ttcn3
/
osmo-ttcn3-hacks
mirror of https://gerrit.osmocom.org/osmo-ttcn3-hacks
10
0
Fork 1
Code Issues Releases Wiki Activity

sgsn: Add test to verify duplicate DeactPDPCtx crashing osmo-sgsn 

osmo-sgsn sends 2 DeletePdpCtxReq on gtp, Confirmation received on first
one frees cbp associatd to pdp and the second one accesses the already
freed cbp.

Related: OS#3956
Change-Id: Ie1cc9fdf91b18b0b7fb3d5fb33b6dcf6f46a393f
This commit is contained in:
Pau Espin 2019-08-15 16:01:20 +02:00
parent 22d597ff94
commit 2a3302a0cd
2 changed files with 52 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
sgsn/SGSN_Tests.ttcn
View File

@ -1470,6 +1470,56 @@ testcase TC_attach_pdp_act_user_deact_mt() runs on test_CT {
vc_conn.done;
}
/* Test MS sending a duplicate Deact PDP Ctx (OS#3956). */
private function f_TC_attach_pdp_act_deact_dup(charstring id) runs on BSSGP_ConnHdlr {
var PdpActPars apars := valueof(t_PdpActPars(mp_ggsn_ip));
var Gtp1cUnitdata g_ud;
var integer i;
var OCT1 cause_regular_deact := '24'O;
/* first perform regular attach + PDP context act */
f_TC_attach(id);
f_pdp_ctx_act(apars);
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_REQ_MO(apars.tid, cause_regular_deact, false, omit), 0);
f_send_l3_gmm_llc(ts_SM_DEACT_PDP_REQ_MO(apars.tid, cause_regular_deact, false, omit), 0);
for (i := 0; i < 2; i := i+1) {
GTP.receive(tr_GTPC_MsgType(?, deletePDPContextRequest, apars.ggsn_tei_c)) -> value g_ud {
var integer seq_nr := oct2int(g_ud.gtpc.opt_part.sequenceNumber);
log("Received deletePDPContextResponse " & int2str(i) & ", seq_nr=" & int2str(seq_nr));
GTP.send(ts_GTPC_DeletePdpResp(g_ud.peer, seq_nr, apars.sgsn_tei_c, '7F'O));
}
}
alt {
[] BSSGP[0].receive(tr_SM_DEACT_PDP_ACCEPT_MT(apars.tid)) {
setverdict(pass);
}
[] as_xid(apars, 0);
}
/* Make sure second DeactPdpAccept is sent: */
timer T := 2.0;
T.start;
alt {
[] BSSGP[0].receive(tr_SM_DEACT_PDP_ACCEPT_MT(apars.tid)) {
setverdict(fail, "Second SM_DEACT_PDP_ACCEPT_MT received");
}
[] T.timeout {
setverdict(pass);
}
}
setverdict(pass);
}
testcase TC_attach_pdp_act_deact_dup() runs on test_CT {
var BSSGP_ConnHdlr vc_conn;
f_init();
vc_conn := f_start_handler(refers(f_TC_attach_pdp_act_deact_dup), testcasename(), g_gb, 46);
vc_conn.done;
}
/* ATTACH + ATTACH (2nd) */
private function f_TC_attach_forget_tlli_attach(charstring id) runs on BSSGP_ConnHdlr {
g_pars.t_guard := 5.0;
@ -2545,6 +2595,7 @@ control {
execute( TC_attach_pdp_act_ggsn_reject() );
execute( TC_attach_pdp_act_user_deact_mo() );
execute( TC_attach_pdp_act_user_deact_mt() );
execute( TC_attach_pdp_act_deact_dup() );
execute( TC_attach_second_attempt() );
execute( TC_attach_restart_ctr_echo() );
execute( TC_attach_restart_ctr_create() );

1
sgsn/expected-results.xml
View File

@ -47,6 +47,7 @@
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_ggsn_reject' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_user_deact_mo' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_user_deact_mt' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_pdp_act_deact_dup' time='MASKED'/>
<testcase classname='SGSN_Tests' name='TC_attach_second_attempt' time='MASKED'>
<failure type='fail-verdict'>Tguard timeout
SGSN_Tests.ttcn:MASKED SGSN_Tests control part