SWu (IKEv2 and ESP). +The osmo-epdg/erlang component is the core and the primary source of the truth. +strongSwan should keep a little state as possible while osmo-epdg/erlang keeps the full state. + +strongSwan/osmo-epdg and osmo-epdg/erlang communicates via the CEIA (Charon External AKA Interface) +and share state over this protocol. +CEIA is implemented on top of GSUP based on TCP port 4222. + +strongSwan will handle and terminate EAP traffic instead of forwarding this towards +a AAA core component. It will request authentication quintlet via CEIA. +Further strongSwan handles IKEv2 traffic and communicates with the Linux kernel to handle +the ESP (user-plane) traffic. The Linux kernel will decrypt, decapsulate and forward traffic +towards GTP tunnels. + +It is possible to modify the given configuration example to change or extend certain aspects +of the usage of strongSwan. But the example configuration is expected as given for this chapter. + +=== CEIA (Charon External AKA Interface) + +The Charon External AKA interface is used by strongSwan/osmo-epdg to communicate +with osmo-epdg/erlang. +It is based on GSUP (https://ftp.osmocom.org/docs/osmo-hlr/master/osmohlr-usermanual.pdf) + +strongSwan/osmo-epdg is using the CEAI to: + +- authenticate UEs +- authorize UEs +- prepare user plane to forward traffic +- notify about termination of UEs + +Further it allows the osmo-epdg/erlang to: + +- terminate UE sessions (SWu) + +The initial connection of GSUP is done by strongSwan/osmo-epdg (client) towards +the osmo-epdg/erlang (server). +The protocol is re-using already defined PDU and messages of GSUP. + +==== UE connecting + +[mscgen] +---- +include::{srcdir}/strongswan-ue-connection.msc[] +---- + diff --git a/docs/manuals/osmo-epdg-erlang.dot b/docs/manuals/osmo-epdg-erlang.dot new file mode 100644 index 0000000..a3d8872 --- /dev/null +++ b/docs/manuals/osmo-epdg-erlang.dot @@ -0,0 +1,28 @@ +digraph G { + node [shape=rect]; + rankdir=LR; + + eUE; + + subgraph cluster1 { + color=black; + label="osmo-epdg (combined epdg/AAA)"; + + { rank=same; strongswan; osmoepdg;} + osmoepdg [label="osmo-epdg/erlang"; color="blue"]; + } + + subgraph cluster2 { + label="epc"; + hss; + pgw; + } + + eUE -> strongswan [label="IKEv2/ESP", dir="both"]; + strongswan -> osmoepdg [label="CEIA/GSUP", dir="both"]; + osmoepdg -> hss [label="SWx (AAA)", dir="both"]; + osmoepdg -> pgw [label="S2b (ePDG)", dir="both"]; + pgw -> ims [label="IPv4/IPv6", dir="both"]; + pgw -> osmoepdg [label="S6b (AAA)", dir="both"]; +} + diff --git a/docs/manuals/osmo-epdg-overview.dot b/docs/manuals/osmo-epdg-overview.dot new file mode 100644 index 0000000..74dce89 --- /dev/null +++ b/docs/manuals/osmo-epdg-overview.dot @@ -0,0 +1,28 @@ +digraph G { + node [shape=rect]; + rankdir=LR; + + eUE; + + subgraph cluster1 { + color=blue; + label="osmo-epdg (combined ePDG/AAA)"; + + { rank=same; strongswan; osmoepdg;} + osmoepdg [label="osmo-epdg"]; + } + + subgraph cluster2 { + label="epc"; + hss; + pgw; + } + + eUE -> strongswan [label="IKEv2/ESP", dir="both"]; + strongswan -> osmoepdg [label="CEIA/GSUP", dir="both"]; + osmoepdg -> hss [label="SWx (AAA)", dir="both"]; + osmoepdg -> pgw [label="S2b (ePDG)", dir="both"]; + pgw -> ims [label="IPv4/IPv6", dir="both"]; + pgw -> osmoepdg [label="S6b (AAA)", dir="both"]; +} + diff --git a/docs/manuals/osmo-epdg-usermanual-docinfo.xml b/docs/manuals/osmo-epdg-usermanual-docinfo.xml new file mode 100644 index 0000000..6216b3c --- /dev/null +++ b/docs/manuals/osmo-epdg-usermanual-docinfo.xml @@ -0,0 +1,46 @@ +<revhistory> + <revision> + <revnumber>1</revnumber> + <date>April 23, 2014</date> + <authorinitials>AC</authorinitials> + <revremark> + Initial version. + </revremark> + </revision> +</revhistory> + +<authorgroup> + <author> + <firstname>Alexander</firstname> + <surname>Couzens</surname> + <email>acouzens(a)sysmocom.de</email> + <authorinitials>AC</authorinitials> + <affiliation> + <shortaffil>sysmocom</shortaffil> + <orgname>sysmocom - s.f.m.c. GmbH</orgname> + <jobtitle>Developer</jobtitle> + </affiliation> + </author> +</authorgroup> + +<copyright> + <year>2024</year> + <holder>sysmocom - s.f.m.c. GmbH</holder> +</copyright> + +<legalnotice> + <para> + Permission is granted to copy, distribute and/or modify this + document under the terms of the GNU Free Documentation License, + Version 1.3 or any later version published by the Free Software + Foundation; with no Invariant Sections, no Front-Cover Texts, + and no Back-Cover Texts. A copy of the license is included in + the section entitled "GNU Free Documentation License". + </para> + <para> + The Asciidoc source code of this manual can be found at + <ulink url="https://gitea.osmocom.org/erlang/osmo-epdg"> + https://gitea.osmocom.org/erlang/osmo-epdg + </ulink> + </para> +</legalnotice> diff --git a/docs/manuals/osmo-epdg-usermanual.adoc b/docs/manuals/osmo-epdg-usermanual.adoc new file mode 100644 index 0000000..05eb6b0 --- /dev/null +++ b/docs/manuals/osmo-epdg-usermanual.adoc @@ -0,0 +1,14 @@ +:gfdl-enabled: +:program-name: osmo-epdg + +osmo-ePDG User Manual +===================== +Alexander Couzens <acouzens(a)sysmocom.de> + + +include::{commondir}/chapters/preface.adoc[] + +include::{srcdir}/chapters/overview.adoc[] + +include::{srcdir}/chapters/strongswan.adoc[] +include::{srcdir}/chapters/osmo-epdg.adoc[] diff --git a/docs/manuals/strongswan-ue-connection.msc b/docs/manuals/strongswan-ue-connection.msc new file mode 100644 index 0000000..02d366b --- /dev/null +++ b/docs/manuals/strongswan-ue-connection.msc @@ -0,0 +1,31 @@ +msc { + hscale = 2; + UE, + sswan [label="strongSwan"], + ePDG [label="osmo-epdg/erlang"], + PGW, + HSS; + + UE <=> sswan [label="IKE: SA_INIT"]; + UE => sswan [label="IKE: AUTH_REQ (IDi=NAI, IDr=APN, CFG Req)"]; + sswan => ePDG [label="GSUP: Send Auth Information Req (NAI, APN)"]; + ePDG => HSS [label="SWx MAR (Multimedia Authentication Request)"]; + ePDG <= HSS [label="SWx MAA (Multimedia Authentication Answer)"]; + sswan <= ePDG [label="GSUP: Send Auth Information Res (Quintlet)"]; + UE <= sswan [label="IKE: AUTH_RESP (EAP-Request/AKA-Challenge)"]; + UE => sswan [label="IKE: AUTH_REQ (EAP-Request/AKA-Response)"]; + sswan => ePDG [label="GSUP: Location Update Req"]; + ePDG => HSS [label="SWx SAR (Server Assignment Request)"]; + ePDG <= HSS [label="SWx SAA (Server Assignment Answer)"]; + sswan <= ePDG [label="GSUP: Location Update Res"]; + UE <= sswan [label="IKE: AUTH_RESP (EAP Success)"]; + UE => sswan [label="IKE: AUTH_REQ"]; + sswan => ePDG [label="GSUP: Tunnel Req"]; + ePDG => PGW [label="S2b: Create Session Request"]; + ePDG => HSS [label="SWx SAR (Server Assignment Request)"]; + ePDG <= HSS [label="SWx SAA (Server Assignment Answer)"]; + ePDG <= PGW [label="S2b: Create Session Answer"]; + sswan <= ePDG [label="GSUP: Tunnel Res"]; + UE <= sswan [label="IKE: AUTH_RESP (CFG Reply)"]; + UE <=> sswan [label="IPSEC SA"]; +} diff --git a/docs/manuals/ue-connects.msc b/docs/manuals/ue-connects.msc new file mode 100644 index 0000000..4ff38c5 --- /dev/null +++ b/docs/manuals/ue-connects.msc @@ -0,0 +1,35 @@ +# UE/ePDG/AAA/HSS/PGW +msc { + hscale = 2; + UE, ePDG [label="osmo-epdg (ePDG/AAA)"], HSS, PGW; + + UE => ePDG [ label="IKE SA INIT" ]; + UE <= ePDG [ label="IKE SA INIT" ]; + + UE => ePDG [ label="IKE Auth Req (IDi=APN, IDr=NAI); TS; CFG (P-CSCF, IP, DNS)" ]; + ePDG => HSS [ label="SWx Multimedia Auth Request (APN, NAI)" ]; + ePDG <= HSS [ label="SWx Multimedia Auth Answer (APN, NAI)" ]; + UE <= ePDG [ label="IKE Auth Resp (EAP AKA: Autn, Rand)" ]; + UE => ePDG [ label="IKE Auth Req (EAP AKA: Res)" ]; + + ePDG => HSS [ label="SWx Server Assignment Request (APN, NAI)"]; + ePDG <= HSS [ label="SWx Server Assignment Answer (APN, NAI)"]; + UE <= ePDG [ label="IKE Auth Resp (EAP: Success)" ]; + +--- [ label="UE authenticated" ]; + + UE => ePDG [ label="IKE Auth Req" ]; + + ePDG => PGW [ label="S2b Create Session Request (PCO: P-CSCF, IP, DNS)" ]; + ePDG <= PGW [ label="S6b Authentication/Authorization Request" ]; + + ePDG => HSS [ label="SWx Server Assignment Request (APN, NAI)"]; + ePDG <= HSS [ label="SWx Server Assignment Answer (APN, NAI)"]; + + ePDG => PGW [ label="S6b Authentication/Authorization Answer" ]; + ePDG <= PGW [ label="S2b Create Session Answer (PCO: P-CSCF, IP, DNS)" ]; + + UE <= ePDG [ label="IKE Auth Resp" ]; + +--- [ label="Tunnel established" ]; +} diff --git a/docs/manuals/ue-connects2.msc b/docs/manuals/ue-connects2.msc new file mode 100644 index 0000000..8eaefc3 --- /dev/null +++ b/docs/manuals/ue-connects2.msc @@ -0,0 +1,32 @@ +# UE/ePDG/AAA/HSS?PGW +msc { + UE, ePDG [label="osmo-epdg (ePDG/AAA)"], HSS, PGW; + + UE => ePDG [ label="IKE SA INIT" ]; + UE <= ePDG [ label="IKE SA INIT" ]; + + UE => ePDG [ label="IKE Auth Req (APN, NAI)" ]; + ePDG => HSS [ label="SWx Multimedia Auth Request (APN, NAI)" ]; + ePDG <= HSS [ label="SWx Multimedia Auth Answer (APN, NAI)" ]; + UE <= ePDG [ label="IKE Auth Resp (EAP AKA: Autn, Rand)" ]; + UE => ePDG [ label="IKE Auth Req (EAP AKA: Res)" ]; + + ePDG => HSS [ label="SWx Server Assignment Request (APN, NAI)"]; + ePDG <= HSS [ label="SWx Server Assignment Answer (APN, NAI)"]; + UE <= ePDG [ label="IKE Auth Resp (EAP: Success)" ]; + + UE => ePDG [ label="IKE Auth Req" ]; + UE <= ePDG [ label="IKE Auth Resp" ]; + +--- [ label="IKE SA estabilished" ]; + + UE => ePDG [ label="IKE Create Child SA" ]; + ePDG => PGW [ label="S2b Create Session Request" ]; + ePDG <= PGW [ label="S6b Authentication/Authorization Request" ]; + + ePDG => HSS [ label="SWx Server Assignment Request (APN, NAI)" ]; + ePDG <= HSS [ label="SWx Server Assignment Answer (APN, NAI)" ]; + + ePDG => PGW [ label="S6b Authentication/Authorization Answer" ]; + ePDG <= PGW [ label="S2b Create Session Answer" ]; +} -- To view, visit https://gerrit.osmocom.org/c/erlang/osmo-epdg/+/36783?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: erlang/osmo-epdg Gerrit-Branch: master Gerrit-Change-Id: I596b6a351b7356aefa7e69f95521bc4012b9264b Gerrit-Change-Number: 36783 Gerrit-PatchSet: 1 Gerrit-Owner: lynxis lazus <lynxis(a)fe80.eu> Gerrit-MessageType: newchange

1 0

[S] Change in docker-playground[master]: asterisk: Enable capabilities required to set up ipsec
by laforge 11 May '24

11 May '24

Attention is currently required from: jolly, pespin. laforge has posted comments on this change. ( https://gerrit.osmocom.org/c/docker-playground/+/36775?usp=email ) Change subject: asterisk: Enable capabilities required to set up ipsec ...................................................................... Patch Set 1: Code-Review+1 -- To view, visit https://gerrit.osmocom.org/c/docker-playground/+/36775?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: docker-playground Gerrit-Branch: master Gerrit-Change-Id: I2dc040cf87169c9a59dc7e9f1af0e1c17bde6683 Gerrit-Change-Number: 36775 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: jolly <andreas(a)eversberg.eu> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: jolly <andreas(a)eversberg.eu> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Sat, 11 May 2024 12:50:53 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

1 0

[M] Change in osmo-ttcn3-hacks[master]: msc: add TC_gsup_mt_sms_lu_x5 for X5 (LU delay) timer
by fixeria 11 May '24

11 May '24

Attention is currently required from: fixeria, pespin. Hello Jenkins Builder, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/36772?usp=email to look at the new patch set (#2). The following approvals got outdated and were removed: Code-Review+1 by pespin, Verified-1 by Jenkins Builder Change subject: msc: add TC_gsup_mt_sms_lu_x5 for X5 (LU delay) timer ...................................................................... msc: add TC_gsup_mt_sms_lu_x5 for X5 (LU delay) timer Change-Id: I74fa174ea649adb2112c8e471c0e339a2197a08d Related: osmo-msc.git Ic519cab55d65e47b2636124427dab1a1d80fab78 Related: SYS#6913 --- M msc/BSC_ConnectionHandler.ttcn M msc/MSC_Tests.ttcn M msc/expected-results.xml 3 files changed, 78 insertions(+), 3 deletions(-) git pull ssh://gerrit.osmocom.org:29418/osmo-ttcn3-hacks refs/changes/72/36772/2 -- To view, visit https://gerrit.osmocom.org/c/osmo-ttcn3-hacks/+/36772?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-ttcn3-hacks Gerrit-Branch: master Gerrit-Change-Id: I74fa174ea649adb2112c8e471c0e339a2197a08d Gerrit-Change-Number: 36772 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: newpatchset

1 0

[M] Change in osmo-msc[master]: libmsc: add X5 timer for delaying LU transactions
by fixeria 11 May '24

11 May '24

Attention is currently required from: laforge, neels, pespin. Hello Jenkins Builder, laforge, neels, pespin, I'd like you to reexamine a change. Please visit https://gerrit.osmocom.org/c/osmo-msc/+/36760?usp=email to look at the new patch set (#3). The following approvals got outdated and were removed: Code-Review+1 by laforge, Code-Review-1 by neels, Verified+1 by Jenkins Builder Change subject: libmsc: add X5 timer for delaying LU transactions ...................................................................... libmsc: add X5 timer for delaying LU transactions The idea is to allow re-using the radio channel that was used for Location Updating to deliver MT SMS over GSUP. This is achieved by delaying release of a BSSAP/RANAP connection and thus delaying the release of the radio channel. The delay can be configured using new timer X5 (default 0 ms), separately for GERAN and UTRAN. Change-Id: Ic519cab55d65e47b2636124427dab1a1d80fab78 Related: osmo-ttcn3-hacks.git I74fa174ea649adb2112c8e471c0e339a2197a08d Related: SYS#6913 --- M include/osmocom/msc/msc_a.h M src/libmsc/msc_a.c M src/libmsc/ran_infra.c 3 files changed, 63 insertions(+), 1 deletion(-) git pull ssh://gerrit.osmocom.org:29418/osmo-msc refs/changes/60/36760/3 -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/36760?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Ic519cab55d65e47b2636124427dab1a1d80fab78 Gerrit-Change-Number: 36760 Gerrit-PatchSet: 3 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: newpatchset

1 0

[M] Change in osmo-msc[master]: libmsc: add X5 timer for delaying LU transactions
by fixeria 11 May '24

11 May '24

Attention is currently required from: neels, pespin. fixeria has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-msc/+/36760?usp=email ) Change subject: libmsc: add X5 timer for delaying LU transactions ...................................................................... Patch Set 2: (1 comment) Patchset: PS2: There is definitely some confusion here. The commit message clearly states MT SMS over GSUP, which is not using the MSC's internal SMSC. The customer explicitly requested to implement this delay for the SMS over GSUP user case. Neels: what you're describing applies to the MSC's built-in SMSC. It already does deliver MT SMS just fine using the existing LU transaction (grep for `S_SUBSCR_ATTACHED`). And yes, we do check the SMS queue before put()ing the LU token. However things get a bit more complicated when using SMS over GSUP, i.e. external 3rd party SMSC. You cannot know in advance if there is pending SMS for a subscriber, and you cannot query that asynchronously because there exists no primitive for that. This is why we're adding this delay: to give the external SMSC a bit more time to deliver MT SMS, which can be sent over the existing RR connection. I did not ask the customer why or for what they want to optimize delivery of MT SMS during Location Updating, but I can imagine a use case of sending "welcome SMS" to newly registered subscribers. > Re Pau's remark, if you keep this patch with the timer delay instead of running the SMS queue like I am suggesting, some of msc_a_fsm_cleanup() or trans_free() should osmo_timer_del() the timer, to make very sure that the timer cb does not try to access a freed pointer. Oh, I get the point now. Will update the patch. > (A consideration: if we ever remove the SMS queue implementation from osmo-msc to a separate SMSC, there should be some async operation to ask for a pending SMS before releasing a conn. [...] AFAIK, there exists no such primitive/procedure in MAP protocol. We want to keep GSUP as close as possible to MAP, so I don't think we should be adding this. There is a concept of `readyForSM`, when after an unsuccessful MT SMS delivery attempt (e.g. subscriber was not present, did not respond to paging) the MSC/VLR sets `MNRF` flag and then sends this primitive when subscriber is back online. But this is a different thing. > I guess that's well under 5 seconds or alike in usual case? You both keep mentioning this, not sure where this 5 seconds comes from. It's a configurable value, which is expected to be set to accomodate for delay between the MSC and the external SMSC. The exact value may vary depending on the expected delay between CNI components. I am even considering to allow using milliseconds instead of seconds. -- To view, visit https://gerrit.osmocom.org/c/osmo-msc/+/36760?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-msc Gerrit-Branch: master Gerrit-Change-Id: Ic519cab55d65e47b2636124427dab1a1d80fab78 Gerrit-Change-Number: 36760 Gerrit-PatchSet: 2 Gerrit-Owner: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: neels <nhofmeyr(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: neels <nhofmeyr(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Sat, 11 May 2024 11:11:43 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: neels <nhofmeyr(a)sysmocom.de> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: comment

1 0

[S] Change in pysim[master]: pySim-trace: Support decoding of eUICC traces
by laforge 10 May '24

10 May '24

laforge has submitted this change. ( https://gerrit.osmocom.org/c/pysim/+/36777?usp=email ) Change subject: pySim-trace: Support decoding of eUICC traces ...................................................................... pySim-trace: Support decoding of eUICC traces Let's register the ISD-R and ECASD applications so we avoid the warnings printed when processing an eUICC protocol trace: WARNING pySim.apdu.ts_102_221: SELECT UNKNOWN AID a0000005591010ffffffff8900000100 Change-Id: I362a1a7f12d979ff0b7971d5300db9ed56bb1ee5 --- M pySim-trace.py M pysim-testdata/pySim-trace_test_gsmtap.pcapng.ok 2 files changed, 19 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified laforge: Looks good to me, approved diff --git a/pySim-trace.py b/pySim-trace.py index 91f50a3..be1d40b 100755 --- a/pySim-trace.py +++ b/pySim-trace.py @@ -14,6 +14,7 @@ from pySim.ts_102_221 import CardProfileUICC from pySim.ts_31_102 import CardApplicationUSIM from pySim.ts_31_103 import CardApplicationISIM +from pySim.euicc import CardApplicationISDR, CardApplicationECASD from pySim.transport import LinkBase from pySim.apdu_source.gsmtap import GsmtapApduSource @@ -78,6 +79,8 @@ profile = CardProfileUICC() profile.add_application(CardApplicationUSIM()) profile.add_application(CardApplicationISIM()) + profile.add_application(CardApplicationISDR()) + profile.add_application(CardApplicationECASD()) scc = SimCardCommands(transport=DummySimLink()) card = UiccCardBase(scc) self.rs = RuntimeState(card, profile) diff --git a/pysim-testdata/pySim-trace_test_gsmtap.pcapng.ok b/pysim-testdata/pySim-trace_test_gsmtap.pcapng.ok index 047f9de..b947983 100644 --- a/pysim-testdata/pySim-trace_test_gsmtap.pcapng.ok +++ b/pysim-testdata/pySim-trace_test_gsmtap.pcapng.ok @@ -3,6 +3,8 @@ Detected UICC Add-on "RUIM" Can't read AIDs from SIM -- 'list' object has no attribute 'lower' warning: EF.DIR seems to be empty! + ADF.ECASD: a0000005591010ffffffff8900000200 + ADF.ISD-R: a0000005591010ffffffff8900000100 ISIM: a0000000871004 USIM: a0000000871002 CardReset(3b9f96801f878031e073fe211b674a4c753034054ba9) -- To view, visit https://gerrit.osmocom.org/c/pysim/+/36777?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: pysim Gerrit-Branch: master Gerrit-Change-Id: I362a1a7f12d979ff0b7971d5300db9ed56bb1ee5 Gerrit-Change-Number: 36777 Gerrit-PatchSet: 2 Gerrit-Owner: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-MessageType: merged

1 0

2026

2025

2024

2023

2022

gerrit-log