open5gs requires the tun device to be pre-created and pre-configured
before using it. A ticket was opened in order to allow upfd itself
configuring it in 
To expand the test capacities we would like to introduce
Android UEs as new modems. Currently the following tests
- iPerf3 DL/UL
- RRC Mobile MT Ping
In the following is a small description.
- Android UE
- Rooted (Ping, iPerf, RRC Idle MT Ping)
- Qualcomm baseband with working diag_mdlog (RRC Idle MT Ping)
- OGT Slave Unit
- Android SDK Platform-Tools
- Pycrate (https://github.com/P1sec/pycrate)
clone https://github.com/bedrankara/scat/ & install dependencies
checkout branch ogt
symlink scat (ln -s ~/scat/scat.py /usr/local/bin/scat)
The Android UEs are connected to the OGT Units via USB. We
activate tethering and set up a SSH server (with Dropbear).
We chose tethering over WiFi to have a more stable route
for the ssh connection. We forward incoming connections to
the OGT unit hosting the Android UE(s) on specific ports
to the UEs via iptables. This enables OGT to issue commands
directly to the UEs. In case of local execution we use ADB
to issue commands to the AndroidUE. The set up was tested
with 5 Android UEs connected in parallel but it should be
scalable to the number of available IPs in the respective
subnet. Furthermore, we need to cross compile Dropbear
and iPerf3 to use them on the UEs. These tools have to be
added to the $PATH variable of the UEs.
Examplary set up:
In this example we have two separate OGT units (master
and slave) and two Android UEs that are connected to the
slave unit. An illustration may be found here: https://ibb.co/6BXSP2C
On UE 1:
ip address add 192.168.42.130/24 dev rndis0
ip route add 192.168.42.0/24 dev rndis0 table local_network
dropbearmulti dropbear -F -E -p 130 -R -T /data/local/tmp/authorized_keys -U 0 -G 0 -N root -A
On UE 2:
ip address add 192.168.42.131/24 dev rndis0
ip route add 192.168.42.0/24 dev rndis0 table local_network
dropbearmulti dropbear -F -E -p 131 -R -T /data/local/tmp/authorized_keys -U 0 -G 0 -N root -A
On OGT slave unit:
sudo ip link add name ogt type bridge
sudo ip l set eth0 master ogt
sudo ip l set enp0s20f0u1 master ogt
sudo ip l set enp0s20f0u2 master ogt
sudo ip a a 192.168.42.1/24 dev ogt
sudo ip link set ogt up
Now we have to manually connect to every UE from OGT Master
to set up SSH keys and verify that the setup works.
ssh -p [UE-PORT] root@[OGT SLAVE UNIT's IP]
Finally, to finish the setup procedure create the
remote_run_dir for Android UEs on the slave unit like
chown jenkins /osmo-gsm-tester-androidue
Example for modem in resource.conf:
- label: mi5g
features: ['4g', 'dl_qam256', 'qc_diag']
Example for default-suites.conf:
The remotely run script is moved into a new subdir called "external",
where external utils to be used by osmo-gsm-tester (exernal to its own
process) are placed.
It needs to be in another directory because python files in obj/ are
loaded at startup of osmo-gsm-tester to dynamically load schemas.
srsENB currently creates 1 zmq stream (1 tx, 1 rx) for each cell (2 if
MIMO is enabled). Each cell transceives on a given EARFCN (and several
cells can transmit on same EARFCN).
However, for handover test purposes, we want to join all cells operating
on the same EARFCN to transceive on the same ZMQ conn, so that an srsUE
can interact with them at the same time (same as if the medium was shared).
Furthermore, we want to set different gains on each of those paths
before merging them in order to emulate RF conditions like handover.
In order to do so, a new element called the Broker is introduced, which
is placed in between ENBs and UEs ZMQ conenctions, multiplexing the
connections on the ENB side towards the UE side.
A separate process for the broker is run remotely (ENB run host) which
listens on a ctrl socket for commands. An internal Broker class is used
in osmo-gsm-tester to interact with the remote script, for instance to
configure the ports, start and stop the remote process, send commands to
On each ENB, when the rfemu "gnuradio_zmq" rfemu implementation is selected
in configuration, it will configure its zmq connections and the UE ones to
go over the Broker.
As a result, that means the UE zmq port configuration is expected to be
different than when no broker is in used, since there's the multiplexing
per EARFCN in between.
In this commit, only 1 ENB is supported, but multi-enb support is
planned in the future.
The handover test passes in the docker setup with this config:
OSMO_GSM_TESTER_OPTS="-T -l dbg -s 4g:srsue-rftype@zmq+srsenb-rftype@zmq+" \
"mod-enb-meas-enable -t =handover.py"
and in resources.conf (or scenario), added:
Note that since the broker is used, there's not need for mod-srsue-ncarriers@2
since the broker is joining the 2 enb cells into 1 stream on the UE side.
Use the ifup script to set up the netns + configure the tun device
created by lteue. Use it also as a hook to know when the UE is attached.
Since tun setup is done by arch-optimized lte-avx(2) binaries, we also
need to give capabilitites to them (instead of allowing inheritance of
caps in general in the setcap script).
* A new abstract generic base class EPC is created
* srsEPC and AmarisoftEPC inherit from that class
* options are loaded from defaults.conf in cascade. First generic "epc",
afterwards the specific enb type.
* A new scenario is added to select the EPC type to use. srsEPC is the
default unless stated by an scenario.
* AmarisoftEPC delegates setup of the tun IP address to an "ifup"
script. As a result, since we run without root permissions (ony with
CAP_NET_ADMIN), the ifup script itself is unablet o set the IP
address. To solve this, we introduce a new osmo-gsm-tester helper
script which must be installed in the slave node which can be called
through sudo to increase privileges to do so.
With this commit, I can already get srsUE<->amarisoftENB<->amarisoftEPC
to pass ping and iperf3 4g tests.
We used to do that once after ofono startup for all iface
(modem-netns-setup.py), but then if a modem crashes the interface is
re-created on the default netns, and tests fail until manual re-run of
This way now we always make sure the iface is moved to the expected
netns before it is used.
NetNSProcess are run in the following process tree:
osmo-gsm-tester -> sudo -> bash (osmo-gsm-tester_netns_exec.sh) ->
Lots of osmo-gsm-tester_netns_exec.sh scripts with tcpdump child process
were spotted in prod setup of osmo-gsm-tester. Apparently that happens
because sometimes tcpdump doesn't get killed in time with SIGTERM and
SIGINT, and as a result SIGKILL is sent by osmo-gsm-tester as usual
termination procedure. When SIGKILL is sent, the parent sudo process is
instantly killed without possibility to forward the signal to its
children, leaving the bash script and tcpdump alive.
In order to fix it, catch SIGKILL for this process class and send
instead SIGUSR1. Then, modify the script under sudo to handle SIGUSR1 as
if it was a SIGKILL towards its children to make sure child process in
the netns terminates.
Since the modem iface and the GGSN iface are on the same host/netns,
it's really difficult to conveniently test data plane without getting
routing loops. As a result, either GGSN or modem iface must be moved to
a different namespace. The decision after a few discussions was finally
to move modem interfaces to a different netns.
* ofono is patched to avoid removing modem if it detects
through udev that its net iface was removed (due to for instance, net
iface being moved to another netns and thus not being reachable anymore
by systemd-udev process running in root netns).
* After ofono is started (and successfully configured all the modems and
detected its net ifaces through syfs/udev), script "modem-netns-setup.py
start" which creates a netns for each modem, naming it after its usb
path ID. net ifaces for that modem are moved into its netns.
* Modem is configured to use 802-3 data format, and as a result the net
iface is configured through DHCP (DHCP req only replied AFTER pdp ctx is
* Since osmo-gsm-tester knowns the modem USB path ID (available in
resources.conf), it can run required steps (ifup, DHCP) to configure the
interface. The interface name is provided by ofono to osmo-gsm-tester.
* As a result, any process willing to transmit data through the modem
must be in the modem netns.
This scripts were already being used by osmo-gsm-tester for a while, but
were not avaialable in this repository. Let's put them here to easy find
them and have all this kind of helper scripts together with code using
Used to quickly set modem net interfaces into their own net namespace
(named after modem USB ID path).
The idea is that since osmo-gsm-tester ofono modem.py knowns the USB
path from a modem (path yml attr), it can infer the netns from it and
run a ping process inside it.
This is a small script written by Alexander Couzens that is useful to
list modems and its properties in a quick and easy way in