Thanks to Stefan Sperling, a critical bug was discovered in trxcon.
The problem was that length of LAPDm frames was not checked before
passing them to the libosmocoding API. So, if a received LAPDm
frame is shorter than expected (i.e. 23 bytes), then:
- in case of xCCH, there was a heap overflow (detected by ASAN),
so a short frame has been encoded together with some garbage
outside the primitive buffer...
- in case of FACCH, as the length != 23, a frame was recognised
as a speech frame, and also encoded together with some garbage.
Since the bug is fixed (OS#3415), some TTCN-3 BTS tests started
to fail, because most likely it was assumed that trxcon would
pad the frames automatically, but it doesn't and shouldn't.
Let's automatically pad LAPDm frames with 0x2b before sending.
Change-Id: I16cba4e4179456bebabf0638760af011a27fd333
Related: OS#3418
With this patch, I see all ttcn3-bsc-tests failing with
"Verdict: fail reason: VTY Timeout for prompt"
This reverts commit cb111b21ab.
Change-Id: I215d7ab5eee75cf6d3afaac760af64356c943140
Pass the CTRL_DETECT_CONNECTION_ESTABLISHMENT_RESULT parameter to
the TELNET port by default. This allows tests to make progress
into an error handling path if they are started while the osmo-*
program they want to connect on VTY is not running.
Observed with osmo-ggsn tests, where if the one test runs
into a VTY connection failure the subsequent test would get
stuck forever in a map() call on the VTY TELNET port.
Change-Id: I9acf7793d5d68aec6d087cff254a10d8b673dab1
Related: OS#3149
This test has been passing since osmo-bts commit
eee7247ebe0d0a54a54b53b739bdd434dfceb511, so expect
it to pass instead of fail.
Change-Id: I576f881fcb40c4fcbe6b6f767220111a0e9ffd3c
Related: OS#3173
The random length for that test could go out of bounds leading to a
Dynamic test case error when sending the message.
The limiting field here is the lengthIndicator of PDU_BSSAP which
includes the length of the PDU_BSSMAP mesageType, cellId as well as the
layer3 info IE and lenght indicator additionally to the l3info payload.
So maximum length for the payload can only be 240 bytes (if the cell ID
is encoded in the longest possible way as BSSMAP_FIELD_LAC_RNC_CI).
Change-Id: I7be33e261a11f03a80a6b770b6acf0a4be49b85b
This is the bts version of patch 637ef6c8
Again I picked a test that sometimes failed -
BTS_Tests.TC_sacch_info_mod - and ran it 20 times before and after this
commit. Before it failed roughly half the time with a DTE and after I
was not able to make it fail.
Change-Id: I96f02037283b79a93ef4d659b00a90ac519c0a75
It is legal that two connections use the same codec but negotiate
different dynamic payload types for both connections. Then the MGW is
expected to receive packets with one PT and send them with the other PT.
This is currently not done in osmo-mgw so the two tests that this commit
adds are expected to fail for now.
- add testcase TC_two_crcx_diff_pt_and_rtp
- add testcase TC_two_crcx_diff_pt_and_rtp_bidir
Change-Id: Ib4606dfc08764410ee9e450949361544adb07cd3
Related: OS#3384
At the moment we check the error counters of the RTP statistics in
the testcases. However, in most situations we will do the check to
make sure that no errors occurred (all counters == 0). Rather than
having a long tail of if statements in the testcases we should have
a function for this. This also makes it much easier in case we add
more error countes lateron.
- add and use function f_rtpem_stats_err_check()
Change-Id: I69e5f80b0765284ec99056ce62c315461967d2a1
Related: OS#3384
Because trxcon now requires frames of a minimum size some
BTS tests which send unpadded frames with a short payload
have started to fail.
Extend the payload size generated by f_TC_rll_ud_ind()
to make TC_rll_unit_data_ind_DCCH pass again.
Change-Id: Ibaa4124ebdec96623f48c38fac702e9bbd843869
Related: OS#3415
It seems mtc.stop() alone does not really solve the race conditions when
shutting down components. The error happens when messages are sent on
ports which are no longer connected since the receiving component has
terminated.
Some web search
http://www.ttcn-3.org/TTCN3UCAsia2007/Presentations/TTCN3%20UC%202007%20Concurrent%20TTCN.pdf
suggested that one should stop all components before
calling mtc.stop (slide 38). Slide 33 also mentions the difference
between .stop and .kill. Kill removes the port connections while stop
does not. And I think looking at the logs when the testcase teminates
(through mtc.stop or otherwise) it is internally calling kill on all the
components. So hopefully stopping all components and then stopping the mtc
will fix this nasty issue.
I verified locally that the situation improves between commits now when
running BSC_Tests.TC_paging_imsi_nochan_all 20 times in a loop and
otherwise generating load on the system. It reliably failed before this
patch and I wasn't able to get it to fail with it.
Change-Id: I398883492919ceabcf94b5cc2361c63ec772d9d5
Since trxcon now drops L2 frames of an incorrect length, some
BTS tests which send unpadded frames with a short payload
have started to fail.
Extend the payload size generated by f_TC_chan_act_encr()
to make these tests pass again:
TC_chan_act_a51
TC_chan_act_a52
TC_chan_act_a53
Found by: Vadim Yanitskiy
Related: OS#3415
Change-Id: I0f9a40503a4ed4fce10d9655f845ac49d33f4041
This test suite acts as an SCCP server on top of M3UA.
SCCP tests are run against the sccp_demo_user program which
can be found in libosmo-sccp/examples. This program must be
started in client mode: sccp_demo_user -c
The SCCP test suite should then work out of the box with
the provided SCCP_Tests.cfg file and this additional change
to sccp_demo_user default point codes:
https://gerrit.osmocom.org/#/c/libosmo-sccp/+/9652/
There is currently only one test, for the libosmo-sccp crash
reported as issue OS#2666. The implementation of this test
is currently using an ugly workaround due to shortcomings of
the M3UA Emulation layer (see source code comments). Whether
a better solution is feasible is still to be determined.
The test requires a patch to the SCCP Protocol Emulation which
has been submitted upstream: https://git.eclipse.org/r/#/c/124552/
Change-Id: I03f5e8b282a7396b45417495c88d8fb81b26cda8
Related: OS#2666
When an RTP packet is received, the payload type is not checked,
so we will not detect if the MGW emits packets with a wrong payload
type for some reason.
- Introduce a statistics counter that counts packets with wrong PT
- Update testcases so that they check for the statistics for wrong
PT count.
Change-Id: I83d4b04656a16ced624024245a2fcb7a0ad48a8a
Related: OS#3384
BSC_ConnectionHandler.ttcn:563 This helps TC_gsup_cancel which
previously encountered a Dynamic test case error: Using the value of an
optional field containing omit. The test still fails, but this time
because it "Received unexpected BSSAP instead of CM SERV REJ".
Change-Id: I9fedf2573487066b951804a328ba428d2189c4a4
Call mtc.stop after setverdict(fail), add reasons to most failures and
fail with verdict error for internal errors.
Change-Id: I9b618235939fa41160b9be6677b121963d3ec857
This will prevent subsequent failures from overwriting the verdict so we
can easily see the root cause of the test failure.
Using testcase.stop instead for errors internal to our test
infrastructure to mark them as test errors instead of failed.
Change-Id: Idc6819aaf0b01e70c38fad828dd44dcec6bdd778
It's not needed for the functionality/scenario of f_gtpu_xceive_mo. It
probably was left in when creating it from f_gtpu_xceive_mo.
Change-Id: Ide226f8501c4598e2bfaa5f1ea62c3ff20807ce4
At the moment the RTP stream emulation is left in its default
configuration, this means that the payload type that appears in the RTP
stream is always 0. This may mismatch the payload type that is
configured with MGCP.
If nothing else is set, we should make sure that whan we create and modify
flows, the RTP emulation is always reconfigured to use the payload-type that
we set in the flow parameters. The other rtp-emulation parameters should
be set to their defaults.
- Make sure f_flow_modify and f_flow_create set the rtp flow parameters
properly.
Change-Id: Ie888424ac3e0bf0d960b6f071855b6dd43935a0e
Related:OS#3384
The IPACC and MDCX interaction happens nearly in parallel to the
normal RSL connection that handles the handover, in particular the
channel relase from the old BTS may arrive in between IPACC and MGCP
operations.
- When the channel release arrives, check if MGCP and IPACC
operations are done (we have seen one MDCX on MGCP and an CRCX
plus an MDCX on IPACC level)
Change-Id: I207e9ece48ec53f872f82d981435cee7c2d0b094
Related: OS#3396
The test currently crashes osmo-msc, which is fixed by
I5c30e0f9545fb76615776ff6cc16b56aeb5b043a (osmo-msc).
Related: OS#3062
Change-Id: Ic80646e1fba37bb6163ca3a7eead7980b4ad7a51
Do not delete the PDP context too early, and look for the second DNS
server in the correct place (2nd match on IPCP protocol, not 1st).
Update a comment which talks about a bug which has been fixed.
Change-Id: I109491cc9ccb060792e29bf6b2999ef48723edbf
Related: OS#3319
Related: OS#3381
The function f_check_mgcp_expectations() checks the counters that
count the occurrence of MDCX and CRCX messages against computed
expected values. At the moment it is not easy to spot where exactly
the deviation occurred. Lets add some log output so that we can see
which type of message on which connection was missing or too much.
Also add a string parameter that is set to the calling functions
name so that we know from where the check has been triggered.
- Add more verbose log output for counters
- Add parameter to prepend to the log line
Change-Id: Ida0eba4ef3c1db977d392267ef76ec37b87133b3
Related: OS#3292
The function f_establish_f_establish_fully does not yet handle the
case where calls get switched locally. In those cases we expect to
see one additional MDCX before the BSSMAP ASSIGNMENT COMPLETE is
sent.
- Check exp_ass_cpl if the call is expected to be LCLS and expect
another MDCX for those cases.
Change-Id: I55fae5ab03980cd810ed7dc38208550686b1659e
Related: OS#3292
Specs state in 3GPP TS 24.008 that TearDownInd IE is optional, so allow
possibility to omit it.
Also fix protocolConfigOpts being passed as parameter but not being used
in template tr_SM_DEACT_PDP_REQ_MT.
Change-Id: I006d64f51c17a22a42a225ddfa4119933e48a022
According to
"""
If a GSN receives a Delete PDP context without a Teardown In
dicator or with a Teardown Indicator with value set to
"0" and only that PDP context is active for a PDN connection, then the
GSN shall ignore the message.
"""
Change-Id: Id5d4774d719685631e4b467dff833ae886c90145
Some GTP messages like Echo Request, Echo Reply and Ind Error don't use
the TEID value. According to 3GPP TS 29.060 sec 9.3.1 in those cases the TEID is
set to 0:
"""
- TEID: Contains the Tunnel Endpoint Identifier for the tunnel to which this T-PDU belongs. The TEID shall be
used by the receiving entity to find the PDP context, except for the following cases:
- The Echo Request/Response and Supported Extension Headers notification messages, where the Tunnel
Endpoint Identifier shall be set to all zeroes.
- The Error Indication message where the Tunnel Endpoint Identifier shall be set to all zeros.
"""
Change-Id: Ic702b78028e850ed961ef805f35e10a42da34e56
as_media handles the MGCP interaction for most of the tests. However,
it does not make sure if transactions are missing or if too many
transactions are performed (e.g. if an SCCP-Lite tests still creates
the connections pointing to the core network, even if they must not
created by the BSC in this case). So lets make sure that the MGCP
transactions are performed as expected by counting them.
- Add counters to count CRCX and MDCX transactions
- Check those counters after call establishment and handover
Change-Id: Ib073b097a840ca3a8ee99c4ed41f59f574191d98
Related: OS#3292
as_media() tests both, IPACC/RSL media handling and MGCP media
handling. These two domains are technically quite separate, which
means we can split them up into two separate altsteps in order
to increase readability of the code.
- Split as_media() into as_Media_ipacc() and as_Media_mgw()
Change-Id: I539e8ffdb9f99d5a8e730dd918df502614b9e84d
Related: OS#3292
since the local MGW may not support transcoding, osmo-bsc should
avoid to LCLS call legs that use different codec/rate. This test
attemts to set up a call with different codec rate and checks if
those legs do not get LCLSed
Change-Id: I91b132306e530ad9ca03fb4a34012381be6b0b52
Depends: osmo-bsc I157549129a40c64364dc126f67195759e5f1d60f
Related: OS#1602
At the moment LCLS is only tested using GSM-FR. There are not LCLS
tests that test with GSM-HR yet. Lets make GSM-HR available and see
what happens when we run BSC_Tests_LCLS.TC_lcls_gcr_bway_connect
on HR instead of FR.
- set channelType depending on g_pars.ass_codec_list.codecElements[0]
- add testcase TC_lcls_gcr_bway_connect_hr
Related OS#1602
Change-Id: I2421519a642bdb7453ae4a9058e177845690a489
This will prevent subsequent failures from overwriting the verdict so we
can easily see the root cause of the test failure.
Change-Id: Iba59a69127e845cadbe9aaa1dabd87ff5ce8b43b
Should fix following spotted message in TTCN3 logs:
BTS_Tests.ttcn:1297 Timeout operation on timer g_Tmeas_exp failed: The timer is not started.
Change-Id: Ia28c40e8cb338ecc23f72474832307bba2b09503
When the protocol configuration options (PCO) contain an IPCP container
then lists only one one DNS server (normally there are two included, a
primary and a secondary). Than the parser in osmo-ggsn runs into an
endles loop. This testcase tries to provoke this behavior by sending
PDP CONTEXT ACTIVATE messages with PCO that contain only a single DNS
entry per IPCP container.
The hanging of osmo-ggsn is already fixed (see Depends). However when
Primary and Secondary DNS are in separate IPCP containers, then only
the first IPCP container is parsed (see also OS#3381)
Change-Id: I71761e1f9db7ceac3c3df43d2e539f8c8d53c4fc
Depends: osmo-msc Icffde89f9bc5d8fcadf6e2dd6c0b4de03440edd5
Closes: OS#3288
Related: OS#3381
This hopefully prevents the verdict from changing to a dynamic test case
error during an unclean termination
Change-Id: I20e156982ae8150a9e7a145f66283de4a5d8e0bd
mtc.stop cleanly shuts down a testcase. This avoids errors influencing
the result after the test completed (such as ports being shutdown with
messages arriving on them causing a dynamic test case error).
Change-Id: I0f6e10006f46db0d68796c7082497af90f74cd07
The current osmo-bsc refactoring causes an erratic MR Config IE. This patch
ensures that the ttcn3-bsc-tests catch this error.
Add MR Config IE expectations to g_pars, set these in the two tests that expect
an MR Config IE in the Chan Activ message:
BSC_Tests.TC_assignment_codec_amr_{f,h}
All other tests now verify that there is *no* MR Config IE in RSL Chan Activ
messages -- all other tests request no voice or a non-AMR codec for Chan Activ.
Change-Id: Ie841feed9d5e478bab1fea2bb86f300e84799013
In osmo-bts Change-Id Iea4a4781481f77c6163d82dcd71a844a5be87bf2
we introduce an Osmocom specific "supplementary measurement info IE"
into the RSL MEAS REP message. This commit adds the related type
definitions and extends the related matching in BTS_Tests.ttcn.
Change-Id: I5d1114c73508c67ad7cd9864d7370367612b1241