lynxis lazus has uploaded this change for review.
Remove authentication acls and auth policy != REMOTE
In prepration to rework the SGSN and integrate libvlr,
remove auth policies for now.
It may be reintroduced later in a similar way as the MSC
is supporting it.
Change-Id: Iea267bfbd9e0f3d1ba00c6d8d8f308b24e8ec6d4
---
M debian/osmo-sgsn.install
M doc/manuals/chapters/configuration.adoc
M include/osmocom/sgsn/auth.h
M include/osmocom/sgsn/sgsn.h
M src/sgsn/sgsn.c
M src/sgsn/sgsn_auth.c
M src/sgsn/sgsn_vty.c
M tests/Makefile.am
D tests/osmo-sgsn-accept-all.cfg
R tests/osmo-sgsn-remote.cfg
M tests/osmo-sgsn_test-nodes.vty
M tests/sgsn/sgsn_test.c
M tests/sgsn/sgsn_test.ok
M tests/vty_test_runner.py
14 files changed, 24 insertions(+), 361 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-sgsn refs/changes/98/43798/1
diff --git a/debian/osmo-sgsn.install b/debian/osmo-sgsn.install
index b9a46ab..91ef8e6 100644
--- a/debian/osmo-sgsn.install
+++ b/debian/osmo-sgsn.install
@@ -2,4 +2,3 @@
lib/systemd/system/osmo-sgsn.service
usr/bin/osmo-sgsn
usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn.cfg usr/share/doc/osmo-sgsn/examples
-usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg usr/share/doc/osmo-sgsn/examples
diff --git a/doc/manuals/chapters/configuration.adoc b/doc/manuals/chapters/configuration.adoc
index d6ddcd3..14b1b36 100644
--- a/doc/manuals/chapters/configuration.adoc
+++ b/doc/manuals/chapters/configuration.adoc
@@ -127,30 +127,14 @@
rejected. The possible options range from accepting just all subscribers without
further checking, to a fine grained access-control, handled by an external HLR.
-accept-all:: All subscribers that attempt to attach to the GPRS network are
-accepted without further checking. This option is intended to be used for
-testing in a controlled environment only. A wide-open network may attract
-subscribers from foreign networks and disrupt their service. It is highly
-recommended to pick one of the options below.
+accept-all:: Deprecated.
remote:: This option allows to connect OsmoSGSN to an external HLR via the
GSUP protocol. This will be the preferred option in larger networks.
-acl-only:: If no external HLR is available, the network operator has the
-option to control the access using an access control list. The access control
-list contains the IMSI numbers of the allowed subscribers. This method offers
-fine grained access control and is ideal for small networks and lab test
-environments.
+acl-only:: Deprecated.
-closed:: This policy mode softens the strict *acl-only* only mode by also
-implicitly accepting home network subscribers. The decision is made by the MCC
-and MNC part of the IMSI number. The combination of MCC and MNC fully identifies
-a subscribers home network, also known as a Home Network Identity (HNI, i.e.
-MCC and MNC found at the start of the IMSI, e.g. MCC 901 and MNC 700 with
-IMSI 901700000003080).
-
-NOTE: The policy mode *closed* must not be confused with the equally named
-policy that is defined for osmo-nitb!
+closed:: Deprecated.
.Example: Assign or change authorization policy
@@ -158,39 +142,17 @@
OsmoSGSN> enable
OsmoSGSN# configure terminal
OsmoSGSN(config)# sgsn
-OsmoSGSN(config-sgsn)# auth-policy acl-only <1>
+OsmoSGSN(config-sgsn)# auth-policy remote <1>
OsmoSGSN(config-sgsn)# write <2>
Configuration saved to sgsn.cfg
OsmoSGSN(config-sgsn)# end
OsmoSGSN# disable
OsmoSGSN>
----
-<1> 'acl-only' is selected as authorization policy
+<1> 'remote' is selected as authorization policy
<2> Saves current changes to cofiguration to make this policy
persistent
-.Example: Access control list
-----
-sgsn
- auth-policy acl-only <1>
- imsi-acl add 001010000000003
- imsi-acl add 001010000000002
- imsi-acl add 001010000000001
- imsi-acl add 901700000000068 <2>
-----
-<1> Set the authorization policy
-<2> Add as many subscribers as required
-
-=== Subscriber Configuration
-
-As opposed to OsmoNITB, OsmoSGSN does not feature a built-in HLR.
-
-It can thus operate only in the following two modes:
-
-. Accessing an external HLR (or HLR gateway) via the GSUP protocol
-. Accepting subscribers based on internal ACL (access control list),
- see also <<auth-pol>>
-
==== Accessing an external HLR via GSUP
The non-standard GSUP protocol was created to provide OsmoSGSN with
@@ -214,14 +176,9 @@
----
OsmoSGSN(config-sgsn)# gsup remote-ip 2.3.4.5 <1>
OsmoSGSN(config-sgsn)# gsup remote-port 10000 <2>
-OsmoSGSN(config-sgsn)# gsup oap-k 000102030405060708090a0b0c0d0e0f <3>
-OsmoSGSN(config-sgsn)# gsup oap-opc 101112131415161718191a1b1c1d1e1f <4>
----
<1> Configure the IP address of the (remote) HLR or HLR-GW
<2> Configure the TCP port of the (remote) HLR or HLR-GW
-<3> Specify the OAP shared key
-<4> Specify the OAP shared OPC
-
=== CDR configuration
diff --git a/include/osmocom/sgsn/auth.h b/include/osmocom/sgsn/auth.h
index a46fb16..fbb0555 100644
--- a/include/osmocom/sgsn/auth.h
+++ b/include/osmocom/sgsn/auth.h
@@ -19,21 +19,9 @@
extern const struct value_string *sgsn_auth_state_names;
-void sgsn_auth_init(struct sgsn_instance *sgsn);
/* Request authorization */
enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mm);
int sgsn_auth_request(struct sgsn_mm_ctx *mm);
void sgsn_auth_update(struct sgsn_mm_ctx *mm);
struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx,
unsigned key_seq);
-
-/*
- * Authorization/ACL handling
- */
-struct imsi_acl_entry {
- struct llist_head list;
- char imsi[OSMO_IMSI_BUF_SIZE];
-};
-struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg);
-int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg);
-int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg);
diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h
index 8524dd7..d9be0ea 100644
--- a/include/osmocom/sgsn/sgsn.h
+++ b/include/osmocom/sgsn/sgsn.h
@@ -85,7 +85,6 @@
enum sgsn_auth_policy auth_policy;
uint8_t gea_encryption_mask;
uint8_t uea_encryption_mask;
- struct llist_head imsi_acl;
struct sockaddr_in gsup_server_addr;
int gsup_server_port;
diff --git a/src/sgsn/sgsn.c b/src/sgsn/sgsn.c
index fe52e6c..a163f4f 100644
--- a/src/sgsn/sgsn.c
+++ b/src/sgsn/sgsn.c
@@ -187,7 +187,7 @@
talloc_set_destructor(inst, sgsn_instance_talloc_destructor);
inst->cfg.gtp_statedir = talloc_strdup(inst, "./");
- inst->cfg.auth_policy = SGSN_AUTH_POLICY_CLOSED;
+ inst->cfg.auth_policy = SGSN_AUTH_POLICY_REMOTE;
inst->cfg.gea_encryption_mask = (1 << GPRS_ALGO_GEA0); /* no encryption */
inst->cfg.uea_encryption_mask = (1 << OSMO_UTRAN_UEA2) | (1 << OSMO_UTRAN_UEA1);
inst->cfg.require_authentication = true; /* only applies if auth_policy is REMOTE */
@@ -215,7 +215,6 @@
osmo_timer_setup(&inst->llme_timer, sgsn_llme_check_cb, NULL);
osmo_timer_schedule(&inst->llme_timer, GPRS_LLME_CHECK_TICK, 0);
/* These are mostly setting up stuff not related to VTY cfg, so they can be set up here: */
- sgsn_auth_init(inst);
sgsn_cdr_init(inst);
sgsn_ra_init(inst);
return inst;
diff --git a/src/sgsn/sgsn_auth.c b/src/sgsn/sgsn_auth.c
index 2f5bc8c..5fbe0be 100644
--- a/src/sgsn/sgsn_auth.c
+++ b/src/sgsn/sgsn_auth.c
@@ -38,72 +38,15 @@
const struct value_string *sgsn_auth_state_names = auth_state_names;
-void sgsn_auth_init(struct sgsn_instance *sgsn)
-{
- INIT_LLIST_HEAD(&sgsn->cfg.imsi_acl);
-}
-
-struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg)
-{
- struct imsi_acl_entry *acl;
- llist_for_each_entry(acl, &cfg->imsi_acl, list) {
- if (!strcmp(imsi, acl->imsi))
- return acl;
- }
- return NULL;
-}
-
-int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg)
-{
- struct imsi_acl_entry *acl;
-
- if (sgsn_acl_lookup(imsi, cfg))
- return -EEXIST;
-
- acl = talloc_zero(NULL, struct imsi_acl_entry);
- if (!acl)
- return -ENOMEM;
- osmo_strlcpy(acl->imsi, imsi, sizeof(acl->imsi));
-
- llist_add(&acl->list, &cfg->imsi_acl);
-
- return 0;
-}
-
-int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg)
-{
- struct imsi_acl_entry *acl;
-
- acl = sgsn_acl_lookup(imsi, cfg);
- if (!acl)
- return -ENODEV;
-
- llist_del(&acl->list);
- talloc_free(acl);
-
- return 0;
-}
-
enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mmctx)
{
- char mccmnc[16];
- int check_net = 0;
- int check_acl = 0;
-
OSMO_ASSERT(mmctx);
switch (sgsn->cfg.auth_policy) {
case SGSN_AUTH_POLICY_OPEN:
- return SGSN_AUTH_ACCEPTED;
-
case SGSN_AUTH_POLICY_CLOSED:
- check_net = 1;
- check_acl = 1;
- break;
-
case SGSN_AUTH_POLICY_ACL_ONLY:
- check_acl = 1;
- break;
+ return SGSN_AUTH_REJECTED;
case SGSN_AUTH_POLICY_REMOTE:
if (!mmctx->subscr)
@@ -129,19 +72,6 @@
return SGSN_AUTH_UNKNOWN;
}
- if (check_net) {
- /* We simply assume that the IMSI exists, as long as it is part
- * of 'our' network */
- snprintf(mccmnc, sizeof(mccmnc), "%s%s",
- osmo_mcc_name(mmctx->ra.lac.plmn.mcc),
- osmo_mnc_name(mmctx->ra.lac.plmn.mnc, mmctx->ra.lac.plmn.mnc_3_digits));
- if (strncmp(mccmnc, mmctx->imsi, mmctx->ra.lac.plmn.mnc_3_digits ? 6 : 5) == 0)
- return SGSN_AUTH_ACCEPTED;
- }
-
- if (check_acl && sgsn_acl_lookup(mmctx->imsi, &sgsn->cfg))
- return SGSN_AUTH_ACCEPTED;
-
return SGSN_AUTH_REJECTED;
}
diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c
index 3d8a3bd..b7df7f8 100644
--- a/src/sgsn/sgsn_vty.c
+++ b/src/sgsn/sgsn_vty.c
@@ -249,7 +249,6 @@
static int config_write_sgsn(struct vty *vty)
{
struct sgsn_ggsn_ctx *gctx;
- struct imsi_acl_entry *acl;
struct apn_ctx *actx;
struct ares_addr_node *server;
struct sgsn_mme_ctx *mme;
@@ -329,9 +328,6 @@
osmo_hexdump_nospc(g_cfg->oap.secret_opc, sizeof(g_cfg->oap.secret_opc)),
VTY_NEWLINE);
- llist_for_each_entry(acl, &g_cfg->imsi_acl, list)
- vty_out(vty, " imsi-acl add %s%s", acl->imsi, VTY_NEWLINE);
-
if (llist_empty(&sgsn->apn_list))
vty_out(vty, " ! apn * ggsn 0%s", VTY_NEWLINE);
llist_for_each_entry(actx, &sgsn->apn_list, list) {
@@ -781,44 +777,15 @@
return CMD_SUCCESS;
}
-
-DEFUN(imsi_acl, cfg_imsi_acl_cmd,
+DEFUN_DEPRECATED(imsi_acl, cfg_imsi_acl_cmd,
"imsi-acl (add|del) IMSI",
"Access Control List of foreign IMSIs\n"
"Add IMSI to ACL\n"
"Remove IMSI from ACL\n"
"IMSI of subscriber\n")
{
- char imsi_sanitized[GSM23003_IMSI_MAX_DIGITS + 1];
- const char *op = argv[0];
- const char *imsi = imsi_sanitized;
- size_t len = strnlen(argv[1], GSM23003_IMSI_MAX_DIGITS + 1);
- int rc;
-
- memset(imsi_sanitized, '0', GSM23003_IMSI_MAX_DIGITS);
- imsi_sanitized[GSM23003_IMSI_MAX_DIGITS] = '\0';
-
- /* Sanitize IMSI */
- if (len > GSM23003_IMSI_MAX_DIGITS) {
- vty_out(vty, "%% IMSI (%s) too long (max %u digits) -- ignored!%s",
- argv[1], GSM23003_IMSI_MAX_DIGITS, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- osmo_strlcpy(imsi_sanitized + GSM23003_IMSI_MAX_DIGITS - len, argv[1],
- sizeof(imsi_sanitized) - (GSM23003_IMSI_MAX_DIGITS - len));
-
- if (!strcmp(op, "add"))
- rc = sgsn_acl_add(imsi, g_cfg);
- else
- rc = sgsn_acl_del(imsi, g_cfg);
-
- if (rc < 0) {
- vty_out(vty, "%% unable to %s ACL%s", op, VTY_NEWLINE);
- return CMD_WARNING;
- }
-
- return CMD_SUCCESS;
+ vty_out(vty, "ACL based on IMSI has been deprecated.%s", VTY_NEWLINE);
+ return CMD_WARNING;
}
DEFUN_DEPRECATED(cfg_encrypt, cfg_encrypt_cmd,
@@ -956,11 +923,18 @@
" permitted to register to the network.\n"
"Accept all IMSIs (DANGEROUS)\n"
"Accept only home network subscribers or those in the ACL\n"
- "Accept only subscribers in the ACL\n"
+ "Accept only subscribers in the ACL. Deprecated.\n"
"Use remote subscription data only (HLR)\n")
{
int val = get_string_value(sgsn_auth_pol_strs, argv[0]);
OSMO_ASSERT(val >= SGSN_AUTH_POLICY_OPEN && val <= SGSN_AUTH_POLICY_REMOTE);
+
+ if (val == SGSN_AUTH_POLICY_ACL_ONLY) {
+ vty_out(vty, "acl-only authentication is deprecated and not implemented anymore.%s",
+ VTY_NEWLINE);
+ return CMD_WARNING;
+ }
+
g_cfg->auth_policy = val;
g_cfg->require_update_location = (val == SGSN_AUTH_POLICY_REMOTE);
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 9d429d7..c907ab3 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -33,7 +33,6 @@
$(TESTSUITE) \
vty_test_runner.py \
ctrl_test_runner.py \
- osmo-sgsn-accept-all.cfg \
osmo-sgsn.cfg \
osmo-sgsn_test-nodes.vty \
$(NULL)
diff --git a/tests/osmo-sgsn-accept-all.cfg b/tests/osmo-sgsn-accept-all.cfg
deleted file mode 100644
index 46a5d61..0000000
--- a/tests/osmo-sgsn-accept-all.cfg
+++ /dev/null
@@ -1,38 +0,0 @@
-# Same as doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg, but without 'gtp state-dir'
-!
-! Osmocom SGSN configuration
-!
-!
-log stderr
- logging color 1
- logging print category-hex 0
- logging print category 1
- logging timestamp 0
- logging print file basename last
- logging print level 1
-
-line vty
- no login
-!
-sgsn
- gtp local-ip 127.0.0.1
- ggsn 0 remote-ip 127.0.0.2
- ggsn 0 gtp-version 1
- ggsn 0 echo-interval 60
- authentication optional
- auth-policy accept-all
-!
-ns
- timer tns-block 3
- timer tns-block-retries 3
- timer tns-reset 3
- timer tns-reset-retries 3
- timer tns-test 30
- timer tns-alive 3
- timer tns-alive-retries 10
- bind udp local
- listen 127.0.0.1 23000
- accept-ipaccess
-!
-bssgp
-!
diff --git a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg b/tests/osmo-sgsn-remote.cfg
similarity index 88%
rename from doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg
rename to tests/osmo-sgsn-remote.cfg
index 9bc1520..e5cd1f9 100644
--- a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg
+++ b/tests/osmo-sgsn-remote.cfg
@@ -14,13 +14,13 @@
no login
!
sgsn
- gtp state-dir /var/lib/osmocom/osmo-sgsn
gtp local-ip 127.0.0.1
ggsn 0 remote-ip 127.0.0.2
ggsn 0 gtp-version 1
ggsn 0 echo-interval 60
authentication optional
- auth-policy accept-all
+ auth-policy remote
+ gsup remote-ip 127.0.0.1
!
ns
timer tns-block 3
diff --git a/tests/osmo-sgsn_test-nodes.vty b/tests/osmo-sgsn_test-nodes.vty
index 031ccfa..1bc28ba 100644
--- a/tests/osmo-sgsn_test-nodes.vty
+++ b/tests/osmo-sgsn_test-nodes.vty
@@ -33,7 +33,6 @@
ggsn <0-255> gtp-version (0|1)
ggsn <0-255> echo-interval <1-36000>
ggsn <0-255> no echo-interval
- imsi-acl (add|del) IMSI
auth-policy (accept-all|closed|acl-only|remote)
authentication (optional|required)
encryption gea <0-4> [<0-4>] [<0-4>] [<0-4>] [<0-4>]
diff --git a/tests/sgsn/sgsn_test.c b/tests/sgsn/sgsn_test.c
index 6dcda84..7a53716 100644
--- a/tests/sgsn/sgsn_test.c
+++ b/tests/sgsn/sgsn_test.c
@@ -65,16 +65,6 @@
TALLOC_FREE(sgsn);
}
-static uint32_t get_new_ptmsi(const struct gprs_gb_parse_context *parse_ctx)
-{
- uint32_t new_ptmsi = GSM_RESERVED_TMSI;
-
- if (parse_ctx->new_ptmsi_enc)
- gprs_parse_tmsi(parse_ctx->new_ptmsi_enc, &new_ptmsi);
-
- return new_ptmsi;
-}
-
/* override */
int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime,
struct bssgp_dl_ud_par *dup)
@@ -1232,118 +1222,6 @@
cleanup_test();
}
-/*
- * Test cancellation of attached MM contexts
- */
-static void test_gmm_cancel(void)
-{
- struct osmo_routing_area_id raid = { 0, };
- struct sgsn_mm_ctx *ctx = NULL;
- struct sgsn_mm_ctx *ictx;
- uint32_t ptmsi1;
- uint32_t foreign_tlli;
- uint32_t local_tlli = 0;
- struct gprs_llc_lle *lle;
-
- sgsn = sgsn_instance_alloc(tall_sgsn_ctx);
- sgsn->cfg.gea_encryption_mask = 0x1;
- const enum sgsn_auth_policy saved_auth_policy = sgsn->cfg.auth_policy;
-
- /* DTAP - Attach Request */
- /* The P-TMSI is not known by the SGSN */
- static const unsigned char attach_req[] = {
- 0x08, 0x01, 0x02, 0xf5, 0xe0, 0x21, 0x08, 0x02, 0x05, 0xf4,
- 0xfb, 0xc5, 0x46, 0x79, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60,
- 0x19, 0x18, 0xb3, 0x43, 0x2b, 0x25, 0x96, 0x62, 0x00, 0x60,
- 0x80, 0x9a, 0xc2, 0xc6, 0x62, 0x00, 0x60, 0x80, 0xba, 0xc8,
- 0xc6, 0x62, 0x00, 0x60, 0x80, 0x00
- };
-
- /* DTAP - Identity Response IMEI */
- static const unsigned char ident_resp_imei[] = {
- 0x08, 0x16, 0x08, 0x9a, 0x78, 0x56, 0x34, 0x12, 0x90, 0x78,
- 0x56
- };
-
- /* DTAP - Identity Response IMSI */
- static const unsigned char ident_resp_imsi[] = {
- 0x08, 0x16, 0x08, 0x19, 0x32, 0x54, 0x76, 0x98, 0x10, 0x32,
- 0x54
- };
-
- /* DTAP - Attach Complete */
- static const unsigned char attach_compl[] = {
- 0x08, 0x03
- };
-
- printf("Testing cancellation\n");
- sgsn->cfg.auth_policy = SGSN_AUTH_POLICY_OPEN;
-
- foreign_tlli = gprs_tmsi2tlli(0xc0000023, TLLI_FOREIGN);
-
- /* Create a LLE/LLME */
- OSMO_ASSERT(count(gprs_llme_list()) == 0);
- lle = gprs_lle_get_or_create(foreign_tlli, 3);
- OSMO_ASSERT(count(gprs_llme_list()) == 1);
-
- /* inject the attach request */
- send_0408_message(lle->llme, foreign_tlli, &raid,
- attach_req, ARRAY_SIZE(attach_req));
-
- ctx = sgsn_mm_ctx_by_tlli(foreign_tlli, &raid);
- OSMO_ASSERT(ctx != NULL);
- OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT);
-
- /* we expect an identity request (IMEI) */
- OSMO_ASSERT(sgsn_tx_counter == 1);
-
- /* inject the identity response (IMEI) */
- send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
- ident_resp_imei, ARRAY_SIZE(ident_resp_imei));
-
- /* we expect an identity request (IMSI) */
- OSMO_ASSERT(sgsn_tx_counter == 1);
-
- /* inject the identity response (IMSI) */
- send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
- ident_resp_imsi, ARRAY_SIZE(ident_resp_imsi));
-
- /* check that the MM context has not been removed due to a failed
- * authorization */
- OSMO_ASSERT(ctx == sgsn_mm_ctx_by_tlli(foreign_tlli, &raid));
-
- OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT);
-
- /* we expect an attach accept/reject */
- OSMO_ASSERT(sgsn_tx_counter == 1);
- ptmsi1 = get_new_ptmsi(&last_dl_parse_ctx);
- OSMO_ASSERT(ptmsi1 != GSM_RESERVED_TMSI);
-
- /* this has been randomly assigned by the SGSN */
- local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL);
-
- /* inject the attach complete */
- send_0408_message(ctx->gb.llme, foreign_tlli, &raid,
- attach_compl, ARRAY_SIZE(attach_compl));
-
- OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_REGISTERED_NORMAL);
-
- /* we don't expect a response */
- OSMO_ASSERT(sgsn_tx_counter == 0);
-
- /* cancel */
- gsm0408_gprs_access_cancelled(ctx, 0);
-
- /* verify that things are gone */
- OSMO_ASSERT(count(gprs_llme_list()) == 0);
- ictx = sgsn_mm_ctx_by_tlli(local_tlli, &raid);
- OSMO_ASSERT(!ictx);
-
- sgsn->cfg.auth_policy = saved_auth_policy;
-
- cleanup_test();
-}
-
static void test_apn_matching(void)
{
struct apn_ctx *actx, *actxs[9];
@@ -1670,7 +1548,6 @@
test_gmm_detach_accept_unexpected();
test_gmm_status_no_mmctx();
test_gmm_reject();
- test_gmm_cancel();
test_apn_matching();
test_ggsn_selection();
test_pdp_status_has_active_nsapis();
diff --git a/tests/sgsn/sgsn_test.ok b/tests/sgsn/sgsn_test.ok
index 35b1d7b..20c9a73 100644
--- a/tests/sgsn/sgsn_test.ok
+++ b/tests/sgsn/sgsn_test.ok
@@ -21,7 +21,6 @@
- Routing Area Update Request (valid)
- Routing Area Update Request (invalid type)
- Routing Area Update Request (invalid CAP length)
-Testing cancellation
Testing APN matching
Testing GGSN selection
Testing pdp_status_has_active_nsapis
diff --git a/tests/vty_test_runner.py b/tests/vty_test_runner.py
index aaa76ed..34c3dee 100755
--- a/tests/vty_test_runner.py
+++ b/tests/vty_test_runner.py
@@ -70,7 +70,7 @@
class TestVTYSGSN(TestVTYBase):
def vty_command(self):
- return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn-accept-all.cfg"]
+ return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn-remote.cfg"]
def vty_app(self):
return (4245, "./src/sgsn/osmo-sgsn", "OsmoSGSN", "sgsn")
@@ -98,7 +98,9 @@
self.assertTrue(self.vty.verify('show bssgp stats', ['']))
self.assertTrue(self.vty.verify('show bssgp nsei 123', ['']))
self.assertTrue(self.vty.verify('show bssgp nsei 123 stats', ['']))
- self.assertTrue(self.vty.verify('show sgsn', [' GSN: signalling 127.0.0.1, user traffic 127.0.0.1']))
+ self.assertTrue(self.vty.verify('show sgsn', [
+ ' Remote authorization: not connected to 127.0.0.1:4222 via GSUP',
+ ' GSN: signalling 127.0.0.1, user traffic 127.0.0.1']))
self.assertTrue(self.vty.verify('show mm-context all', ['']))
self.assertTrue(self.vty.verify('show mm-context imsi 000001234567', ['No MM context for IMSI 000001234567']))
self.assertTrue(self.vty.verify('show pdp-context all', ['']))
@@ -109,27 +111,6 @@
res = self.vty.command("show llc")
self.assertTrue(res.find('State of LLC Entities') >= 0)
- def testVtyAuth(self):
- self.vty.enable()
- self.assertTrue(self.vty.verify('configure terminal', ['']))
- self.assertEqual(self.vty.node(), 'config')
- self.assertTrue(self.vty.verify('sgsn', ['']))
- self.assertEqual(self.vty.node(), 'config-sgsn')
- self.assertTrue(self.vty.verify('auth-policy accept-all', ['']))
- res = self.vty.command("show running-config")
- self.assertTrue(res.find('auth-policy accept-all') > 0)
- self.assertTrue(self.vty.verify('auth-policy acl-only', ['']))
- res = self.vty.command("show running-config")
- self.assertTrue(res.find('auth-policy acl-only') > 0)
- self.assertTrue(self.vty.verify('auth-policy closed', ['']))
- res = self.vty.command("show running-config")
- self.assertTrue(res.find('auth-policy closed') > 0)
- self.assertTrue(self.vty.verify('gsup remote-ip 127.0.0.4', ['']))
- self.assertTrue(self.vty.verify('gsup remote-port 2222', ['']))
- self.assertTrue(self.vty.verify('auth-policy remote', ['']))
- res = self.vty.command("show running-config")
- self.assertTrue(res.find('auth-policy remote') > 0)
-
def testVtySubscriber(self):
self.vty.enable()
res = self.vty.command('show subscriber cache')
To view, visit change 43798. To unsubscribe, or for help writing mail filters, visit settings.