lynxis lazus has submitted this change. ( https://gerrit.osmocom.org/c/osmo-sgsn/+/43798?usp=email ) Change subject: Remove authentication acls and auth policy != REMOTE ...................................................................... Remove authentication acls and auth policy != REMOTE In prepration to rework the SGSN and integrate libvlr, remove auth policies for now. It may be reintroduced later in a similar way as the MSC is supporting it. Change-Id: Iea267bfbd9e0f3d1ba00c6d8d8f308b24e8ec6d4 --- M debian/osmo-sgsn.install D doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg M doc/manuals/chapters/configuration.adoc M include/osmocom/sgsn/auth.h M include/osmocom/sgsn/sgsn.h M src/sgsn/sgsn.c M src/sgsn/sgsn_auth.c M src/sgsn/sgsn_vty.c M tests/Makefile.am D tests/osmo-sgsn-accept-all.cfg M tests/osmo-sgsn_test-nodes.vty M tests/sgsn/sgsn_test.c M tests/sgsn/sgsn_test.ok M tests/vty_test_runner.py 14 files changed, 30 insertions(+), 422 deletions(-) Approvals: Jenkins Builder: Verified pespin: Looks good to me, approved diff --git a/debian/osmo-sgsn.install b/debian/osmo-sgsn.install index b9a46ab..91ef8e6 100644 --- a/debian/osmo-sgsn.install +++ b/debian/osmo-sgsn.install @@ -2,4 +2,3 @@ lib/systemd/system/osmo-sgsn.service usr/bin/osmo-sgsn usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn.cfg usr/share/doc/osmo-sgsn/examples -usr/share/doc/osmo-sgsn/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg usr/share/doc/osmo-sgsn/examples diff --git a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg b/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg deleted file mode 100644 index 9bc1520..0000000 --- a/doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg +++ /dev/null @@ -1,38 +0,0 @@ -! -! Osmocom SGSN configuration -! -! -log stderr - logging color 1 - logging print category-hex 0 - logging print category 1 - logging timestamp 0 - logging print file basename last - logging print level 1 - -line vty - no login -! -sgsn - gtp state-dir /var/lib/osmocom/osmo-sgsn - gtp local-ip 127.0.0.1 - ggsn 0 remote-ip 127.0.0.2 - ggsn 0 gtp-version 1 - ggsn 0 echo-interval 60 - authentication optional - auth-policy accept-all -! -ns - timer tns-block 3 - timer tns-block-retries 3 - timer tns-reset 3 - timer tns-reset-retries 3 - timer tns-test 30 - timer tns-alive 3 - timer tns-alive-retries 10 - bind udp local - listen 127.0.0.1 23000 - accept-ipaccess -! -bssgp -! diff --git a/doc/manuals/chapters/configuration.adoc b/doc/manuals/chapters/configuration.adoc index d6ddcd3..14b1b36 100644 --- a/doc/manuals/chapters/configuration.adoc +++ b/doc/manuals/chapters/configuration.adoc @@ -127,30 +127,14 @@ rejected. The possible options range from accepting just all subscribers without further checking, to a fine grained access-control, handled by an external HLR. -accept-all:: All subscribers that attempt to attach to the GPRS network are -accepted without further checking. This option is intended to be used for -testing in a controlled environment only. A wide-open network may attract -subscribers from foreign networks and disrupt their service. It is highly -recommended to pick one of the options below. +accept-all:: Deprecated. remote:: This option allows to connect OsmoSGSN to an external HLR via the GSUP protocol. This will be the preferred option in larger networks. -acl-only:: If no external HLR is available, the network operator has the -option to control the access using an access control list. The access control -list contains the IMSI numbers of the allowed subscribers. This method offers -fine grained access control and is ideal for small networks and lab test -environments. +acl-only:: Deprecated. -closed:: This policy mode softens the strict *acl-only* only mode by also -implicitly accepting home network subscribers. The decision is made by the MCC -and MNC part of the IMSI number. The combination of MCC and MNC fully identifies -a subscribers home network, also known as a Home Network Identity (HNI, i.e. -MCC and MNC found at the start of the IMSI, e.g. MCC 901 and MNC 700 with -IMSI 901700000003080). - -NOTE: The policy mode *closed* must not be confused with the equally named -policy that is defined for osmo-nitb! +closed:: Deprecated. .Example: Assign or change authorization policy @@ -158,39 +142,17 @@ OsmoSGSN> enable OsmoSGSN# configure terminal OsmoSGSN(config)# sgsn -OsmoSGSN(config-sgsn)# auth-policy acl-only <1> +OsmoSGSN(config-sgsn)# auth-policy remote <1> OsmoSGSN(config-sgsn)# write <2> Configuration saved to sgsn.cfg OsmoSGSN(config-sgsn)# end OsmoSGSN# disable OsmoSGSN> ---- -<1> 'acl-only' is selected as authorization policy +<1> 'remote' is selected as authorization policy <2> Saves current changes to cofiguration to make this policy persistent -.Example: Access control list ----- -sgsn - auth-policy acl-only <1> - imsi-acl add 001010000000003 - imsi-acl add 001010000000002 - imsi-acl add 001010000000001 - imsi-acl add 901700000000068 <2> ----- -<1> Set the authorization policy -<2> Add as many subscribers as required - -=== Subscriber Configuration - -As opposed to OsmoNITB, OsmoSGSN does not feature a built-in HLR. - -It can thus operate only in the following two modes: - -. Accessing an external HLR (or HLR gateway) via the GSUP protocol -. Accepting subscribers based on internal ACL (access control list), - see also <<auth-pol>> - ==== Accessing an external HLR via GSUP The non-standard GSUP protocol was created to provide OsmoSGSN with @@ -214,14 +176,9 @@ ---- OsmoSGSN(config-sgsn)# gsup remote-ip 2.3.4.5 <1> OsmoSGSN(config-sgsn)# gsup remote-port 10000 <2> -OsmoSGSN(config-sgsn)# gsup oap-k 000102030405060708090a0b0c0d0e0f <3> -OsmoSGSN(config-sgsn)# gsup oap-opc 101112131415161718191a1b1c1d1e1f <4> ---- <1> Configure the IP address of the (remote) HLR or HLR-GW <2> Configure the TCP port of the (remote) HLR or HLR-GW -<3> Specify the OAP shared key -<4> Specify the OAP shared OPC - === CDR configuration diff --git a/include/osmocom/sgsn/auth.h b/include/osmocom/sgsn/auth.h index a46fb16..fbb0555 100644 --- a/include/osmocom/sgsn/auth.h +++ b/include/osmocom/sgsn/auth.h @@ -19,21 +19,9 @@ extern const struct value_string *sgsn_auth_state_names; -void sgsn_auth_init(struct sgsn_instance *sgsn); /* Request authorization */ enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mm); int sgsn_auth_request(struct sgsn_mm_ctx *mm); void sgsn_auth_update(struct sgsn_mm_ctx *mm); struct gsm_auth_tuple *sgsn_auth_get_tuple(struct sgsn_mm_ctx *mmctx, unsigned key_seq); - -/* - * Authorization/ACL handling - */ -struct imsi_acl_entry { - struct llist_head list; - char imsi[OSMO_IMSI_BUF_SIZE]; -}; -struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg); -int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg); -int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg); diff --git a/include/osmocom/sgsn/sgsn.h b/include/osmocom/sgsn/sgsn.h index 8524dd7..d9be0ea 100644 --- a/include/osmocom/sgsn/sgsn.h +++ b/include/osmocom/sgsn/sgsn.h @@ -85,7 +85,6 @@ enum sgsn_auth_policy auth_policy; uint8_t gea_encryption_mask; uint8_t uea_encryption_mask; - struct llist_head imsi_acl; struct sockaddr_in gsup_server_addr; int gsup_server_port; diff --git a/src/sgsn/sgsn.c b/src/sgsn/sgsn.c index fe52e6c..a163f4f 100644 --- a/src/sgsn/sgsn.c +++ b/src/sgsn/sgsn.c @@ -187,7 +187,7 @@ talloc_set_destructor(inst, sgsn_instance_talloc_destructor); inst->cfg.gtp_statedir = talloc_strdup(inst, "./"); - inst->cfg.auth_policy = SGSN_AUTH_POLICY_CLOSED; + inst->cfg.auth_policy = SGSN_AUTH_POLICY_REMOTE; inst->cfg.gea_encryption_mask = (1 << GPRS_ALGO_GEA0); /* no encryption */ inst->cfg.uea_encryption_mask = (1 << OSMO_UTRAN_UEA2) | (1 << OSMO_UTRAN_UEA1); inst->cfg.require_authentication = true; /* only applies if auth_policy is REMOTE */ @@ -215,7 +215,6 @@ osmo_timer_setup(&inst->llme_timer, sgsn_llme_check_cb, NULL); osmo_timer_schedule(&inst->llme_timer, GPRS_LLME_CHECK_TICK, 0); /* These are mostly setting up stuff not related to VTY cfg, so they can be set up here: */ - sgsn_auth_init(inst); sgsn_cdr_init(inst); sgsn_ra_init(inst); return inst; diff --git a/src/sgsn/sgsn_auth.c b/src/sgsn/sgsn_auth.c index 2f5bc8c..682c429 100644 --- a/src/sgsn/sgsn_auth.c +++ b/src/sgsn/sgsn_auth.c @@ -38,108 +38,21 @@ const struct value_string *sgsn_auth_state_names = auth_state_names; -void sgsn_auth_init(struct sgsn_instance *sgsn) -{ - INIT_LLIST_HEAD(&sgsn->cfg.imsi_acl); -} - -struct imsi_acl_entry *sgsn_acl_lookup(const char *imsi, const struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - llist_for_each_entry(acl, &cfg->imsi_acl, list) { - if (!strcmp(imsi, acl->imsi)) - return acl; - } - return NULL; -} - -int sgsn_acl_add(const char *imsi, struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - - if (sgsn_acl_lookup(imsi, cfg)) - return -EEXIST; - - acl = talloc_zero(NULL, struct imsi_acl_entry); - if (!acl) - return -ENOMEM; - osmo_strlcpy(acl->imsi, imsi, sizeof(acl->imsi)); - - llist_add(&acl->list, &cfg->imsi_acl); - - return 0; -} - -int sgsn_acl_del(const char *imsi, struct sgsn_config *cfg) -{ - struct imsi_acl_entry *acl; - - acl = sgsn_acl_lookup(imsi, cfg); - if (!acl) - return -ENODEV; - - llist_del(&acl->list); - talloc_free(acl); - - return 0; -} - enum sgsn_auth_state sgsn_auth_state(struct sgsn_mm_ctx *mmctx) { - char mccmnc[16]; - int check_net = 0; - int check_acl = 0; - OSMO_ASSERT(mmctx); + if (!mmctx->subscr) + return mmctx->auth_state; - switch (sgsn->cfg.auth_policy) { - case SGSN_AUTH_POLICY_OPEN: - return SGSN_AUTH_ACCEPTED; + if (mmctx->subscr->flags & GPRS_SUBSCRIBER_UPDATE_PENDING_MASK) + return mmctx->auth_state; - case SGSN_AUTH_POLICY_CLOSED: - check_net = 1; - check_acl = 1; - break; + if (sgsn->cfg.require_authentication && + (!sgsn_mm_ctx_is_authenticated(mmctx) || + mmctx->subscr->sgsn_data->auth_triplets_updated)) + return SGSN_AUTH_AUTHENTICATE; - case SGSN_AUTH_POLICY_ACL_ONLY: - check_acl = 1; - break; - - case SGSN_AUTH_POLICY_REMOTE: - if (!mmctx->subscr) - return mmctx->auth_state; - - if (mmctx->subscr->flags & GPRS_SUBSCRIBER_UPDATE_PENDING_MASK) - return mmctx->auth_state; - - if (sgsn->cfg.require_authentication && - (!sgsn_mm_ctx_is_authenticated(mmctx) || - mmctx->subscr->sgsn_data->auth_triplets_updated)) - return SGSN_AUTH_AUTHENTICATE; - - if (mmctx->subscr->authorized) - return SGSN_AUTH_ACCEPTED; - - return SGSN_AUTH_REJECTED; - } - - if (!strlen(mmctx->imsi)) { - LOGMMCTXP(LOGL_NOTICE, mmctx, - "Missing IMSI, authorization state not known\n"); - return SGSN_AUTH_UNKNOWN; - } - - if (check_net) { - /* We simply assume that the IMSI exists, as long as it is part - * of 'our' network */ - snprintf(mccmnc, sizeof(mccmnc), "%s%s", - osmo_mcc_name(mmctx->ra.lac.plmn.mcc), - osmo_mnc_name(mmctx->ra.lac.plmn.mnc, mmctx->ra.lac.plmn.mnc_3_digits)); - if (strncmp(mccmnc, mmctx->imsi, mmctx->ra.lac.plmn.mnc_3_digits ? 6 : 5) == 0) - return SGSN_AUTH_ACCEPTED; - } - - if (check_acl && sgsn_acl_lookup(mmctx->imsi, &sgsn->cfg)) + if (mmctx->subscr->authorized) return SGSN_AUTH_ACCEPTED; return SGSN_AUTH_REJECTED; diff --git a/src/sgsn/sgsn_vty.c b/src/sgsn/sgsn_vty.c index 3d8a3bd..b7df7f8 100644 --- a/src/sgsn/sgsn_vty.c +++ b/src/sgsn/sgsn_vty.c @@ -249,7 +249,6 @@ static int config_write_sgsn(struct vty *vty) { struct sgsn_ggsn_ctx *gctx; - struct imsi_acl_entry *acl; struct apn_ctx *actx; struct ares_addr_node *server; struct sgsn_mme_ctx *mme; @@ -329,9 +328,6 @@ osmo_hexdump_nospc(g_cfg->oap.secret_opc, sizeof(g_cfg->oap.secret_opc)), VTY_NEWLINE); - llist_for_each_entry(acl, &g_cfg->imsi_acl, list) - vty_out(vty, " imsi-acl add %s%s", acl->imsi, VTY_NEWLINE); - if (llist_empty(&sgsn->apn_list)) vty_out(vty, " ! apn * ggsn 0%s", VTY_NEWLINE); llist_for_each_entry(actx, &sgsn->apn_list, list) { @@ -781,44 +777,15 @@ return CMD_SUCCESS; } - -DEFUN(imsi_acl, cfg_imsi_acl_cmd, +DEFUN_DEPRECATED(imsi_acl, cfg_imsi_acl_cmd, "imsi-acl (add|del) IMSI", "Access Control List of foreign IMSIs\n" "Add IMSI to ACL\n" "Remove IMSI from ACL\n" "IMSI of subscriber\n") { - char imsi_sanitized[GSM23003_IMSI_MAX_DIGITS + 1]; - const char *op = argv[0]; - const char *imsi = imsi_sanitized; - size_t len = strnlen(argv[1], GSM23003_IMSI_MAX_DIGITS + 1); - int rc; - - memset(imsi_sanitized, '0', GSM23003_IMSI_MAX_DIGITS); - imsi_sanitized[GSM23003_IMSI_MAX_DIGITS] = '\0'; - - /* Sanitize IMSI */ - if (len > GSM23003_IMSI_MAX_DIGITS) { - vty_out(vty, "%% IMSI (%s) too long (max %u digits) -- ignored!%s", - argv[1], GSM23003_IMSI_MAX_DIGITS, VTY_NEWLINE); - return CMD_WARNING; - } - - osmo_strlcpy(imsi_sanitized + GSM23003_IMSI_MAX_DIGITS - len, argv[1], - sizeof(imsi_sanitized) - (GSM23003_IMSI_MAX_DIGITS - len)); - - if (!strcmp(op, "add")) - rc = sgsn_acl_add(imsi, g_cfg); - else - rc = sgsn_acl_del(imsi, g_cfg); - - if (rc < 0) { - vty_out(vty, "%% unable to %s ACL%s", op, VTY_NEWLINE); - return CMD_WARNING; - } - - return CMD_SUCCESS; + vty_out(vty, "ACL based on IMSI has been deprecated.%s", VTY_NEWLINE); + return CMD_WARNING; } DEFUN_DEPRECATED(cfg_encrypt, cfg_encrypt_cmd, @@ -956,11 +923,18 @@ " permitted to register to the network.\n" "Accept all IMSIs (DANGEROUS)\n" "Accept only home network subscribers or those in the ACL\n" - "Accept only subscribers in the ACL\n" + "Accept only subscribers in the ACL. Deprecated.\n" "Use remote subscription data only (HLR)\n") { int val = get_string_value(sgsn_auth_pol_strs, argv[0]); OSMO_ASSERT(val >= SGSN_AUTH_POLICY_OPEN && val <= SGSN_AUTH_POLICY_REMOTE); + + if (val == SGSN_AUTH_POLICY_ACL_ONLY) { + vty_out(vty, "acl-only authentication is deprecated and not implemented anymore.%s", + VTY_NEWLINE); + return CMD_WARNING; + } + g_cfg->auth_policy = val; g_cfg->require_update_location = (val == SGSN_AUTH_POLICY_REMOTE); diff --git a/tests/Makefile.am b/tests/Makefile.am index 9d429d7..c907ab3 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -33,7 +33,6 @@ $(TESTSUITE) \ vty_test_runner.py \ ctrl_test_runner.py \ - osmo-sgsn-accept-all.cfg \ osmo-sgsn.cfg \ osmo-sgsn_test-nodes.vty \ $(NULL) diff --git a/tests/osmo-sgsn-accept-all.cfg b/tests/osmo-sgsn-accept-all.cfg deleted file mode 100644 index 46a5d61..0000000 --- a/tests/osmo-sgsn-accept-all.cfg +++ /dev/null @@ -1,38 +0,0 @@ -# Same as doc/examples/osmo-sgsn/osmo-sgsn-accept-all.cfg, but without 'gtp state-dir' -! -! Osmocom SGSN configuration -! -! -log stderr - logging color 1 - logging print category-hex 0 - logging print category 1 - logging timestamp 0 - logging print file basename last - logging print level 1 - -line vty - no login -! -sgsn - gtp local-ip 127.0.0.1 - ggsn 0 remote-ip 127.0.0.2 - ggsn 0 gtp-version 1 - ggsn 0 echo-interval 60 - authentication optional - auth-policy accept-all -! -ns - timer tns-block 3 - timer tns-block-retries 3 - timer tns-reset 3 - timer tns-reset-retries 3 - timer tns-test 30 - timer tns-alive 3 - timer tns-alive-retries 10 - bind udp local - listen 127.0.0.1 23000 - accept-ipaccess -! -bssgp -! diff --git a/tests/osmo-sgsn_test-nodes.vty b/tests/osmo-sgsn_test-nodes.vty index 031ccfa..1bc28ba 100644 --- a/tests/osmo-sgsn_test-nodes.vty +++ b/tests/osmo-sgsn_test-nodes.vty @@ -33,7 +33,6 @@ ggsn <0-255> gtp-version (0|1) ggsn <0-255> echo-interval <1-36000> ggsn <0-255> no echo-interval - imsi-acl (add|del) IMSI auth-policy (accept-all|closed|acl-only|remote) authentication (optional|required) encryption gea <0-4> [<0-4>] [<0-4>] [<0-4>] [<0-4>] diff --git a/tests/sgsn/sgsn_test.c b/tests/sgsn/sgsn_test.c index 6dcda84..7a53716 100644 --- a/tests/sgsn/sgsn_test.c +++ b/tests/sgsn/sgsn_test.c @@ -65,16 +65,6 @@ TALLOC_FREE(sgsn); } -static uint32_t get_new_ptmsi(const struct gprs_gb_parse_context *parse_ctx) -{ - uint32_t new_ptmsi = GSM_RESERVED_TMSI; - - if (parse_ctx->new_ptmsi_enc) - gprs_parse_tmsi(parse_ctx->new_ptmsi_enc, &new_ptmsi); - - return new_ptmsi; -} - /* override */ int bssgp_tx_dl_ud(struct msgb *msg, uint16_t pdu_lifetime, struct bssgp_dl_ud_par *dup) @@ -1232,118 +1222,6 @@ cleanup_test(); } -/* - * Test cancellation of attached MM contexts - */ -static void test_gmm_cancel(void) -{ - struct osmo_routing_area_id raid = { 0, }; - struct sgsn_mm_ctx *ctx = NULL; - struct sgsn_mm_ctx *ictx; - uint32_t ptmsi1; - uint32_t foreign_tlli; - uint32_t local_tlli = 0; - struct gprs_llc_lle *lle; - - sgsn = sgsn_instance_alloc(tall_sgsn_ctx); - sgsn->cfg.gea_encryption_mask = 0x1; - const enum sgsn_auth_policy saved_auth_policy = sgsn->cfg.auth_policy; - - /* DTAP - Attach Request */ - /* The P-TMSI is not known by the SGSN */ - static const unsigned char attach_req[] = { - 0x08, 0x01, 0x02, 0xf5, 0xe0, 0x21, 0x08, 0x02, 0x05, 0xf4, - 0xfb, 0xc5, 0x46, 0x79, 0x11, 0x22, 0x33, 0x40, 0x50, 0x60, - 0x19, 0x18, 0xb3, 0x43, 0x2b, 0x25, 0x96, 0x62, 0x00, 0x60, - 0x80, 0x9a, 0xc2, 0xc6, 0x62, 0x00, 0x60, 0x80, 0xba, 0xc8, - 0xc6, 0x62, 0x00, 0x60, 0x80, 0x00 - }; - - /* DTAP - Identity Response IMEI */ - static const unsigned char ident_resp_imei[] = { - 0x08, 0x16, 0x08, 0x9a, 0x78, 0x56, 0x34, 0x12, 0x90, 0x78, - 0x56 - }; - - /* DTAP - Identity Response IMSI */ - static const unsigned char ident_resp_imsi[] = { - 0x08, 0x16, 0x08, 0x19, 0x32, 0x54, 0x76, 0x98, 0x10, 0x32, - 0x54 - }; - - /* DTAP - Attach Complete */ - static const unsigned char attach_compl[] = { - 0x08, 0x03 - }; - - printf("Testing cancellation\n"); - sgsn->cfg.auth_policy = SGSN_AUTH_POLICY_OPEN; - - foreign_tlli = gprs_tmsi2tlli(0xc0000023, TLLI_FOREIGN); - - /* Create a LLE/LLME */ - OSMO_ASSERT(count(gprs_llme_list()) == 0); - lle = gprs_lle_get_or_create(foreign_tlli, 3); - OSMO_ASSERT(count(gprs_llme_list()) == 1); - - /* inject the attach request */ - send_0408_message(lle->llme, foreign_tlli, &raid, - attach_req, ARRAY_SIZE(attach_req)); - - ctx = sgsn_mm_ctx_by_tlli(foreign_tlli, &raid); - OSMO_ASSERT(ctx != NULL); - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT); - - /* we expect an identity request (IMEI) */ - OSMO_ASSERT(sgsn_tx_counter == 1); - - /* inject the identity response (IMEI) */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - ident_resp_imei, ARRAY_SIZE(ident_resp_imei)); - - /* we expect an identity request (IMSI) */ - OSMO_ASSERT(sgsn_tx_counter == 1); - - /* inject the identity response (IMSI) */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - ident_resp_imsi, ARRAY_SIZE(ident_resp_imsi)); - - /* check that the MM context has not been removed due to a failed - * authorization */ - OSMO_ASSERT(ctx == sgsn_mm_ctx_by_tlli(foreign_tlli, &raid)); - - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_COMMON_PROC_INIT); - - /* we expect an attach accept/reject */ - OSMO_ASSERT(sgsn_tx_counter == 1); - ptmsi1 = get_new_ptmsi(&last_dl_parse_ctx); - OSMO_ASSERT(ptmsi1 != GSM_RESERVED_TMSI); - - /* this has been randomly assigned by the SGSN */ - local_tlli = gprs_tmsi2tlli(ptmsi1, TLLI_LOCAL); - - /* inject the attach complete */ - send_0408_message(ctx->gb.llme, foreign_tlli, &raid, - attach_compl, ARRAY_SIZE(attach_compl)); - - OSMO_ASSERT(ctx->gmm_fsm->state == ST_GMM_REGISTERED_NORMAL); - - /* we don't expect a response */ - OSMO_ASSERT(sgsn_tx_counter == 0); - - /* cancel */ - gsm0408_gprs_access_cancelled(ctx, 0); - - /* verify that things are gone */ - OSMO_ASSERT(count(gprs_llme_list()) == 0); - ictx = sgsn_mm_ctx_by_tlli(local_tlli, &raid); - OSMO_ASSERT(!ictx); - - sgsn->cfg.auth_policy = saved_auth_policy; - - cleanup_test(); -} - static void test_apn_matching(void) { struct apn_ctx *actx, *actxs[9]; @@ -1670,7 +1548,6 @@ test_gmm_detach_accept_unexpected(); test_gmm_status_no_mmctx(); test_gmm_reject(); - test_gmm_cancel(); test_apn_matching(); test_ggsn_selection(); test_pdp_status_has_active_nsapis(); diff --git a/tests/sgsn/sgsn_test.ok b/tests/sgsn/sgsn_test.ok index 35b1d7b..20c9a73 100644 --- a/tests/sgsn/sgsn_test.ok +++ b/tests/sgsn/sgsn_test.ok @@ -21,7 +21,6 @@ - Routing Area Update Request (valid) - Routing Area Update Request (invalid type) - Routing Area Update Request (invalid CAP length) -Testing cancellation Testing APN matching Testing GGSN selection Testing pdp_status_has_active_nsapis diff --git a/tests/vty_test_runner.py b/tests/vty_test_runner.py index aaa76ed..1b97f35 100755 --- a/tests/vty_test_runner.py +++ b/tests/vty_test_runner.py @@ -70,7 +70,7 @@ class TestVTYSGSN(TestVTYBase): def vty_command(self): - return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn-accept-all.cfg"] + return ["./src/sgsn/osmo-sgsn", "-c", "tests/osmo-sgsn.cfg"] def vty_app(self): return (4245, "./src/sgsn/osmo-sgsn", "OsmoSGSN", "sgsn") @@ -98,7 +98,9 @@ self.assertTrue(self.vty.verify('show bssgp stats', [''])) self.assertTrue(self.vty.verify('show bssgp nsei 123', [''])) self.assertTrue(self.vty.verify('show bssgp nsei 123 stats', [''])) - self.assertTrue(self.vty.verify('show sgsn', [' GSN: signalling 127.0.0.1, user traffic 127.0.0.1'])) + self.assertTrue(self.vty.verify('show sgsn', [ + ' Remote authorization: not connected to 127.0.0.1:4222 via GSUP', + ' GSN: signalling 127.0.0.1, user traffic 127.0.0.1'])) self.assertTrue(self.vty.verify('show mm-context all', [''])) self.assertTrue(self.vty.verify('show mm-context imsi 000001234567', ['No MM context for IMSI 000001234567'])) self.assertTrue(self.vty.verify('show pdp-context all', [''])) @@ -109,27 +111,6 @@ res = self.vty.command("show llc") self.assertTrue(res.find('State of LLC Entities') >= 0) - def testVtyAuth(self): - self.vty.enable() - self.assertTrue(self.vty.verify('configure terminal', [''])) - self.assertEqual(self.vty.node(), 'config') - self.assertTrue(self.vty.verify('sgsn', [''])) - self.assertEqual(self.vty.node(), 'config-sgsn') - self.assertTrue(self.vty.verify('auth-policy accept-all', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy accept-all') > 0) - self.assertTrue(self.vty.verify('auth-policy acl-only', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy acl-only') > 0) - self.assertTrue(self.vty.verify('auth-policy closed', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy closed') > 0) - self.assertTrue(self.vty.verify('gsup remote-ip 127.0.0.4', [''])) - self.assertTrue(self.vty.verify('gsup remote-port 2222', [''])) - self.assertTrue(self.vty.verify('auth-policy remote', [''])) - res = self.vty.command("show running-config") - self.assertTrue(res.find('auth-policy remote') > 0) - def testVtySubscriber(self): self.vty.enable() res = self.vty.command('show subscriber cache') -- To view, visit https://gerrit.osmocom.org/c/osmo-sgsn/+/43798?usp=email To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings?usp=email Gerrit-MessageType: merged Gerrit-Project: osmo-sgsn Gerrit-Branch: master Gerrit-Change-Id: Iea267bfbd9e0f3d1ba00c6d8d8f308b24e8ec6d4 Gerrit-Change-Number: 43798 Gerrit-PatchSet: 3 Gerrit-Owner: lynxis lazus <lynxis@fe80.eu> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: lynxis lazus <lynxis@fe80.eu> Gerrit-Reviewer: pespin <pespin@sysmocom.de>